Ask around your office and you will probably find that someone is already using an AI chatbot at work. They are drafting patient letters, rewording emails and making sense of insurance denials. They are doing it to save time, and they mean well.
The trouble starts when patient information goes into a tool the practice never approved. This is often called shadow AI: AI use that happens outside what the practice has reviewed and signed off on.
The short version
- Staff are likely using AI tools already, whether or not you have a policy.
- Patient information in an unapproved tool can be a HIPAA problem even if nothing bad happens afterward.
- A ban rarely works. A short policy plus an approved tool does.
Why it is a HIPAA problem
- No agreement. Under HIPAA, a company that handles patient information on your behalf is a business associate, and you need a signed Business Associate Agreement before sharing anything. Tools people sign up for on their own usually come with no such agreement.
- No control. You may not know where the information is stored, how long it is kept, or whether it is used to improve the product.
- No record. The practice has no log of what was shared, so there is nothing to review if a question comes up later.
- No undo. Once something is pasted in, you cannot take it back.
Typing a patient’s name, date of birth and treatment details into an unapproved tool can count as an improper disclosure under HIPAA, even when the intent was good.
What it looks like day to day
- Pasting chart notes into a chatbot to get a referral letter.
- Uploading a screenshot of the schedule to ask for help reorganizing it.
- Pasting an insurance denial, patient details included, and asking for an appeal letter.
- Installing a browser extension that can read every page, including your practice management software.
- Recording a patient call with a personal app to get a transcript.
A simple AI policy your practice can adopt
Banning AI outright rarely works. People keep using it and stop telling you. A short, clear policy does better, and it can fit on one page:
- List the approved tools. Name the AI tools the practice has reviewed and signed agreements with. Everything else is off limits for patient information.
- No patient information in unapproved tools. No names, dates of birth, images, chart notes or insurance IDs.
- Work accounts only. No personal accounts for practice work.
- A person reviews everything. AI drafts get read before they go to a patient, a payer or a chart.
- Ask before adding. One named person approves new tools. Make asking easy and fast.
- Report slips without blame. If someone pastes something they should not have, you want to hear about it the same day.
- Train and repeat. Cover it in onboarding and in your regular HIPAA training.
Back the policy with the right setup
People turn to shadow tools when there is no approved option, so give them one. Some business versions of AI tools offer a Business Associate Agreement and admin controls. Confirm that in writing with the vendor before anyone uses it for patient work.
Your IT team can also limit which apps and browser extensions get installed, and watch for patient data leaving the network. And when you do your next HIPAA risk assessment, add AI tools to the list of systems you review. This is where compliance, cybersecurity and day-to-day IT support overlap.
Need help putting an AI policy in place?
Xceltek and our sister company Cytek help practices with HIPAA risk assessments, staff training and the controls that back a policy up.
Common questions
Is using an AI chatbot a HIPAA violation?
Not by itself. It depends on whether patient information goes in and whether the vendor has signed a Business Associate Agreement. Using a chatbot to reword a general office memo is very different from pasting in a patient’s chart.
What counts as patient information?
Anything that identifies a patient and relates to their care or payment. That includes names, dates, phone numbers, photos, X-rays, insurance IDs and account numbers.
Should we just block AI tools?
Blocking has a place, especially on computers that run your practice management software. It works best alongside an approved tool and a clear policy, so staff have a safe way to get the same help.
