“Our front desk uses ChatGPT to clean up emails and draft review replies. Is that a HIPAA problem?”
Using ChatGPT to draft review replies can create a problem under the Health Insurance Portability and Accountability Act (HIPAA), depending on what staff enter into it. HIPAA requires a medical practice to have a business associate agreement (BAA) with any vendor that handles protected health information (PHI) on the practice’s behalf. Consumer accounts for artificial intelligence chatbots do not come with a BAA. When a staff member enters information that identifies a patient together with details about the patient’s care, that information leaves the practice’s control, whether the chatbot is ChatGPT, a competing product, or an AI feature built into another app.
This article explains which marketing tasks put patient information into AI chatbots, what counts as PHI, which AI products offer a BAA, and how to write a one-page AI use policy for your staff. The article provides general information, not legal advice, and your attorney should review your policy before staff are asked to follow it.
This is the second article in our series on AI for medical practice marketing. The first article describes the full content workflow, and this article covers the rules that need to be in place before that workflow starts.
Marketing tasks where patient information ends up in AI chatbots
Patient information usually enters AI chatbots through routine marketing tasks rather than through medical records. Replies to online reviews are a common example. A staff member pastes a review into the chatbot and asks for a polite response. If the review includes the patient’s name, or if the staff member adds a detail such as “she came in last Tuesday for her follow-up” to make the reply sound personal, the chatbot now holds patient information. The added detail also confirms that the reviewer is a patient of the practice, which is itself a disclosure.
Patient stories for social media create a similar risk. A prompt such as “Write a social post about a patient who came to us after two years of knee pain and is now hiking again” leaves out the patient’s name, but in a small community those details can be enough to identify the person. Patient photos carry the same risk when staff upload them to a chatbot to brighten them or remove the background, because the image goes to the vendor’s servers and a full-face photograph is one of the identifiers listed under HIPAA.
Office managers often use chatbots to summarize contact forms and call notes because it saves time. Pasting a day’s contact form submissions or voicemail transcripts into a chatbot sends every name, phone number, and reason for calling to the vendor. Patient testimonials raise a consent issue as well. A patient who agreed to let the practice publish a testimonial on its website did not agree to let a vendor without a BAA process it.
For example, a new front desk employee might paste each day’s voicemail transcripts into a personal chatbot account to sort them into callbacks, prescription refills, and new patient inquiries. The method saves an hour a day, but every transcript includes a name, a phone number, and a reason for calling. No one told the employee not to do it because the practice had no written policy. The one-page policy described later in this article is designed to prevent this situation.
What counts as protected health information
Protected health information is information about a person’s health, care, or payment for care that a medical practice holds and that can be linked to that person. The U.S. Department of Health and Human Services (HHS) lists eighteen identifiers that must be removed before health information is considered de-identified. They include expected items such as name, address, phone number, email address, Social Security number, and medical record number. They also include less obvious items such as any date other than the year, full-face photographs, vehicle license plate numbers, internet protocol (IP) addresses, and any other unique detail that could identify the person.
A visit detail on its own is not PHI. A sentence such as “Maria was in for her thyroid follow-up on the 12th” is PHI, because it combines a name and a date with a health detail. That combination is exactly what appears in many review reply drafts. A reply that confirms someone is a patient of the practice is also a disclosure. In 2023, HHS reached a settlement with a New Jersey psychiatric practice over online review replies that disclosed patient information. Staff can apply a one-sentence test: if a stranger could read the text and figure out who the patient is and something about their care, it should not be entered into an AI tool.
Is ChatGPT HIPAA compliant?
Whether ChatGPT can be used with patient information depends on the plan and on whether the vendor has signed a BAA with your practice. As of October 2026, the consumer plans from the major AI vendors do not include a BAA, and patient information should not be entered into any plan without one.
Some vendors offer versions that come with a BAA. As of October 2026, OpenAI lists a specific set of HIPAA-eligible products, including ChatGPT for Enterprise with Regulated Workspace, and its standard individual and team plans are not on that list. For practices that use Google Workspace, which is Google’s paid email and productivity service, the arrangement is different. Once the practice signs Google’s BAA, Google states that Workspace with Gemini can support HIPAA workloads, so the practice can use Gemini within its Workspace account under that agreement. In every case, the BAA applies to a business account that the practice controls, not to personal accounts that staff created on their own.
Plan names and eligibility rules change often. Before you set up an account, read the vendor’s current HIPAA or BAA page rather than relying on a sales representative’s summary.
A BAA doesn’t make your workflow compliant
A signed BAA covers the vendor’s obligations, not the practice’s. Under HIPAA, responsibility is shared. The vendor agrees to protect the data it holds, and the practice remains responsible for training staff, controlling access, completing its risk analysis, and deciding what information staff enter into the chatbot.
A common gap is the personal account. A practice may sign an enterprise agreement and set up a covered workspace while some staff continue to use the free accounts they already had, because those accounts are already open in their browsers. Work done in a personal account is not covered by the practice’s BAA. For that reason, the practice’s policy must name the approved accounts, not only the approved tool.
What staff can do with AI without PHI
The rules above limit what goes into AI chatbots, but they do not prevent staff from using AI for marketing. Staff can use AI to draft general patient education content, such as what a service involves, what to expect at a first visit, or how to prepare for a procedure, because none of that content involves a specific patient. They can edit copy that is already published on the practice website, and they can write or revise service pages, provider biographies, and frequently asked questions from the practice’s reference documents, which is the same material a medical content engine is built on. They can draft review reply templates, as long as the template is written without a real review in the chatbot and a staff member personalizes it afterward without adding visit details. They can also turn an approved blog post into social media captions and an email, the kind of repurposing that makes content marketing for medical practices sustainable.
Staff can decide what is allowed by looking at what they are about to enter. Information that describes the practice can be entered, and information that describes a patient cannot. Everything drafted this way still needs review before it is published, and the third article in this series explains who reviews AI-drafted content and what they check.
Write a one-page AI use policy
Keep the AI use policy to one page so that staff will read it. Like the rest of your marketing strategy and foundation, it works best when it is written down before the work begins. The policy should cover the following items:
- Approved chatbots and accounts. Name the chatbot, the plan, and the login staff must use, for example “the practice’s enterprise workspace, signed in with your practice email.” State that personal accounts are not approved for any work task.
- Prohibited inputs. List the eighteen HHS identifiers in plain language, along with photos, reviews that contain patient details, form submissions, call notes, and patient messages. Include the one-sentence test from this article.
- Approval. Name the person who approves new AI products and new uses and who answers staff questions about what is allowed.
- Staff training. State when training happens (at hire and once a year), who leads it, and where the signed acknowledgment forms are kept.
- Incident reporting. Explain what a staff member should do as soon as they realize something was entered that should not have been, including whom to tell that same day. State that no one will be penalized for reporting. Your attorney can advise on next steps, and this section makes sure the practice finds out in time to act.
Have your attorney review the policy before you distribute it. After it is approved, have every staff member sign it, and add it to onboarding for new employees.
The mistake to avoid
In our view, banning AI creates more risk than allowing it under clear rules. When a practice tells staff not to use AI at all, some staff use it anyway on personal accounts without telling anyone, which is the situation the policy is meant to prevent. When staff have an approved account and a short list of rules, most will follow them, because the rules are reasonable and the chatbot still saves them time. Write the one-page policy this week, send it to your attorney for review, and then distribute it to your staff.
This article is for general information and isn’t legal advice. Talk to your attorney about your practice’s obligations under HIPAA and your state’s privacy laws.
Net One Click works exclusively with medical practices. If you’d like to talk about how we can help build and grow your practice, book a free consultation.
