This page covers what to do in practice. It is not legal advice. I help clinics set up AI so staff can use it without guessing, and your compliance officer or attorney signs off on the rules.
What should never go into ChatGPT or another public AI tool?
Nothing that identifies a patient goes into a public AI tool. That means names, dates of birth, phone numbers, addresses, record numbers, insurance details, photos, and visit notes, even with the name taken off if the rest still points to one person. A free account typed into by a well-meaning medical assistant is the most likely way a clinic gets in trouble with AI. Assume your staff are already using it at home and tell them plainly where the line is.
What is a business associate agreement, and do I need one?
A business associate agreement (BAA) is a contract where a vendor agrees to protect the patient information you give it. If an AI tool will see patient data, the vendor has to sign one with you first. Some of the big AI vendors offer a BAA on certain business or enterprise plans and not on others. Ask the vendor for it in writing, have your compliance officer read it, and keep a copy. No BAA, no patient data.
Are paid AI accounts safer than free ones?
Paid business accounts are safer than free ones, and they are still not automatically safe for patient data. Business plans from the major vendors generally do not train on what you type and give an administrator control over who has access. Free personal accounts often do train on it and give you no control at all. A paid account without a BAA is fine for work with no patient data in it. Patient data still needs the BAA.
Where can a clinic start with AI safely?
Start with the work that never touches a patient record.
- Scheduling templates and staffing grids.
- Policies and procedures, first drafts your manager and compliance officer then edit.
- Marketing: website pages, service descriptions, social posts, patient newsletters.
- Staff training: onboarding guides, quizzes, how-to sheets for the phone system.
- Job postings and interview questions.
That list alone gives the front office hours back every week, and nobody has to ask whether it is allowed.
What goes in a clinic AI policy?
A clinic AI policy names the tools staff may use, what may never go into them, which tools are covered by a BAA, who approves a new tool, and who to ask when unsure. It fits on one page so a new hire reads it on day one. I write it with your team, and your compliance officer reviews it before it goes out. More on writing an AI policy.
What does it cost to get set up?
A one-page AI policy is $750. A half-day AI workshop for your staff is $1,500, and covers the safe starting list above with your own tools. If you want help getting the whole team using the tools week after week, AI adoption runs from $3,500 a month.
I have done service design and UX research for Medtronic and Fairview Health Services, research-side UX with the University of Minnesota, and healthcare UX for 3M on the agency side. I am not a HIPAA attorney, and the policy goes through yours.
Answered by Jared Lukes, Minneapolis. Twenty-five years in brand, UX, and technology, currently holding fractional AI and technology seats at three companies. About Jared.