Can we use ChatGPT with patient information?

Only if you have a BAA with the vendor and the specific service is covered by it — which is not the case for consumer ChatGPT plans. Your policy should name the approved tools and prohibit PHI everywhere else.

Do AI scribes need to be in the policy?

Absolutely. Ambient scribes record entire patient encounters. The policy should require a BAA, patient notice where required by state law, and clinician review of every AI-generated note.

AI Policy Template for Healthcare Practices

Healthcare practices face the strictest AI constraints of any industry: HIPAA applies to every AI tool that touches patient information, and the popular consumer chatbots don't offer Business Associate Agreements on free plans. Meanwhile AI scribes, billing assistants, and patient-message drafting are becoming standard. The gap between what staff are already doing and what's legally permitted is exactly what a written AI policy closes.

Generate a policy customized for healthcare practices in about 3 minutes:

Generate an AI policy for healthcare practices

Free preview · $49 one-time to download

AI risks specific to healthcare practices

Pasting patient details into a chatbot without a BAA is a HIPAA violation, even if names are removed carelessly
AI scribes and transcription tools record PHI and need vendor agreements before use
Clinical decisions influenced by AI output require documented clinician review
Patients may need to be informed when AI tools participate in their care or communications

Compliance requirements your policy must address

HIPAA

Protected health information (PHI) as defined by HIPAA must never be entered into any AI tool unless the Company has a signed Business Associate Agreement (BAA) with the tool vendor and the tool has been explicitly approved for PHI by management. Employees must treat any patient or health-related information as PHI unless told otherwise.

AI Governance and Billing Integrity

AI tools that create, receive, maintain, or transmit PHI must be included in the Company's HIPAA security risk analysis and technology asset inventory; a vendor's own security or compliance claims do not substitute for the Company's own risk assessment. Decision-support or predictive tools used in patient care, including those built into certified electronic health record systems, are subject to the Section 1557 prohibition on discrimination on the basis of race, color, national origin, sex, age, or disability, and the Company will make reasonable efforts to identify and mitigate that risk before and during their use. Any AI-generated clinical note, code, diagnosis prompt, or billing suggestion, including prompts to add risk-adjusting diagnoses, must be reviewed and confirmed by the treating clinician before it affects a medical record or a submitted claim; federal enforcement authorities have identified AI-influenced documentation and coding as an active enforcement priority, and accepting an AI-generated suggestion without independent clinical verification is not a defense in a billing integrity review.

Patient Notice and AI Scribe Consent

Before an ambient AI scribe or any other tool records, transcribes, or summarizes a patient encounter, the patient must be told what the tool does and must agree to its use, and that consent must be documented; a patient who declines is seen and documented without the tool. Where state law requires it, patients must be informed when AI is used in their care or in communications sent to them, and any AI-drafted patient communication must be reviewed by a clinician before it is sent. Recordings and transcripts are retained only as long as the approved tool's agreement and the Company's record-retention rules allow.

What a complete AI policy for healthcare practices includes

Purpose, scope, and who the policy covers (employees, contractors, volunteers)
Approved AI tools and the process for approving new ones
Acceptable uses — and the prohibited list, including data that must never enter prompts
Privacy-law clauses for your jurisdictions (GDPR, EU AI Act, CCPA, PIPEDA) plus HIPAA and AI Governance and Billing Integrity and Patient Notice and AI Scribe Consent requirements
Human review and accountability rules for AI output
Incident reporting, enforcement, and annual review

Frequently asked questions

Can we use ChatGPT with patient information?: Only if you have a BAA with the vendor and the specific service is covered by it — which is not the case for consumer ChatGPT plans. Your policy should name the approved tools and prohibit PHI everywhere else.
Do AI scribes need to be in the policy?: Absolutely. Ambient scribes record entire patient encounters. The policy should require a BAA, patient notice where required by state law, and clinician review of every AI-generated note.

Get your AI policy for healthcare practices

Answer a few questions, preview the full document free, and download it as editable Word for a one-time $49.

Start the generator

DraftAIPolicy is not a law firm; documents are self-help templates, not legal advice.

Related guides

Other industries

Dental Practices Physical Therapy & Rehab Clinics Mental Health & Counseling Practices Home Health & Hospice Agencies Veterinary Clinics Financial Advisory Firms Insurance Agencies Education (K-12 & Districts)