Using ChatGPT and Other AI Tools in Your Houston Medical Practice
Yes, your medical practice can use AI, but the task, the information you share, and the vendor’s safeguards all matter. For a HIPAA-covered practice, an AI vendor processing protected health information on your behalf generally needs a Business Associate Agreement (BAA). Your practice also needs to assess the risks and configure the service appropriately. A signed agreement alone does not make every use compliant. [1]
The practical starting point is simple: keep patient information out of unapproved AI tools. Staff can still use AI for useful everyday work, such as drafting general office announcements or brainstorming patient education topics, without uploading patient records.
How Patient Information Can Leak Through AI Tools
A busy afternoon can turn a helpful shortcut into a privacy problem. These are workflows worth reviewing with your team:
- Front desk messaging. A staff member pastes a patient’s message, including a name and treatment details, into a chatbot to help draft a reply.
- AI scribes and transcription apps. A provider records a visit with an app before anyone checks its contract, retention settings, or access controls.
- Scheduling and intake assistants. A website or phone assistant collects names, reasons for visits, and insurance information through an unreviewed vendor.
- Translation and summarization. Staff upload an intake form or chart note to an online tool without knowing how the service will handle it.
Review the AI features inside software you already use, too. A familiar vendor name does not establish that a newly added feature is covered by your existing agreement.
What Makes AI Use Lower Risk or Higher Risk
Protected health information, or PHI, is individually identifiable health information protected by HIPAA. It can include information about care, health conditions, or payment. A name is not the only way a patient can be identified. [1]
Lower risk: Ask AI to draft a generic appointment reminder using invented details, create an office announcement, or suggest a general outline for a patient education handout. Have a qualified staff member review medical content before sharing it.
Requires careful approval: Use an AI scribe or other service with real patient information only after reviewing the specific service, putting the required BAA in place, and establishing appropriate safeguards. [1]
Higher risk: Paste an identifiable patient message into a personal chatbot account, or activate an AI feature that processes PHI before reviewing its coverage and settings. An impermissible disclosure can trigger HIPAA obligations even when staff meant well. [2, 3]
Removing a patient’s name is not enough to establish de-identification. HHS recognizes two methods: Safe Harbor, which requires removing specified identifiers and meeting additional conditions, and Expert Determination. Unusual circumstances and details in narrative notes can still identify someone. Use invented scenarios when patient details are unnecessary. [4]
What to Check Before Approving an AI Vendor
A BAA sets limits on a business associate’s use and disclosure of PHI and requires safeguards, incident reporting, and appropriate obligations for subcontractors. Confirm that it covers the actual product and workflow your practice intends to use. [2]
During vendor review, ask these questions and keep the answers with your approval record:
- Which service, account type, and AI features are covered by the BAA?
- Can prompts, recordings, or uploaded files be used for model training, and do the terms permit only appropriate uses?
- Who can access the data, which subcontractors handle it, and how long is it retained?
- What access controls, activity logs, deletion options, and incident reporting procedures are available?
An enterprise label or a setting that disables training is not proof of HIPAA compliance. Review the agreement and configuration for the exact service instead of relying on marketing language.
A Documented Texas Enforcement Example
In 2019, Elite Dental Associates in Dallas agreed to pay $10,000 and adopt a corrective action plan to settle potential HIPAA Privacy Rule violations involving patient information disclosed in responses to social media reviews. HHS published the settlement on October 2, 2019. [5]
This was a social media case, not an AI case. It illustrates that routine online communication can expose a small practice to enforcement. The $10,000 settlement is a historical example, not an estimate of what an AI incident would cost.
A Hypothetical Houston Practice Example
Consider a Houston dermatology office where a receptionist uses a personal chatbot account to rewrite a patient’s message about a procedure. The message includes the patient’s name and treatment details. This is an illustrative scenario, not a Scorpion client case study.
A sensible response would be to stop that workflow, document what was shared, and have the practice’s privacy lead assess the incident. The office could then adopt an approved-tool list, train staff to use generic message templates, and review any AI service proposed for patient information.
Useful measures would include the percentage of staff trained and the number of AI tools with completed vendor reviews. These are suggested tracking measures, not claimed results from a real engagement.
How Managed IT Can Support Safer AI Use
A written policy works better when your systems support it. Start with an inventory of AI tools and browser extensions, an approval process for new services, and clear examples of what staff may share.
Cloud account monitoring can help identify suspicious sign-ins, app permissions, or sharing activity. Endpoint detection and response can help detect malicious apps and extensions. Neither should be presented as a reliable way to detect a patient detail pasted into an otherwise legitimate chatbot.
Where supported and configured, browser controls and data loss prevention tools can restrict certain services or sensitive uploads. Staff training still matters because technical controls have coverage limits. Dark web monitoring may identify exposed credentials, but it is not a dependable way to discover PHI submitted to an AI service.
For practices considering our Assured or Complete plans, start by reviewing the coverage your workflow needs, including vendor review responsibilities, staff training, and incident response. Confirm the included services and support hours in your agreement.
If Patient Information Has Already Been Shared
Stop further sharing and notify your practice’s privacy or security lead promptly. Preserve the relevant facts, including the tool used, information submitted, account involved, and date. Ask the vendor about access, retention, and deletion while preserving records needed for the review.
An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented risk assessment establishes a low probability that PHI was compromised. Your privacy lead should evaluate any notification obligations; deleting a chat alone does not resolve the incident. [3]
Help Your Team Use AI With Clear Rules
Start with one question at your next staff meeting: which AI tools are we already using? From there, establish approved uses and a simple way to request a new tool before patient information is involved.
If your Houston practice needs help reviewing its technology and AI workflows, contact Scorpion Technology or call 713-623-1266.
Scorpion Technology has provided managed IT services for Houston businesses since 2007, including support for medical practices. Learn more at ScorpionITSupport.com.
Sources
[1] HHS — Guidance on HIPAA and Cloud Computing
[2] HHS — Business Associate Contracts
[3] HHS — Breach Notification Rule
