The Free AI Tool Your Front Desk Is Probably Using (and the HIPAA Risk)

Are you HIPAA compliant with your AI tools?

When you run a medical practice, someone at your front desk is likely using ChatGPT or another free AI tool.

They may draft a patient letter.

They may rewrite an appointment reminder or summarize a long insurance email. This raises HIPAA compliance and using AI safely concerns.

They’re not trying to cause trouble. It just saves time, and your team is busy. But it creates a risk most practices don’t know they have.

Why it’s a HIPAA problem

When someone types patient information into a free AI tool — a name, a date of birth, a diagnosis, even details in a letter — that data leaves your practice. Three things make that a problem:

1. There’s no agreement in place. HIPAA requires a Business Associate Agreement (BAA) with any outside company that handles patient data for you. Free consumer AI tools don’t sign one.
2. There’s no record of what was shared. If you’re ever audited or have a breach, you can’t say what patient information went where.
3. The data may be kept and used. Depending on the tool and its settings, what your staff types can be stored and used to train the AI model.

Put together, typing patient information into a free AI tool can count as a HIPAA violation, even when nobody meant any harm.

Why banning it won’t work

The natural reaction is to block ChatGPT and send a memo. That rarely works.

The team started using AI because it solved a real problem. However, take the tool away and the problem is still there. People will find a workaround — a personal phone, a different free tool, a browser at home. Now, HIPAA compliance and using AI safely remain at risk, and you can’t see it.

What works instead

Give your team an AI tool that does the same job, safely. That means:

• A tool covered by a BAA, set up so patient data stays private and isn’t used for training.
• Clear, simple rules for what can and can’t go into AI, written for front-desk staff, not lawyers.
• Visibility for you, so you know which tools are in use and what they’re connected to.
• Templates for the common tasks: patient letters, reminders, referral summaries, and insurance replies.

Your staff keeps the time savings. Your practice stays compliant.

A quick question to ask your team this week

Ask, without judgment: “Is anyone using AI to help with letters or emails?” You’ll likely get a few honest yeses. That’s not a problem. It’s your starting point.

This is the work we do with medical practices. We help your team use AI to save time without the HIPAA risk.

Additionally, we show how we support HIPAA compliance and using AI safely for practices.