Quick check
Guess first, no penalty. You delete the patient's name from a visit note before pasting it into a free public chatbot (an AI chat tool anyone can use online). Is it safe now?
PHI (protected health information) is health information that can identify a patient. HIPAA's Safe Harbor method for de-identifying it lists 18 kinds of identifiers, from "(A) Names" to "(D) Telephone numbers", "(F) Electronic mail addresses" and "(H) Medical record numbers" (45 CFR 164.514(b)(2)). Deleting the name isn't de-identifying.
Approved tools only
A vendor that handles PHI for a provider is a business associate and needs a business associate agreement, a contract that protects the data. HHS's own examples include an AI chatbot on a patient portal. A free chatbot you signed up for yourself has no such agreement with your employer.
In the UK, the ICO (the data protection regulator) treats "data concerning health" as special category data under UK GDPR, which gets extra protection.
So patient data goes only into tools your organization approved for it. Everywhere else, use blanks:
Rewrite this appointment reminder so it's friendly and under 50
words: "[Patient name], your appointment with [clinic] is on [date]
at [time]. Please bring [documents]." Keep every blank as it is.Fill the gaps
Fill the gaps in the same request.
Request
Rewrite this appointment reminder: ", your appointment with [clinic] is on ."
Try it
Your steps, about 2 minutes
- 1.Add line 5 to finish your Record check sheet: "Patient data only in approved tools. Blanks everywhere else." Then find out which AI tools your organization approved, and for what data.2 min