Patient data stays out of public chatbots

PHI (protected health information) is health information that can identify a patient. HIPAA's Safe Harbor method for de-identifying it lists 18 kinds of identifiers, from "(A) Names" to "(D) Telephone numbers", "(F) Electronic mail addresses" and "(H) Medical record numbers" (45 CFR 164.514(b)(2)). Deleting the name isn't de-identifying.

Approved tools only

A vendor that handles PHI for a provider is a business associate and needs a business associate agreement, a contract that protects the data. HHS's own examples include an AI chatbot on a patient portal. A free chatbot you signed up for yourself has no such agreement with your employer.

In the UK, the ICO (the data protection regulator) treats "data concerning health" as special category data under UK GDPR, which gets extra protection.

So patient data goes only into tools your organization approved for it. Everywhere else, use blanks:

Rewrite this appointment reminder so it's friendly and under 50
words: "[Patient name], your appointment with [clinic] is on [date]
at [time]. Please bring [documents]." Keep every blank as it is.

Try it