From the Finally archive. The service offers are closed. See current work at Local Current.
Is it safe to use AI in a healthcare practice?
For practice operations and content, yes, with clear boundaries. For anything containing protected health information, no, unless you have done the specific work of a HIPAA-compliant setup with a signed BAA. Most practitioners have not, and most tools do not offer one.
The simple working rule: if it would be a HIPAA problem to email it to a stranger, it's a HIPAA problem to paste it into a chatbot.
What counts as PHI here?
Broader than people assume. Not just names. Any of the eighteen identifiers tied to health information. A date of birth plus a condition. A photograph. An address with a diagnosis.
A small-town detail specific enough to identify someone, like "the 52-year-old firefighter from Soquel with the thyroid case," is PHI in practice even without a name attached, because in a community that size it identifies a person.
That last one is where careful practitioners slip. Not by pasting a chart. By describing a case in enough detail to be useful.
What's clearly fine?
- Drafting posts, newsletters, and handouts from your own general clinical knowledge
- Rewriting your own material for a different audience
- Summarizing published research
- Practice operations that contain no patient data: your policies, your pricing, your scheduling procedures, your FAQ answers
- Fictional composite cases you wrote yourself
What's clearly not?
- Any chart note, intake form, lab result, or message from a patient, pasted into a general AI tool
- "De-identified" case details that remain identifiable in a small community
- Any patient-facing AI that gives individualized clinical guidance, unless you've built it deliberately, with counsel, and with the compliance infrastructure that requires
What about the tools that say they're HIPAA compliant?
Some genuinely are. AI scribes and EHR-integrated tools built for clinical documentation, sold with a BAA. That's a real category, and if you want AI in the treatment room, that's where to look.
But "HIPAA compliant" on a marketing page means nothing without a signed Business Associate Agreement between you and that vendor. If they won't sign one, the tool is not compliant for your use no matter what the homepage says. That's the single question to ask, and it settles it fast.
Where I've drawn the line in my own work
Everything I build and teach is content and practice operations only. No patient data, no clinical decision support, no patient-facing advice. Not because it's impossible, but because the compliance surface is a different business and I'd rather do one thing without asterisks.
If you want a system that helps you market your practice, that's what this is. If you want an AI scribe for your notes, buy a HIPAA-compliant scribe with a BAA. Those are different purchases, and anyone blurring them should worry you.
A practical first step
Write a one-page rule for yourself and anyone who touches your marketing: what goes in, what never does, who to ask. It takes twenty minutes, and it's the thing that actually prevents the mistake. Most breaches in small practices are a well-meaning assistant, not a hacker.
From the Finally archive
This article documents an earlier content system. The Finally service offers are closed.