For practitioners

Is it safe to use AI in a healthcare practice?

For practice operations and content, yes, with clear boundaries. For anything containing protected health information, no, unless you have done the specific work of a HIPAA-compliant setup with a signed BAA. Most practitioners have not, and most tools do not offer one.

What counts as PHI here?

Broader than people assume. Not just names. Any of the eighteen identifiers tied to health information. A date of birth plus a condition. A photograph. An address with a diagnosis.

A small-town detail specific enough to identify someone, like "the 52-year-old firefighter from Soquel with the thyroid case," is PHI in practice even without a name attached, because in a community that size it identifies a person.

That last one is where careful practitioners slip. Not by pasting a chart. By describing a case in enough detail to be useful.

What is safe to put into a general AI tool, and what is not?

Everything that draws on your own general clinical knowledge is fine. Anything containing real patient data is not, unless the tool is HIPAA compliant and you have a signed Business Associate Agreement.

PHI is defined by the eighteen HIPAA identifiers tied to health information, which is broader than names alone. This page covers content and practice operations only, not clinical documentation. Reviewed August 2026. Not legal advice.

What about the tools that say they're HIPAA compliant?

Some genuinely are. AI scribes and EHR-integrated tools built for clinical documentation, sold with a BAA. That's a real category, and if you want AI in the treatment room, that's where to look.

But "HIPAA compliant" on a marketing page means nothing without a signed Business Associate Agreement between you and that vendor. If they won't sign one, the tool is not compliant for your use no matter what the homepage says. That's the single question to ask, and it settles it fast.

Where I've drawn the line in my own work

Everything I build and teach is content and practice operations only. No patient data, no clinical decision support, no patient-facing advice. Not because it's impossible, but because the compliance surface is a different business and I'd rather do one thing without asterisks.

If you want a system that helps you market your practice, that's what this is. If you want an AI scribe for your notes, buy a HIPAA-compliant scribe with a BAA. Those are different purchases, and anyone blurring them should worry you.

A practical first step

Write a one-page rule for yourself and anyone who touches your marketing: what goes in, what never does, who to ask. It takes twenty minutes, and it's the thing that actually prevents the mistake. Most breaches in small practices are a well-meaning assistant, not a hacker.