AI in health care: Meeting HIPAA standards with ChatGPT

DR GPT™ perspective

This was written before enterprise agreements and business associate arrangements existed for general-purpose models. The principle has not moved: protected health information does not belong in a consumer tool. What has moved is the set of options for doing it properly.

What I tell clinicians today

The rule I teach is short: if it can identify a patient, it does not go into a consumer chatbot. That includes names, dates, record numbers, photos and the kind of detailed story that makes a patient recognizable in a small town.

If your organization wants to use AI with patient information, these are the questions to settle first:

• Is there a signed business associate agreement covering this exact product?
• Is patient data excluded from model training?
• Who can see the prompts and outputs, and how long are they kept?
• Has privacy and compliance approved the workflow, not just the vendor?

Until those answers are in writing, use AI only with information that cannot identify anyone.

Questions people ask

Is ChatGPT HIPAA compliant?

The consumer version is not designed for protected health information. Some enterprise offerings support business associate agreements, but compliance depends on your signed agreement and how you use it.

Can I use AI with de-identified data?

Yes, with care. Remove all identifiers and remember that rare conditions or small communities can make a patient identifiable even without a name.

Originally published on KevinMD. Read the full essay, or see how I build these arguments for a room as a speaker.