Blog & news

Shadow AI: why clinicians paste patient data into chatbots

Shadow AI is what happens when the approved tool is slow and the phone chatbot is one tap away. The fix is workflow, not another memo.

DR GPT™ brand mark

DR GPT™ perspective

Shadow AI is not a mystery. It is what busy clinicians do when the approved tool sits behind two logins, only works on a desktop, and the phone chatbot is already unlocked.

In the KevinMD essay, I describe a familiar night-shift picture: a septic patient, a noisy hallway, a complex discharge, and a hospital AI product that cannot keep up with the moment. The point is not to scold anyone who has typed a clinical question into a consumer chatbot. The point is to name the gap. If the safe path is harder than the risky path, people will choose the risky path.

What safer looks like in practice

Leaders who want less Shadow AI need three things that show up in the workflow, not only in a policy PDF.

  1. One approved place to ask. Clinicians should not have to hunt across portals to find the sanctioned tool.
  2. Speed that matches the floor. If the answer arrives after the patient has left the department, the tool lost.
  3. Clear rules on what never leaves the chart. Names, record numbers, dates of birth, and other identifiable details stay inside systems that are built for them.

AI can help improve care here. It can draft discharge language a family can follow, or turn a long outside record into something a clinician can actually use at 3 a.m. That help only counts if it is available where the work happens and under rules the organization can defend.

What I want hospitals to measure

Stop counting only "AI seats licensed." Start counting how often clinicians open the approved tool during a shift, how long it takes to get a usable answer, and how many workarounds IT still hears about in hallway conversations. Those numbers tell you whether Shadow AI will shrink or grow.

If you are a clinician reading this, the short rule is simple. Treat consumer chatbots as study aids for thinking, not as a place for real patient data. If you are a leader, make the approved option the easiest option.

By Harvey Castro, MD, MBA. Originally published 2026-11-05 on KevinMD.

Read the full article on KevinMD.

Browse my KevinMD archive or explore healthcare AI keynotes and workshops.