Is your staff putting patient info into ChatGPT?

A caregiver finishes a long shift and needs to write up a visit. A scheduler wants a kinder way to word a difficult message to a family. An office manager has a pile of intake notes to summarize. Each of them opens a free AI chatbot on their phone and pastes in the details. It saves twenty minutes. It may also have just sent protected health information to a company your agency has no agreement with.

Why this is a real problem

Under HIPAA, any outside company that handles protected health information (PHI) for you needs a Business Associate Agreement, or BAA. Free and standard consumer AI accounts generally do not come with one. When a staff member pastes a client’s name, diagnosis, medications or visit notes into one of those tools, the information leaves your control. You may not be able to see it, delete it, or prove what happened to it.

It does not matter that the staff member meant well. From a compliance standpoint, the agency is responsible for how its workforce handles PHI.

What counts as patient information?

More than people think. Names, addresses, birth dates, phone numbers, diagnoses, medication lists, visit notes, photos and even a combination like “the 82-year-old client on Elm with the hip replacement” can all identify a person.

How to find out if it is happening

1. Ask, without blame. A short anonymous survey (“Which AI tools have you tried for work?”) gets more honest answers than an accusation.
2. Check your Microsoft 365 or Google Workspace admin console. Look at third-party apps people have connected with their work accounts.
3. Look at the software you already use. Your EHR, scheduling, phone or note-taking tools may have added AI features recently.
4. Review company phones and computers for AI apps and browser extensions.

What to do this month

• Write a one-page AI use rule: what tools are allowed, and that PHI never goes into an unapproved tool.
• If staff need AI for documentation, choose a tool that will sign a BAA and set it up with company accounts.
• Spend fifteen minutes in your next staff meeting explaining the rule and why it exists.
• Add AI tools to your HIPAA Security Risk Analysis so they are documented.

If you want help, our Home Care AI Governance Starter covers the inventory, policy, BAA checklist, staff training and HIPAA risk analysis in one fixed-price package.