What should a practice’s AI use policy for staff include?

In most practices I walk into, AI is already in use. Someone at the front desk drafts emails with it, a hygienist asks it to reword post-visit instructions, a manager summarizes a vendor contract. Nobody decided any of this. A staff AI policy is how the practice catches up with what is already happening, before a patient’s details end up somewhere they should not be.

Why does a practice need an AI policy at all?

Because HIPAA already expects written policies and training, and AI tools create new ways to break them. HHS’s summary of the Privacy Rule says a practice must train all workforce members on its privacy policies as needed for their jobs, and must apply sanctions to those who violate them. An AI policy puts the new tools inside that existing duty.

Workforce is wider than payroll. HHS includes employees, volunteers, trainees and others under the practice’s direct control. So the policy covers the student shadowing on Tuesdays and the temp covering the front desk, not only the permanent staff.

Start from what staff already do. When I ask a front-desk team which AI tools they use, the full answer usually takes a few minutes and some reassurance, because people expect to be told off. Make it safe to answer. A policy written from real use will fit the practice. One copied from a template will be signed and ignored.

What sections should a practice AI policy include?

Seven short sections cover most practices: approved tools, what may go into them, required human review, patient-facing disclosure, who owns the policy, how to report a mistake, and sanctions. Each one should fit in a paragraph. If a section needs a page, the rule inside it is probably not clear yet.

The reporting section deserves more attention than it usually gets. HHS says a practice must mitigate, to the extent practicable, any harmful effect it learns was caused by a disclosure by its workforce or its business associates. You can only mitigate what you hear about, so a staff member who pasted a patient note into the wrong tool has to feel able to say so within the hour.

Which AI tools can staff use with patient information?

Only tools the practice has a signed business associate agreement with, set up the way the practice approved. HHS requires a written agreement before a vendor handles patient information on the practice’s behalf, and its cloud guidance says storing or processing that data with a vendor without one violates the HIPAA Rules. Everything else is off-limits for patient data.

Write the list by product and plan, because the same brand can have a consumer version with no agreement and a business version with one. “ChatGPT is fine” is not a usable rule. “Our business workspace, signed in with your practice account, is approved for drafting patient letters. Personal accounts are not approved for anything involving patients” is.

Is it safe if staff remove the patient’s name first?

Usually not. HHS recognizes two ways to de-identify health information. The Safe Harbor method requires removing eighteen types of identifiers, which include all date elements except the year, most geographic detail, record numbers, full-face photos and voice prints. A note with the name deleted but the visit date and town left in is still protected information.

For a staff policy, the simple version is better than the precise one. “If it came from a patient’s record or a patient conversation, it goes only into approved tools.” That rule is easy to remember and hard to get wrong, which is what a rule for a busy Tuesday afternoon needs to be.

Who should review what AI drafts?

The person whose name goes on it. A clinician reviews and signs any note an AI scribe drafted. A staff member reads any patient message before sending it. The owner or manager approves anything public, such as review replies and website copy. The policy should say that AI may draft, and a named person approves and sends.

Apply the minimum necessary standard to the drafting itself. HHS asks practices to take reasonable steps to limit the patient information used to what the purpose needs. If a tool can write the reminder from a name and a time, it does not get the chart.

How often should an AI policy be updated?

Whenever a new tool is added, and on a fixed date at least once a year. HHS guidance on risk analysis says the analysis should be revisited when a practice plans to bring in new technology, so tie the two together: no tool goes on the approved list until the risk analysis has been updated for it.

1. Ask staff, without blame, which AI tools they already use and for what.
2. Sort each tool into approved with patient data, approved without patient data, or not approved.
3. Write the seven sections in plain language, one or two pages in total.
4. Train everyone on it, record the training, and have each person sign.
5. Name the owner and set the review date in the calendar.

If you want more structure later, NIST publishes a voluntary AI Risk Management Framework, released in January 2023, with a generative AI profile added in July 2024. It is written for larger organizations, and a practice does not need all of it. It is a good reference when the approved list grows past a handful of tools.