Resource
What Healthcare Practices Need to Know About AI Tools and Client Confidentiality
Clinical staff are already using AI to save time on documentation, whether or not the practice approved it. The question isn't whether AI is in your environment. It's whether it's touching PHI in ways that violate HIPAA and expose the practice to real fines and, in the worst cases, real prison time.
The real pattern: personal AI, not sanctioned tools.
Most AI exposure in healthcare doesn't start with an approved enterprise tool. It starts with an individual provider or staff member pasting a patient note into a free AI tool to draft a summary faster, or using a personal AI scribing app that wasn't reviewed by anyone. It's not malicious. It's someone trying to get through their day. But the moment PHI is typed into a consumer AI tool with no Business Associate Agreement, the practice has almost certainly violated HIPAA, whether or not anyone intended to.
"It's just playing music" is not a defense.
Not every AI exposure comes from someone deliberately using a chatbot. A smart speaker sitting on the front desk to play music is still an always-listening device, and consumer models like Alexa, Google Home, or similar assistants are not HIPAA-compliant by default. These devices listen continuously for a wake word, which means ambient conversation, including a staff member discussing a patient at the front desk, can be captured even when nobody asked the device to do anything. Independent research has documented these devices activating on words that aren't the actual wake word, meaning just playing music doesn't reliably limit what gets picked up.
The recordings don't stay local. Standard consumer devices send audio to the manufacturer's cloud for processing, and that data may be reviewed by employees or contractors, and used to improve the product, with no Business Associate Agreement in place and no practical way for the practice to know what was captured or where it went. A dedicated HIPAA-eligible path exists for healthcare voice deployments, but it requires enterprise enrollment and specific configuration. A consumer device purchased for the front desk and plugged in doesn't qualify, regardless of intent. See Standards & Security Baseline, since this is a device and network segmentation issue as much as an AI policy one.
What actually happens to that data.
Most consumer and freemium AI tools' terms of service allow the company to use submitted data to improve or train future models. That means PHI entered into an unapproved tool isn't just briefly exposed, it may be retained and used to train a system with no way to un-train it or verify it was deleted. Once that happens, the practice has no way to fully account for where that data went or who it might be exposed to next. See AI Readiness & Governance.
What this actually costs.
HIPAA's civil penalties scale by culpability and can reach well into six and seven figures per violation category, adjusted annually. Criminal penalties are separate and apply to individuals, not just the organization: up to one year in prison for knowingly obtaining or disclosing PHI, up to five years if done under false pretenses, up to ten years if done for personal gain or malicious intent. An employee using an unapproved AI tool with patient data typically isn't prosecuted criminally unless intent is involved, but the practice still faces the full civil exposure, and a pattern of staff using ungoverned AI tools is exactly the kind of knew-or-should-have-known failure that pushes an incident toward the higher, willful-neglect penalty tier. See Governance, Risk & Compliance.
Why "we didn't approve it" isn't a defense.
A practice doesn't get to disclaim responsibility for what staff actually do with patient data, even if leadership never sanctioned the specific tool. HIPAA expects the practice to have a documented policy and enforcement mechanism covering exactly this scenario. Not having one is itself a compliance failure, separate from whatever the AI tool did with the data.
Common questions
Questions leadership usually asks first.
Continue reading
Related work and reading.
IT for Healthcare
The full compliance picture this AI-specific risk sits inside.
Read more: IT for HealthcareAI Readiness & Governance
Inventory what AI tools and devices are already touching PHI, approved or not.
Read more: AI Readiness & GovernanceGovernance, Risk & Compliance
The documented policy and enforcement mechanism HIPAA expects to already exist.
Read more: Governance, Risk & ComplianceNext step
Get a clearer view of your IT environment.
Find out what is working, where the risks are, and what needs attention next.