Introduction

Somewhere in your practice this week, someone pasted a patient’s information into a chatbot. Maybe your office manager asked it to rewrite a denial appeal to an insurer. Maybe a hygienist used it to draft post-op instructions for a specific case. Maybe someone dropped in a messy paragraph of clinical notes and asked for a cleaner version to send to a referring provider. Nobody did anything malicious. They were trying to get through the day faster, and the tool is genuinely good at that. That is exactly why this is a problem worth taking seriously — the behavior is helpful, invisible, and spreading through dental and medical offices faster than any policy has caught up with it. The industry calls this “shadow AI”: employees using AI tools your practice never evaluated, never approved, and cannot see. Unlike ransomware, it does not announce itself. There is no encrypted server, no ransom note, no downtime. There is just protected health information sitting on a vendor’s servers under a set of terms nobody at your practice ever read. This article covers what HIPAA actually requires here, which AI vendors will and will not stand behind their tools with a signed agreement, and what a realistic policy looks like for a practice that does not want to ban AI outright — because banning it outright almost never works.

1. What shadow AI actually looks like in a practice

When practice owners hear “AI risk,” they picture something exotic. The reality is mundane. In dental and medical offices, the recurring patterns look like this:

• Insurance and billing correspondence. Appeal letters, predetermination narratives, and claim disputes get pasted in wholesale — usually including the patient name, date of birth, procedure codes, and clinical justification.
• Clinical note cleanup. Rough chart notes go in, polished prose comes out. Every identifier in the original goes with it.
• Patient communication. Drafting a reply to an upset patient’s email, which means the patient’s email and complaint go into the prompt.
• Referral and specialist letters. Full clinical summaries, by definition.
• Spreadsheet work. Someone uploads a recall list or an accounts-receivable export to get help sorting it. That single file can contain hundreds of patients.

Notice that none of these are people goofing off. They are all real work. That is what makes a blanket ban so ineffective — you would be asking staff to give up a tool that visibly makes their job easier, with nothing offered in return. They will simply do it on their phones instead, where you have no visibility at all.

2. Why the free tier is the whole problem

HIPAA does not say “do not use AI.” It says that when a vendor creates, receives, maintains, or transmits protected health information on your behalf, that vendor is a business associate — and you need a Business Associate Agreement with them before any PHI changes hands. That is the entire crux of it. A BAA is what contractually obligates the vendor to safeguard PHI, restrict how it is used, report breaches back to you, and submit to the relevant parts of the Security Rule. Without one, sending PHI to that vendor is an impermissible disclosure, full stop. It does not matter how secure the vendor’s engineering is. It does not matter that the data was probably never seen by a human. The agreement is the control HIPAA cares about. Consumer AI tiers — the free plans, and in most cases the individual paid plans your staff might expense — are not offered with a BAA. The vendors say so plainly in their own documentation. So the same chatbot can be perfectly acceptable on one plan and a compliance violation on another, with an identical interface and no warning on screen telling your staff which one they are sitting in front of. This is also why “our IT is secure” is not an answer. The exposure here is contractual, not technical, and it is one of the gaps a proper HIPAA audit for a dental practice is designed to surface.

3. Which AI tools will actually sign a BAA

The good news is that most of the major vendors now have a compliant path. The catch is that the path is almost never the plan your staff signed up for on their own. Here is where things stand as of 2026 — verify current terms before you rely on any of it, because these programs change often.

OpenAI (ChatGPT)

OpenAI will sign a BAA for its API platform and for sales-managed ChatGPT Enterprise and Edu accounts, and it launched a dedicated healthcare offering in January 2026. What is not covered: ChatGPT Free, Plus, Pro, Team, and the self-serve Business plan. Those tiers are not eligible for a BAA, which means PHI does not belong in them.

Microsoft 365 Copilot

This is the easiest win for most practices already on Microsoft 365. Microsoft 365 Copilot on commercial enterprise plans falls under Microsoft’s HIPAA BAA, which is part of the standard Data Protection Addendum most organizations already have in place. If you are already covered for Exchange and SharePoint, Copilot inside Outlook, Word, and Teams is generally in the same scope — but confirm it in writing rather than assuming.

Google Gemini in Workspace

Gemini can be covered under the Google Workspace BAA on eligible business and enterprise editions, provided you configure it according to Google’s HIPAA implementation guide. The configuration step is not optional decoration; coverage depends on it.

Anthropic (Claude)

Anthropic offers BAA coverage for its API and for eligible Enterprise organizations. Notably, Enterprise coverage is not automatic — an organization owner has to switch on the HIPAA-ready configuration in settings and accept the BAA there. Free, Pro, Max, and Team plans are not covered. The pattern across all four is the same: a business-tier account under your practice’s control, with the agreement explicitly in place. An employee’s personal login never qualifies, no matter what they are paying for it.

4. “But I took the name out first”

This comes up constantly, and it is worth addressing directly because the instinct is right even though the execution usually is not. Yes, de-identified information falls outside HIPAA. But HIPAA’s Safe Harbor method sets a specific bar: eighteen categories of identifiers have to be removed. That list is longer than most people assume. It covers names, but also all geographic subdivisions smaller than a state, every date more specific than a year that relates to the individual, phone and fax numbers, email addresses, medical record and account numbers, health plan numbers, device identifiers, biometric identifiers, and full-face photographs — among others. Deleting the patient’s name from a chart note that still contains their date of birth, their ZIP code, their treatment dates, and their account number has not de-identified anything. And a rare condition combined with a narrow geography can re-identify someone even after the obvious fields are stripped. De-identification is a legitimate strategy, but it is a documented process with a defined standard — not a quick visual scan by a busy front-desk employee at 4:45 on a Friday. If you cannot show your work, do not count on it.

5. What a practice AI policy needs to say

The policies that work are short, specific, and tell people what they can do. The ones that fail are two pages of prohibition. At minimum, yours should answer:

• Which tools are approved, by name and by plan. “Microsoft 365 Copilot on our business account” is a usable instruction. “Approved AI tools” is not.
• What may never go into any AI tool. Spell out the identifier categories in plain language rather than citing regulation numbers.
• What AI is explicitly fine for. Drafting general patient-education content, rewriting your website copy, building a staff training outline, summarizing a vendor contract — none of that involves PHI, and calling it out gives people a legitimate outlet.
• Who to ask. One named person who can approve a new tool or answer a judgment call, so the answer to an ambiguous case is a question rather than a guess.
• That AI output gets reviewed before it goes out. These tools produce confident, fluent, and occasionally wrong text. Nothing clinical or contractual leaves the office without a human reading it.
• Personal accounts are not permitted for practice work. This is the single line that closes the largest gap.

HIPAA already requires workforce security awareness training. Fold AI use into the training you are doing anyway rather than treating it as a separate initiative — and document that you did, because documentation is what an auditor asks for.

6. The controls that make the policy real

A policy nobody can enforce is a policy nobody follows. A few practical measures close the gap between the document and the behavior:

• Provide a sanctioned tool. This is the highest-leverage step by a wide margin. If staff have a fast, approved option, most shadow AI disappears on its own. If they do not, no amount of policy will hold.
• Update your risk analysis. The Security Rule requires an accurate assessment of risks to electronic PHI. If AI tools have entered your workflows and your risk analysis does not mention them, it is out of date — and that document is one of the first things requested in an investigation.
• Know what is running on your network. DNS filtering and endpoint monitoring can show you which AI services practice devices are reaching, which turns “I think we’re fine” into an actual answer.
• Watch browser extensions. AI writing assistants installed as extensions can read page content — including what is on screen inside your practice management software. Manage extensions centrally.
• Add AI to your vendor review. Your PMS, imaging platform, and billing service are all shipping AI features now. When a vendor turns one on, confirm your existing BAA covers it. Features sometimes ship ahead of the paperwork.

7. What to do if PHI already went into a free AI tool

Assume it has, because it probably has. Panic is not the response; process is. An impermissible disclosure is presumed to be a reportable breach unless you can demonstrate a low probability that the PHI was compromised, based on a documented risk assessment. That assessment weighs the nature and extent of the information involved, who received or accessed it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Deleting the conversation and disabling model training on the account are real mitigation steps and belong in that write-up. If the analysis lands on a reportable breach, notification timelines apply — individuals must be notified without unreasonable delay and no later than 60 days from discovery. Breaches affecting 500 or more individuals carry additional and faster obligations to HHS and, in some cases, the media. Smaller incidents are logged and reported to HHS annually. Two things matter more than anything else here. First, do the assessment and write it down; an undocumented conclusion is worth nothing later. Second, involve someone who has handled this before — your compliance counsel and your IT provider — rather than deciding on your own that it was probably fine. If you want the underlying obligations in one place, our HIPAA compliance checklist is a reasonable starting point.

Conclusion

AI is not the next ransomware. It is not an attack, and treating it as one leads practices to write bans that get ignored within a month. It is closer to the arrival of email or the smartphone: genuinely useful, adopted from the bottom up, and quietly capable of moving protected health information somewhere it should not be while everyone assumes someone else approved it. The practices that handle this well over the next year will not be the ones that said no. They will be the ones that picked a tool with a signed BAA, wrote a one-page policy their team can actually remember, updated their risk analysis, and spent twenty minutes in a staff meeting explaining why the free version is different from the business version. That is a modest amount of work, and it is far less expensive than the alternative. If you are not sure what is already in use in your office, that is the place to start. You cannot govern tools you cannot see.