Why AI Use Needs Governing Here
Dental AI reads radiographs and charts, front-desk staff use chat assistants for patient letters, and scribes are arriving in the operatory. All of it touches protected health information, and most practices have no record of which AI tools are in use.
The Policy a New Client Starts With
A client created with the Dental industry starts with these policy packs:
- HIPAA — Protected Health Information. PHI may only go to approved (BAA-covered) AI apps, and only after a warning.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
Every client also gets the baseline packs: Credentials & Secrets, CMMC — CUI & Export Control, Visibility Baseline, Prompt Injection & Jailbreaks.
Setting It Up
- Approve the dental AI the practice licenses under a business associate agreement.
- Block consumer chat assistants for patient information, or approve one with an agreement and work accounts only.
- Apply the HIPAA pack so patient identifiers stop before they reach an AI app that isn't covered.
- Report monthly so the practice has evidence ready for its HIPAA risk assessment.
Start every client in observe-only mode for two weeks, so the decisions are made on what staff actually use. The shadow AI audit describes the steps.
AI Apps to Decide On First
- OverjetMedium
- PearlMedium
- Bola AIMedium
- VideaHealthMedium
- AbridgeHigh
- NablaHigh
- FreedHigh
- SukiHigh
- Heidi HealthHigh
- DeepScribeHigh
- Nuance DAX CopilotHigh
- ChatGPTMedium
- ClaudeMedium
- Google GeminiMedium
- Microsoft CopilotLow
Compliance
HIPAA: the controls ProctoredAI evidences, the packs and the checklist.
Questions
Is dental imaging AI covered by HIPAA?
Yes. Radiographs and charts are protected health information, so the vendor needs a business associate agreement like any other.
Do small practices need AI governance?
Size doesn't change HIPAA. A small practice has the same duty to know where patient information goes, and fewer people to notice when it goes somewhere new.
Does it slow down the front desk?
No. Inspection happens on the computer, for AI traffic only, and everything else goes direct.
All industries · The MSP AI governance guide · AI policy template