Why AI Use Needs Governing Here
Clinical staff use AI to draft notes, letters and summaries, and the fastest way to get a good answer is to paste in the patient record. Ambient scribes record whole visits. Every one of those tools is handling protected health information, so each needs a business associate agreement or has to be kept away from PHI.
The Policy a New Client Starts With
A client created with the Healthcare industry starts with these policy packs:
- HIPAA — Protected Health Information. PHI may only go to approved (BAA-covered) AI apps, and only after a warning.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
Every client also gets the baseline packs: Credentials & Secrets, CMMC — CUI & Export Control, Visibility Baseline, Prompt Injection & Jailbreaks.
Setting It Up
- Approve the scribe and assistant the practice has business associate agreements for, and block the other scribes.
- Set the practice's work email domains and mark clinical AI apps Work Accounts Only.
- Apply the HIPAA pack so patient identifiers stop on their way to any AI app without an agreement.
- Publish the AI Use Policy and collect each employee's acknowledgment.
Start every client in observe-only mode for two weeks, so the decisions are made on what staff actually use. The shadow AI audit describes the steps.
AI Apps to Decide On First
- AbridgeHigh
- NablaHigh
- FreedHigh
- SukiHigh
- Heidi HealthHigh
- DeepScribeHigh
- Nuance DAX CopilotHigh
- OpenEvidenceHigh
- Doximity GPTMedium
- Otter.aiMedium
- NottaMedium
- PlaudMedium
- DescriptHigh
- RevHigh
- TrintHigh
Compliance
HIPAA: the controls ProctoredAI evidences, the packs and the checklist.
Questions
Can a medical practice use ChatGPT?
Only through a service covered by a business associate agreement, and only for the minimum necessary information. The practice can approve that service and block the rest.
Which health identifiers are detected?
Medical record numbers, NPI numbers and ICD-10 codes, alongside Social Security numbers and dates of birth, plus documents that read as medical records.
What about AI scribes?
Scribes record patient visits, so the practice should approve one under an agreement and block the others. The catalog lists the scribes ProctoredAI recognizes.
All industries · The MSP AI governance guide · AI policy template