Is ChatGPT HIPAA compliant for clinicians? A practical PHI checklist

Start with the account shown on the screen

OpenAI's current HIPAA-eligible products list includes ChatGPT for Healthcare, ChatGPT Enterprise with a Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians, and specified API configurations with Modified Retention. Eligibility applies only under the relevant agreement and to covered functionality.

A personal account is not on that list. Business privacy settings or a promise not to train on customer data do not, by themselves, make an ordinary workspace appropriate for PHI. Before using a tool, the clinician should know who owns the account, which product it is, and whether the organization has approved it for that exact purpose.

Four common clinical tasks, four separate data decisions

A practice should approve workflows, not just brands. A tool might be approved for drafting de-identified administrative copy but not for processing a named referral. It might cover typed chat while a connector or external transcription service falls outside the approved environment.

• Drafting a note: Does the dictated or pasted recap contain names, dates, record numbers, locations, or details that identify the patient?
• Answering a patient message: Will the prompt or output be copied between the AI workspace, inbox, and EHR, and who reviews it before sending?
• Reading a referral: Are the uploaded file, extracted text, generated summary, and any connected storage service covered by the approved workflow?
• Reviewing labs: Does the task require identifiable data at all, and who checks the generated interpretation against the source result?

A BAA is a starting gate, not the finish line

HHS guidance explains that a cloud provider that creates, receives, maintains, or transmits electronic PHI on behalf of a regulated entity is generally a business associate. An appropriate BAA is central to that relationship, but the healthcare organization must still perform its own risk analysis and apply safeguards.

The agreement does not decide which staff members need access, how long a transcript should remain available, whether a connected app is allowed, or which outputs require a clinician's review. Those decisions belong in the practice's policy and configuration.

The clinician's pre-PHI checklist

Before a patient detail enters an AI workspace, a clinician should be able to answer each of the following without relying on assumptions or a marketing badge.

• This is an organization-approved account, not a personal login.
• The exact product and feature are covered by the organization's agreement and BAA.
• The practice has defined which clinical tasks and data are permitted.
• Files, audio, connectors, exports, and support access have been reviewed, not only typed chat.
• Retention, sharing, user access, and offboarding settings match practice policy.
• Generated notes, messages, and summaries are treated as drafts and checked against the source record.
• Staff know where to report accidental PHI disclosure or an incorrect output.

What if you only remove the patient's name?

Removing a name does not necessarily de-identify a record. Dates, addresses, contact details, record numbers, device identifiers, distinctive events, and combinations of facts can still identify a person. HIPAA recognizes specific de-identification approaches; casual redaction should not be treated as a guarantee.

A purpose-built PHI detection or tokenization layer can reduce exposure, but automated detection should still be tested and monitored. The clinical team remains responsible for using the approved workflow and checking what enters and leaves it.

What to do after PHI enters an unapproved account

Stop using that account for patient information and follow the practice's privacy and security incident process. Do not assume that deleting the conversation closes the issue. Notify the designated privacy or security contact, document the minimum facts needed to assess what happened, and avoid copying the same PHI into additional systems while investigating.

The employee who notices the mistake should not have to decide alone whether it is a reportable breach. That determination depends on the facts and belongs in the organization's established assessment process.

The practical bottom line

Some ChatGPT products can support HIPAA-compliant clinical use when the correct agreement, configuration, controls, and organizational safeguards are in place. That does not make every ChatGPT account safe for patient information.

For the clinician closing charts at the end of the day, the rule can stay simple: if you cannot name the approved account, covered workflow, and required review step, do not enter PHI yet. Use the sanctioned clinical workspace or ask the practice's privacy lead before continuing.