What Is an AI Use Policy?

An AI use policy is a short written rule that tells a practice's staff which AI tools they may use, what they may type into them and who checks the results. For a health practice, the key line is patient information. Where HIPAA applies, patient details belong only in tools whose vendor has signed the right contract. This page is general information, not legal advice, so confirm your setup with your compliance advisor.

How an AI use policy works

Most staff adopt AI tools on their own because the tools are free, fast and useful. A policy turns that scattered habit into a known list. It does not need to be long. One page that people read is better than ten that sit in a folder.

A policy for a health practice answers five questions.

• Which tools are approved? Name them. List the plan too, since a tool can offer different terms on different plans.
• What may go in? Public information, such as a draft blog post built from published facts, is a different case from patient information, such as names, messages, lab results, photos or call recordings.
• What cannot go in? Anything that identifies a patient, unless the tool is on the approved list for that use.
• What must a person check? Medical claims, prices, dates, names and anything that will be published or sent to a patient.
• Who owns the policy? One named person who answers questions and updates the list.

The patient information line comes from the business associate rules. HHS says the HIPAA Rules permit a covered entity to disclose protected health information to a business associate if it obtains satisfactory assurances, in the form of a contract or other written arrangement, that the business associate will appropriately safeguard the information. That arrangement is called a business associate agreement, or BAA. An AI vendor that receives patient information on your behalf can be a business associate. For the full explanation, see business associate agreement. The practical rule for staff is simple. If the vendor has not signed a BAA covering that product, patient details stay out.

Some practices are not HIPAA covered entities, and cash-only practices vary. Confirm that status with a compliance advisor. A practice outside HIPAA can still use the same rule, since patients expect their details to stay private.

The review line comes from how these tools work. A large language model is the technology behind most chatbots. Google's guidance says generative models predict a likely sequence of words based on training data, and they do not retrieve facts, so outputs can contain errors. Google says to fact-check and review AI content before publishing it.

That is the same problem described under hallucination, and the reason health pages need a clinician's eye.

See YMYL for why pages that affect health get a higher bar.

Google also says that using AI tools to generate many pages without adding value for users may violate its scaled content abuse policy. So the policy should say that AI can help draft, and a person must add and check the substance.

Example: an AI use policy at a health practice

This example is illustrative, not a transcript. A functional medicine clinic with eight staff members notices three habits. The front desk pastes patient messages into a chatbot to draft replies. A health coach uses an AI notetaker on calls. The marketing contractor uses AI to draft blog posts.

The clinic's owner writes a one-page policy with her compliance advisor. It approves two tools. The first is a drafting assistant for public marketing content only. The second is a scribe product, but only after the vendor confirms in writing that it will sign a BAA covering that product and the clinic files the signed agreement. The policy says patient messages, lab results, photos and call recordings go only into a tool with a signed BAA on file.

The policy also sets the review rule. A clinician checks every health claim in a blog post, and the contractor records the reviewer's name and date. It says the front desk may use an approved template for replies but must not paste a patient message anywhere else.

Every staff member signs it, and the owner puts a quarterly review on the calendar. Within a month the clinic learns that the chatbot vendor does not sign a BAA at the plan the front desk used. The front desk stops using it for patient messages and uses templates instead. The policy gave the team a line to follow.

How to check yours in 60 seconds

1. Ask three staff members, one from the front desk, one clinical and one from marketing, which AI tools they use at work.
2. Ask what they have typed or pasted into each one.
3. Write down any tool that has seen patient names, messages, results or recordings.
4. Check whether you have a signed BAA on file for each of those tools.
5. Ask whether anything AI-written has been published or sent without a person reading it.

Any tool that saw patient details and has no signed BAA goes to the top of your list.

What to do about it

1. Confirm with a compliance advisor whether HIPAA covers your practice.
2. List every AI tool in use, including the ones staff chose themselves.
3. Ask each vendor in writing whether it will sign a BAA, and which plan or product the BAA covers.
4. Approve tools by purpose, such as marketing drafts or notes, and write the allowed use next to each name.
5. Write the one-page policy. Cover approved tools, what may go in, what may not, who checks output and who owns the policy.
6. Require a named clinician to check health claims before anything is published, and keep a simple log of the reviewer and date.
7. Use invented patients when testing prompts or training staff.
8. Have each employee sign the policy and give a copy to every new hire.
9. Review the list every quarter and whenever someone asks to try a new tool.