Your AI Intern Just Started. Now You're Liable for Everything It Does.
You didn't approve a risky system.
You just clicked a button that made your day easier.
Draft a patient email faster.
Clean up an insurance response.
Summarize notes after a long appointment.
It felt harmless.
Until you realize something uncomfortable:
That "helpful" tool has no idea what HIPAA is protecting… and no
boundaries unless you create them.
And if something goes wrong?
It doesn't answer for it.
You do.
Why This Isn't Just a Tech Issue — It's a Compliance Decision
HIPAA doesn't care whether exposure was intentional.
It focuses on one core outcome: protected health information must stay
controlled, traceable, and secure.
That means:
- You must know
where data is going
- You must
control who can access it
- You must be
able to audit what happened
When AI tools store, transmit, or learn from inputs, they can create
something HIPAA calls an unauthorized disclosure of PHI.
Not because your team did something reckless.
Because they did something convenient… without guardrails.
And here's the hard part:
From an auditor's perspective, that's not a mistake.
That's a missing control.
What Non-Compliant AI Use Actually Looks Like (In Real Offices)
Let's remove the theory.
This is what's happening right now inside dental practices:
- A treatment
coordinator pastes patient financing details into a chatbot to "rewrite it
more clearly"
- A front desk
employee copies appointment notes into AI to draft a patient message
- A team member
uses AI to generate insurance appeal language without review
- AI-generated
documents are saved in personal drives or email drafts with no oversight
No one flagged it.
No one reviewed it.
No one documented it.
That's not innovation.
That's exposure without visibility.
A Real Scenario (And Why It Matters)
A front desk coordinator pastes:
- Patient name
- Treatment plan
notes
- Payment
breakdown
- Scheduling
constraints
…into a free AI tool to make it "sound more professional."
The response comes back polished in seconds.
What no one sees:
That information may now be retained, processed, or reused by the
platform depending on its terms.
At that point, you've lost control of:
- Where that data
lives
- Who might
access it
- Whether it can
be audited or deleted
From a compliance standpoint, you've created a potential reportable
event.
And it took less than 60 seconds.
Good vs Risky AI Use (Make This Instinctive for Your Team)
This is where most teams hesitate. So make it simple.
Use this as your baseline decision table:
Safe / Controlled
- Drafting
internal scheduling emails (no patient data)
- Brainstorming
marketing headlines
- Formatting
generic SOP documents
- Summarizing
non-sensitive meeting notes
Risky / Non-Compliant
- Analyzing
patient treatment plans
- Rewriting notes
with patient identifiers
- Drafting
insurance responses using real cases
- Inputting any
PHI into consumer AI tools
If the task involves identifiable patient information — it doesn't go in.
No exceptions.
Role-Based Reality (Because Not Everyone Uses AI the Same Way)
One of the biggest gaps in most practices is assuming one rule fits
everyone.
It doesn't.
Front Desk
- Safe:
appointment reminders (no PHI), general scripts
- Unsafe: patient
notes, insurance conversations, financial data
Marketing / Admin
- Safe: blog
drafts, social content, internal messaging
- Unsafe: patient
testimonials with identifiers, internal records
Clinical Team
- Safe: general
education content, non-specific templates
- Unsafe:
charting, diagnostics, treatment planning, clinical summaries
If your policy doesn't reflect roles, it won't be followed.
Because people won't know where the line actually is.
The AI Acceptable Use Policy (Dental Version)
This is where most practices stop short.
They talk about AI.
They don't formalize it.
Here's the operational version you can actually use.
AI Acceptable Use Policy (Baseline)
1. Approved Tools Only Only pre-approved AI platforms may be
used.
Unapproved tools are not permitted for any work-related activity.
2. Prohibited Inputs (Non-Negotiable) The following must never be entered
into AI tools:
- Patient names
or identifiers
- Treatment
details or clinical notes
- Financial or
insurance information
- Employee
records or internal HR data
3. Required Review Process All AI-generated content must be:
- Reviewed by a
human
- Verified for
accuracy
- Approved before
being shared externally
4. Data Handling Requirements AI outputs must be stored in:
- Approved
systems only
- Managed,
auditable environments
No saving in personal drives, notes apps, or unmanaged email drafts.
5. Enforcement Violation of this policy:
- Triggers
immediate review
- May result in
restricted system access
- Requires
retraining before continued AI use
This isn't about punishment.
It's about protecting the practice from silent, compounding risk.
How an Outside Auditor Sees This
If your practice is reviewed tomorrow, the evaluator is not guessing.
They are looking for evidence:
- Do you have
defined AI usage policies?
- Can you prove
data boundaries exist and are enforced?
- Are AI tools
inventoried and controlled?
- Is there a
documented review process?
If the answer is "informal" or "we've talked about it,"
The result is simple:
You've introduced a system that interacts with protected data… without
controls.
That's not a gray area.
The Next Week Action (Start Here, Not Everywhere)
Pick one role in your office.
Just one.
Front desk, marketing, or clinical.
Sit down for 20 minutes and define:
- What they are
currently using AI for
- What they
should stop immediately
- What is clearly
allowed moving forward
Write it down.
Share it with that role.
That single step turns uncertainty into control.
And control is what compliance is built on.
The Bottom Line
AI isn't the risk.
Unsupervised AI is.
And the uncomfortable truth is this:
Most practices aren't knowingly non-compliant.
They're unconsciously exposed.
Not because they failed.
Because no one translated convenience into policy.
You don't need to slow down.
You need to define the rules before speed turns into liability.
Get the Policy and Know Where You Stand
Download the AI Use Policy for Dental Practices and compare it against
how your team is actually working today. Then schedule your 10 minute discovery
call with 911 IT to walk through the gaps and confirm what needs to change.
It's a simple way to get clarity without overcomplicating it.
