ChatGPT for Medical Billing: Appeals and Claim Checks Without PHI

Keep everything that identifies a patient out of the chat window. A billing team can paste the denial reason, the codes and the payer's policy wording, with names, member IDs, claim numbers and exact dates swapped for placeholders, and let ChatGPT draft the appeal or the claim check. Real identifiers stay in your billing system.

Two cautions shape everything below. ChatGPT Business does not come with a business associate agreement (BAA), so it is not a place for protected health information (PHI), however carefully you configure it. And removing a name is not de-identification: a rare procedure, an exact date and a small practice can still point to one person. Redact on purpose, with a method, every time.

Follow me on Instagram@sagnikteaches

What can go into a prompt and what must stay out

Most of an appeal is not patient data. The denial reason, the adjustment code, the payer's published policy and the argument for why the service met it are all generic. The patient-specific parts are a short list, and you can name them before you start.

Connect on LinkedInSagnik Bhattacharya

The free-text row is where most leaks happen. A line such as "patient fell off a ladder at the school where he teaches" contains no name, yet it is far more identifying than a date of birth. When a note has to be summarised for the argument, a person writes the summary, not a copy-and-paste.

Subscribe on YouTube@sagnikteaches

A five-step redaction method that takes about two minutes

Write this down as a one-page procedure and pin it next to the billing screens. The point is that two different staff members redact the same way.

1. Copy into a scratch document first. Never paste straight from the practice-management screen or the remittance PDF into ChatGPT. The scratch document is where you strip things, and it is deleted afterwards.
2. Replace identifiers with fixed tokens. Use the same tokens every time: [PATIENT], [MEMBER ID], [CLAIM NO], [CLINICIAN], [FACILITY], [DOB]. Fixed tokens make the finished letter easy to fill back in, and they make a stray real name stand out in a review.
3. Turn dates into relative days. The first visit is day 0, the denied procedure is day 21, the payer's letter arrived on day 60. The appeal deadline arithmetic still works and no calendar date leaves the building.
4. Cut free text down to a summary you write. Two or three sentences covering the clinical reason for the service, with no ages beyond a band, no occupation, no family details and no place names.
5. Read it once as a stranger would. If a colleague from another practice could guess who this is from the text, remove more. Then paste.

Keep the key (which token stood for what) only in the billing system or the claim record. The AI never sees it, and you refill the tokens in the final letter after review.

Main example: appealing a denied physiotherapy claim

Take an illustrative small physiotherapy practice. A payer has denied a block of six treatment sessions with the reason "medical necessity not established", adjustment code 50. The billing lead, working from a redacted scratch document, builds the prompt below. Every figure is made up for the example.

You are helping a medical billing team draft a first-level appeal.
Write a one-page appeal letter in plain, polite, firm language.

Facts (all identifiers removed):
- Payer: [PAYER], commercial plan
- Claim: [CLAIM NO], six physiotherapy sessions, timed code 97110
  (therapeutic exercise) billed on each of the six dates of service
- Denial: code 50, "services not deemed a medical necessity"
- Timeline: first visit day 0; sessions on days 7, 10, 14, 17, 21, 24;
  denial letter received day 60; appeal window is 180 days from denial
- Clinical summary (written by the team): adult with a documented
  shoulder repair six weeks before the first visit; referral from the
  surgeon on file; functional score improved from 38 to 61 across the
  six sessions; no other therapy billed in the period
- Payer policy wording we rely on: "[paste the payer's published
  rehabilitation policy paragraph here]"

Requirements:
1. Open with the claim token, the denial code and what we ask for.
2. Argue necessity strictly from the facts above. Do not add any
   clinical fact that is not listed.
3. List the enclosures as bullet points, using placeholders.
4. Leave [PATIENT], [MEMBER ID] and [CLINICIAN] untouched.
5. After the letter, list any fact in it you could not tie to the
   input, so the team can check it.

An illustrative first output runs to about 330 words. It opens with the claim token and the request to overturn the denial, then sets out the surgical history, the referral and the score improvement from 38 to 61 in three tight paragraphs, quotes the payer's own policy sentence, and lists enclosures: referral letter, daily notes, functional score sheets. It ends with a "facts I could not tie to your input" list containing one item: it had written "progressive overload programme", a phrase nobody gave it.

That last item is the reason for requirement 5. The billing lead deletes the phrase, because the chart does not say it, refills the tokens from the claim record, attaches the three documents, and routes the letter to the treating physiotherapist for a two-minute read of the clinical paragraph. Total time: about twenty minutes, against forty for writing from scratch. The saving is in the structure and wording, never in skipping the chart check.

Claim checks before submission

The second job is cheaper and safer: a pre-submission read of a claim line summary. You are not asking ChatGPT to code anything. You are asking it to read your own checklist against the lines and flag mismatches a tired biller would miss at 4.45 on a Friday.

Act as a claim scrubber's second pair of eyes. I will paste a
redacted claim summary and the payer's rules I am working from.
Do not invent rules. Where a rule is not in what I pasted, say
"not covered by pasted rules".

Claim lines (no identifiers):
Line 1: 99213, modifier none, dx J45.909, units 1
Line 2: 99213, modifier 25, dx J45.909, units 1
Line 3: 94010, modifier none, dx J45.909, units 1
Line 4: 99213, modifier none, dx Z00.00, units 1

Payer rules pasted: [paste the payer's bulletin text]

Checks: duplicate lines, missing or doubtful modifiers, diagnosis
that does not support the procedure, units above one for
once-a-day services, anything the pasted rules forbid.
Output a table: line, issue, rule it relates to, confidence.

On this made-up claim a good answer flags lines 1 and 2 as a likely duplicate of the same evaluation code, notes that modifier 25 on line 2 is the only thing separating them, asks whether a separately identifiable service is documented, and marks line 4 as a diagnosis code that describes a routine examination sitting beside an asthma diagnosis on the other lines. It should also say "not covered by pasted rules" for anything about spirometry, because you did not paste a spirometry rule. If the output states a payer rule you did not supply, treat the whole table as unreliable and rerun it with a stricter instruction.

Notice what the biller does next: opens the real claim and the note, confirms or rejects each flag. The AI narrows where to look. It does not decide.

Decoding denial codes into a worklist

A remittance full of group and reason codes is hard to triage by eye. Strip the patient columns and keep only the code, the amount and the service category, then ask for a worklist. The codes below are the standard claim adjustment reason codes most practices meet every week.

Say a practice has 40 denied lines in a week with a combined value of $6,200. Pasting the code, amount and service-category columns for those lines, with no patient column at all, lets ChatGPT sort them into three piles: resubmit with a fix (codes 16 and 18), appeal (code 50), and investigate bundling (code 97). It might return 14, 17 and 9 lines respectively. The tool has seen nothing that identifies anyone, and the biller now has a plan for Monday morning instead of a spreadsheet to stare at.

For a deeper routine on grouping and tracking, see AI denial management for medical billing.

A mistake that happens: the screenshot with the member ID

The most common leak is not a person pasting a name. It is a screenshot. A biller wants help reading a confusing explanation of benefits, so they drop in a photo of the page. The image carries the member ID in the header, the patient name in the top left and the date of birth in a box nobody thought about.

The fix is a rule, not a reminder: images and PDFs from payers never go into a chat. Only typed text that has passed the five-step method does. A practice can back that rule with a one-line check in the redaction procedure: "Did I type or copy this text from the scratch document? If it came from an attachment, stop." Add a second rule that anyone who realises they pasted something real tells the practice manager the same day, with no blame, so the chat can be deleted and the vendor's retention settings checked.

A timely-filing check you can run on numbers alone

Timely-filing denials (code 29) are the one type where redaction costs you nothing, because the argument is arithmetic. Suppose a payer allows 90 days from the date of service to file. Your claim log shows the claim went out on day 82 and the payer's acknowledgement is dated day 85, yet the denial says it was received on day 96. Give ChatGPT only those day counts and the payer's stated limit, and ask it to draft a short appeal that cites the acknowledgement as proof of timely submission and asks the payer to reprocess from the original receipt date.

Draft a three-paragraph appeal for a timely-filing denial (code 29).
Facts: payer limit 90 days; submitted day 82; payer acknowledgement
day 85; denial states received day 96. Enclosures: clearinghouse
acceptance report, payer acknowledgement. Use [CLAIM NO] and [PAYER].
Do not add facts. Ask for reprocessing from the day-85 receipt.

The letter that comes back is short and dull, which is exactly right. The human step is to confirm that the acknowledgement really exists in the clearinghouse report and that the day counts are correct. If the acknowledgement is missing, the draft is useless and the real work is a call to the clearinghouse.

Teaching a payer-call script the same way

Appeals are slow, and sometimes a phone call fixes a denial in ten minutes. The same method works for scripts. Ask for a call outline with the reference token, three questions to put to the payer (what exactly is missing, what is the fastest correction route, what is the reference number for this call), and a place to note the answer. The biller fills in the real claim number from the record while on the phone. Because the script contains no identifiers, it can live in a shared folder and be reused across the team.

Before and after: the same paragraph, redacted properly

Here is the kind of free text that starts as unsafe and what a safe version looks like. Both are illustrative.

Before: "Mr [full name], 58, a bus driver from the depot on the east side, had a knee arthroscopy on 12 March and was seen again on 19 March and 2 April. Claim 55-2210 was denied."

After: "Adult patient, knee arthroscopy on day 0, follow-up on days 7 and 21. Claim [CLAIM NO] denied, code 50."

The after version loses the occupation, the place, the exact dates and the claim number, and none of those losses weakens the appeal. If the occupation matters to the necessity argument, the billing lead says so in general terms: "physically demanding job requiring prolonged standing".

When the work needs PHI: BAA-covered routes

Some tasks cannot be redacted: summarising a long chart for a medical-necessity argument, or reading a scanned record. For those you need a vendor that will sign a business associate agreement and a plan that the agreement covers. As of November 2026, OpenAI's help centre says the following, and you should recheck it before relying on it.

• It does not offer a BAA for ChatGPT Business. The Business plan is a good fit for redacted work and a bad fit for PHI.
• A BAA for sales-managed ChatGPT Enterprise or Edu accounts goes through OpenAI's sales team.
• The API can be covered by a standard BAA accepted in the API Platform by an organisation admin, but self-serve enrolment requires an established history of API usage, and some organisations show as not eligible yet.
• Eligible individual clinicians have a separate in-product BAA flow for ChatGPT for Clinicians. OpenAI describes that product as designed for individual use by verified physicians, nurse practitioners, physician assistants and pharmacists, and points organisations that need a BAA covering several users to ChatGPT for Healthcare. A billing office cannot shelter under one clinician's agreement, a point I unpack in ChatGPT for Clinicians and the individual BAA.

Other vendors draw their own lines, and each line sits on a business account, never a personal plan. Anthropic's privacy centre says its BAA covers its API and Claude Enterprise organisations whose owner has switched on the health-data configuration and accepted the agreement, and that connectors, beta tools and some other features sit outside it. Microsoft's documentation says Copilot and Copilot Chat used by organisations support the health-privacy rules when properly configured under its data protection addendum and BAA, with web search queries excluded. Google lists the Gemini app and Gemini in Google Workspace among the Workspace services included in its BAA. Read the covered-features list for whichever you use, because a feature can be available in your account and still sit outside the agreement. The plan-by-plan comparison is in which ChatGPT plans suit a small practice, free, Business and Clinician, and the checklist for a whole office is in BAA checks for AI assistants in a medical office.

A BAA is a contract, not a magic switch. Even when one is signed, the practice should still pass only the minimum data a task needs, keep an audit record of who used the tool, and have its own policy. The usage-policy tutorial linked in the further reading shows what to put in it.

Settings that sit on top of redaction

Treat settings as a second layer, never the first. On a personal ChatGPT account, switch off the option that lets chats improve the model, and use a temporary chat for redacted drafting so it stays out of the chat history. OpenAI's data controls page says temporary chats are not used to improve its models but may be kept for up to 30 days for safety purposes, so a temporary chat is no more a place for PHI than a normal one. Describe these settings generically in your procedure, because vendors rename menus often. On a business plan, the default is that business content is not used for training. Do not connect apps (formerly called connectors) that reach your drive, email or practice software to the workspace where billers draft appeals: a connected app can pull real records into a chat without anyone pasting a thing.

Give each biller their own login, not a shared one, so a person can be asked what they did. Shared logins make an audit impossible, and they are the usual reason a small practice cannot answer "who pasted this?".

The review step that makes the draft sendable

An appeal is a document your practice signs. Build a short review that happens every time, by someone other than the person who prompted.

1. Tokens refilled and checked. Every placeholder replaced, and the right patient on the right letter. Read the first line aloud against the claim record.
2. Facts against the chart. Each clinical statement matched to a note or an order. Delete anything the chart does not say.
3. Codes against the payer's policy. The policy paragraph is the current version, not last year's PDF.
4. Deadlines. The appeal window counted from the denial date on the payer letter, with the date written in the claim log.
5. Clinical paragraph signed off. The treating clinician reads any paragraph that argues medical necessity.
6. Enclosures attached. Every document the letter lists is actually in the pack.

A practice that does this consistently ends up with a library of strong paragraphs: one for necessity on rehabilitation, one for a bundling dispute, one for proof of timely filing. Store those in your own system with no patient content, and start each new appeal from the closest one.

Checking that it works: a monthly audit

Once a month, the practice manager samples ten prompts from the shared logins, checks them for anything that looks like an identifier (digits in a member-ID pattern, a surname, a date with a year), and records the result. Zero leaks for three months is a good sign. One leak means the procedure needs a clearer example, not a lecture.

Track outcomes as well. Keep a plain sheet with the denial code, the date appealed, whether the appeal used an AI draft, and the result. After a quarter you can see whether drafted appeals are overturned at least as often as hand-written ones, and which denial types are worth the effort. Those numbers belong to your practice and need no patient data. If the claim-check routine also cuts resubmissions, your accounts-receivable ageing report will show it, and the aged-claims tutorial shows how to read it.

If you would rather map the redaction steps and tool choices with someone before rolling them out, my AI implementation consultation covers that, and you can start at the contact page.

Questions billing teams ask before they start

Are CPT and ICD-10 codes PHI?

A code on its own, such as a procedure or diagnosis code, does not identify anyone, so it can go into a prompt. The risk comes from the combination: a rare code, an exact date of service and a small practice can point to one person. Keep the codes, shift or drop the dates, and keep the rest generic.

Can I paste a payer's denial letter into ChatGPT?

Not as it arrives. Denial letters carry the patient's name, member ID, claim number and often the date of birth. Copy only the denial reason, the code and the payer's policy wording into the prompt, and replace everything else with placeholders before you paste.

Does turning off model training make the prompt safe?

No. Switching off training limits how a vendor may use your chats, but it does not create a business associate agreement and it does not remove the data from the vendor's systems. Redaction is what keeps PHI out; the setting is a second layer on top.

Who should sign an appeal that ChatGPT drafted?

A named person in your billing team, after checking every fact against the chart and the payer's policy. If the appeal makes a clinical argument, the treating clinician should read and approve that paragraph. The AI draft is never sent as it came out.

Further reads

• Using AI for Medical Billing: Spot Missed Charges From Visit Notes — Find charges visit notes imply but nobody billed.
• AI Medical Coding Software: Audit Trails and Upcoding Risk — What audit trails to demand if coding is automated.
• Outsourced Medical Billing or In-House AI Tools? A Decision Rule — Decide whether AI tools beat outsourcing the billing.
• Best AI Tool for Medical Billing: Scrubbing, Coding, Denials — Compare tools for scrubbing, coding and denials.
• AI Usage Policy for a Medical Practice: Template and HIPAA Rules — Turn these rules into a policy staff sign.
• AI Claim Scrubber: What It Catches and What It Misses — Modifier, bundling and diagnosis edits are caught; eligibility, documentation and fresh payer rules often are not. Test one on 50 claims.
• Medical Billing Proposal: Draft Practice Quotes With AI — Draft a medical billing proposal with AI: percentage vs flat-fee pricing, a scope table, an onboarding timeline and a fully worked quote.
• Medicare Codes for Billing Psychology in Australia: AI Claim Checks — A pre-submission claim check for Australian psychologists: match MBS item numbers to times, referrals and session counts, flag mismatches and never upcode.
• Using ChatGPT for Physical Therapy: Referring-Doctor Updates and Outreach — Build a library of referral update and outreach templates in ChatGPT, then fill the patient details from your own records, never the chatbot.
• AI for Medical Billing Companies: Seven Jobs to Automate First — Seven jobs for a medical billing company to automate first, ranked by risk, with sample prompts, a worked denial-letter example and the human checks each needs.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help centre articles on business associate agreements, ChatGPT for Clinicians and data controls, and OpenAI's enterprise privacy page; Anthropic privacy centre article on BAAs for commercial customers; Microsoft Learn page on enterprise data protection in Copilot; Google Cloud page listing services covered by its BAA; X12 claim adjustment reason code list; AAPC code pages for 97110, 99213 and 94010 and ICD-10-CM entries for J45.909 and Z00.00 (all checked 4 November 2026).