How to Train Employees on AI in a Clinic: Four Short Sessions

A small clinic can train its staff to use AI safely with patient information in four 30-minute sessions: the rules, practice on de-identified tasks, consent wording for patients, and incident reporting. Finish with a signed sheet per person. Two hours per head, spread over two weeks, is enough to change habits.

Most staff do not leak patient data on purpose. They paste a referral letter into a chatbot because it is 5:40 on a Friday and the letter is due. Generic AI courses talk about prompts. A clinic needs something narrower: which tool, which data, which button, and who to tell when it goes wrong. That is what these four sessions cover, in the order people need them.

Follow me on Instagram@sagnikteaches

What goes wrong in a clinic when nobody sets the rules

Before you plan the sessions, picture the three slips that actually happen. A receptionist pastes an email thread containing a patient's name, date of birth and medication into a free chatbot to get a politer reply. A clinician records a dictation on a personal phone app whose terms allow the provider to keep audio. A practice manager uploads a spreadsheet of this month's appointments, with names and phone numbers, to get a quick summary. None of these people think of it as a breach. Each one thought they were saving time.

Connect on LinkedInSagnik Bhattacharya

The fix is not fear. It is a short, specific rule set that staff can recall under pressure, practice with fake data until the rules feel normal, and a way to say "I think I made a mistake" without being punished for it. The sessions below are built around those three things. If you want the wider checklist that sits behind them, the patient data and AI confidentiality checklist goes through what to configure; this tutorial is about getting people to follow it.

Subscribe on YouTube@sagnikteaches

Plan the four sessions before you book anyone

Keep each session to 30 minutes, run it at the start or end of a normal day, and never longer than a team meeting slot. Thirty minutes is short enough that nobody has to arrange cover, and long enough for one rule set, one exercise and one question round. Run them a few days apart, not back to back, so people have time to try things between sessions.

Before session one, decide three things yourself, because staff will ask on the day. First, which AI tools are approved. Second, which accounts they must use (a business account, not a personal login). Third, who owns the answers: usually the practice manager for process and the clinical lead for anything touching care. Write the three answers at the top of the rule card.

Take a clinic with nine staff: two clinicians, a nurse, four reception and admin, a practice manager and a part-time bookkeeper. Four sessions of 30 minutes is two hours per person, so 18 staff hours in total. If an hour of staff time costs the clinic $35 loaded, the whole programme is roughly $630 of time, once. That is small next to the cost of one reportable incident, and you can cut it further by running sessions two and three only for the people who handle patient records every day.

Session one: the rule card and the approved list

The first session has one job: leave everyone with a one-page card they can find in ten seconds. Spend ten minutes on why, fifteen on the rules, five on questions. Keep the card to eight lines or fewer. Longer cards do not get read.

Here is an illustrative card for a clinic that uses a business-tier chat assistant and no other AI tools. Change the details to match yours.

AI RULE CARD (clinic staff)
1. Use only the approved tool: [tool name], signed in with your work account.
2. Never type or paste a patient's name, date of birth, address, phone,
   email, insurance or ID number, or free-text notes into any AI tool.
3. If the task needs real patient details, do it by hand or in the clinical system.
4. Remove identifiers first (Session 2). If you are not sure it is clean, it is not.
5. AI drafts, you decide. Read every word before it leaves the building.
6. Never use AI to make or suggest a diagnosis, dose or triage decision.
7. Tell patients when AI touched something that affects them (Session 3).
8. Mistake? Report it the same day, no blame (Session 4).

Walk through the card line by line and add one example to each. For rule 2: "Pasting an email that starts 'Hi Mrs [surname], your results are in' counts." For rule 5: "An AI summary can tell you a patient has no allergies when the allergy sits in the one line it skipped." Say clearly that such examples are illustrative, not drawn from a real record.

Say plainly what the approved tool can and cannot do

Staff will assume that "business plan" means "safe for anything". It does not. Business plans from the major providers do not train on your content by default, but that is a privacy setting, not clearance to hold patient records. A business associate agreement (BAA), the contract that lets a health provider share protected patient information with a vendor, is a separate thing. OpenAI's help centre is explicit here: it offers BAAs for the API, for sales-managed ChatGPT Enterprise and Edu accounts, and through a separate in-product flow for eligible individual clinicians on ChatGPT for Clinicians, and it states that it does not offer a BAA for ChatGPT Business. One more detail belongs in this part of the session. Anthropic's privacy centre says its commercial plans do not train on your chats by default, but feedback you send with the thumbs up or down buttons may be used, and owners of Team and Enterprise plans can switch the buttons off with the Rate chats setting. Check whether your approved tool has an equivalent, and tell staff never to rate a chat that contains anything sensitive. The tutorial on whether the individual BAA covers a practice unpacks that in more detail. The practical rule for staff is simpler: if there is no signed agreement with the vendor, no identifiable patient data goes in.

Ask each person one question at the end

Finish by asking everyone to name one task they currently do that AI could help with. Write the answers on a whiteboard. These become your session-two practice tasks, which keeps the training real. A receptionist will probably say "rewriting cancellation emails". A clinician might say "turning my bullet notes into a patient letter". Both are legitimate once identifiers are removed.

Session two: practise on fake, de-identified records

This is the session that changes behaviour, because it lets people make mistakes safely. Before the session, create three fake patient items yourself: an appointment email, a referral note and a spreadsheet extract. Make them look real, use invented names and numbers, and mark the top "FAKE, SAFE TO PRACTISE". Never use a real record "just this once" for training.

The skill being practised is spotting identifiers. Obvious ones are names, dates of birth, addresses, phone numbers and email addresses. Less obvious ones are a rare condition plus a small suburb, an employer's name, a unique job title, a child's school, an appointment slot that only one patient could have had, and free-text phrases like "the lady whose husband just died". Staff should learn that removing the name is the beginning, not the end. For clinical text in particular, a safe drafting workflow for medical notes in ChatGPT goes further.

Practice task 1: an email reply, before and after

Give staff this fake email and ask them to prepare it for AI help.

Before (do NOT paste):
Hi, it's [full name] (DOB 14/03/1981). I need to move Thursday's 10:15
with Dr [surname] because my chemo starts that week. Can you call me on
[mobile number]? Also is my MRI report ready?

After (safe to paste):
Hi, I need to move my Thursday appointment because of a treatment that
starts that week. I'd like a phone call back. I also want to know whether
my scan report is ready.

The "after" version also drops the clinician's name, the time slot and the specific treatment type. Ask the group what else could be removed and what must stay. The AI only needs to know: reschedule request, wants a call, asks about a report. It does not need to know the treatment. A suitable prompt is "Write a short, kind reply from a clinic receptionist that offers a call back and says the scan report status will be checked. Leave placeholders for the date and the patient's first name." The reply comes back with "[first name]" and "[date]" placeholders, and the receptionist fills those in inside the clinical system.

Practice task 2: a spreadsheet extract

The second exercise teaches the most common office mistake: sharing a table. Give people a fake extract of ten appointments with columns for patient name, phone, appointment date, clinician, status and reason. Ask them to produce a version fit for AI analysis. The sound answer drops name and phone entirely, replaces the date with the week number, keeps clinician as a code (C1, C2), keeps status, and either drops the reason or changes it to a broad category. Then show them an AI query such as "Which day of the week has the most no-shows?" on the cleaned data and check the answer by counting by hand. The full walk-through is in the tutorial on analysing no-show rates in ChatGPT.

Practice task 3: a clinician's note into a letter

The third exercise is harder, because clinical notes hide identifiers in unusual places. Provide a fake note such as "58M, retired bus driver from the village, type 2 diabetes, on metformin 500 mg, HbA1c up, wife attends." Ask staff to rewrite it so a drafting assistant could turn it into a patient letter template. A good answer reads "Adult patient with type 2 diabetes, current medication unchanged, blood-sugar marker above target, family member attends appointments", and the clinician then adds the name and personal details inside the record system, not in the chat. Some staff will argue that even this is too much. That is a good discussion. The test to apply: could you show the text to the patient without them recognising themselves?

The two-person check

Close the session by teaching a habit. Before pasting anything, read it aloud once as if the patient were standing behind you. For batch tasks, ask a colleague to glance at the cleaned version first. This takes 20 seconds and catches most slips. A clinic that adopts it only for spreadsheets and referral letters is still ahead of most.

Session three: consent wording and the questions patients ask

The third session is about what you tell patients. Whether you need explicit consent depends on how AI is used and on the rules that apply to you, so ask your regulator, professional body or adviser; this tutorial cannot decide that for you. What staff can do regardless is be honest, consistent and calm when a patient asks.

Draft the wording together. A short notice can go on the consent form, the website and a reception sign:

We use AI tools for some administrative tasks, such as drafting letters
and reminders. Staff remove personal details before using them, and a
member of our team always checks the result. AI is never used to make
decisions about your care. If you would prefer we do not use AI for
anything involving you, tell us and we will note it on your record.

If your clinic uses an ambient scribe that records consultations, that is a different category with its own consent needs, and the tutorial on consent wording for AI note-taking covers it. Keep session three focused on administrative use unless you already run a scribe.

Role-play three awkward questions

In pairs, one person plays the patient and the other the receptionist. Swap after each question. Use these three, which come up in practice:

• "Did a robot read my records?" A good answer: "No. We use AI only for admin like drafting reminders, and we take your personal details out first. Your records stay in our clinical system."
• "I don't want AI used on me." A good answer: "That's fine. I'll note it on your record so nobody uses it for anything involving you." Then actually do it, which means you need a flag or field for it before the session.
• "Was my email written by AI?" A good answer is the truth: "A draft may have been, and a member of staff read and sent it." Never deny it.

The point of the role-play is that nobody should freeze or improvise a reassurance they cannot back. Ask each pair to write down the one sentence they would struggle to say, then tidy those sentences as a group.

A realistic mistake to discuss

End with a short story, clearly made up for the session. A reception team adds AI-drafted reminder text to their booking system. The draft says "Your fertility consultation is tomorrow." The patient shares a phone with a partner. Nobody had told the AI, or checked the template, to keep the service type out of messages. The lesson: AI will happily add helpful detail you did not ask for, so template wording that goes to a patient's phone should be reviewed for what it reveals, not just what it says.

Session four: incident reporting without blame

If staff fear punishment, they will hide slips, and a small slip left unreported becomes a large one. The fourth session teaches what counts, how to report, and why speed matters. Start by saying explicitly that nobody will be disciplined for an honest same-day report, and mean it, because the first person who is will end your reporting.

What counts as an AI incident

Give staff a simple list to remember:

1. Identifiable patient information was typed or pasted into an unapproved tool, or into an approved one against the rule card.
2. AI output containing an error reached a patient or went into a record without being checked.
3. A tool did something unexpected with data, such as emailing a summary to the wrong person or keeping something you thought was deleted.
4. A patient complained about, or was upset by, a message that AI helped to write.
5. A near miss: you caught it before it went anywhere, but you want it logged.

Near misses matter most. They are free lessons. Tell staff that a log of ten near misses and no incidents is a healthy clinic, while a log of zero suggests people are not reporting.

The one-page report form

Keep the form to six fields and make it something a person can fill in on their phone:

AI INCIDENT / NEAR-MISS REPORT
Date and time:
Your name (or "anonymous" if you prefer):
Which tool, and which account (work or personal):
What went in or out (describe, do not copy the patient data here):
How many patients may be affected (a number or "not sure"):
What you did straight away (stopped, deleted chat, told someone):

Ask staff not to copy the sensitive text into the report. That sounds obvious, and it is the first thing anxious people do. Describe it instead: "pasted a referral letter with a patient's name and condition into the free chatbot."

Walk through two scenarios

Split the room in two and give each half one scenario to answer in five minutes. The groups report back: what do we do in the first hour, who do we tell, what do we write down.

• Scenario A. A clinician realises she pasted a patient's full referral letter into a personal free chatbot at lunch. Expected steps: stop using it, do not try to hide the chat, delete the conversation from her history if the tool allows it, report the same day with the tool name and roughly what was in the text, and let the practice manager decide whether the patient and any regulator need telling.
• Scenario B. An AI-drafted letter says a patient is on a drug that is not in their record. A colleague caught it before sending. Expected steps: do not send, fix the letter by hand, log a near miss naming the tool and prompt, and add a line to the rule card, "check every medication against the record".

Whether a particular incident must be reported to a regulator or to patients depends on where you practise and on the facts. That decision sits with the practice manager and your adviser. Staff only need to know that their job is to raise it quickly; they do not decide the legal answer.

The sign-off sheet that proves it happened

A sign-off sheet is a one-page record that each person attended each session, received the rule card, and understood the incident process. It protects staff as much as the clinic, because a person who followed the card has a clear position. Keep it in the staff folder with their other training records.

Add three declarations above the signature line, in plain words: "I have received the AI rule card. I understand I must not enter identifiable patient information into any tool not on the approved list. I know how to report an incident or near miss." Do not add legal language that nobody will read.

Check that the training changed behaviour

A signature shows attendance, not habit. Two weeks after session four, run three quick checks. First, give everyone a five-question quiz with a mix of "safe to paste?" examples; the AI literacy quiz for employees has a longer set you can borrow from. Second, look at the approved tool's admin dashboard if it has one, and see whether usage matches who you trained. Third, count the incident log: if it is empty after a month, ask the team whether people know where to find the form.

Look for these warning signs in the first month:

• Staff using personal accounts "because the work one is slow". Fix the speed problem or the access problem, not the people.
• Prompts that still contain surnames or dates of birth. Your quarterly refresher should include one before-and-after of a typical prompt, with the identifiers made up.
• Over-reliance, where staff send AI text unread. Spot it by asking, when a letter goes out with an error, to see the draft and the prompt behind it; a draft that matches the sent letter word for word was not read.
• A long gap since anyone mentioned the rule card. Put it on the staff-room wall and in the induction pack for new starters.

Adapting the four sessions to your kind of clinic

A clinic with only front-desk AI use (reminders, enquiries, drafting emails) can shrink session two to a single email exercise and spend the saved time on session three. A clinic where clinicians use AI to turn notes into letters needs a longer session two, perhaps with two follow-ups on note de-identification. A multi-site group should have each site's manager run the sessions so the questions stay local, but share one rule card and one incident form so that reports can be compared.

If you are a sole practitioner with a single admin helper, you can run all four sessions in a morning with a coffee break between each. The aim is the same: two people who agree on the rule card and know where the incident form lives.

Whatever the size of the clinic, put the date of the first quarterly refresher in the diary before session four ends. Training that has no next date tends to become a one-off, and the rule card goes out of date the first time you add a tool.

Questions clinic managers ask before the first session

Do part-time and locum staff need all four sessions?

Yes, if they can touch patient information or use any AI tool for work. Record their sessions on the same sign-off sheet. Locums can take a shortened version: session one and session four in 40 minutes, with the rule card and the incident form handed over on their first day.

How often should the training be repeated?

Run a ten-minute refresher every quarter, and repeat the full four sessions whenever you add a new AI tool, change a setting or have an incident. A new tool changes the rules for that tool, so it deserves its own short session rather than a footnote.

Should we ban AI altogether instead?

A ban rarely holds. Staff who see a faster way to write a letter will use a personal account on their phone, and you lose all visibility. A short approved list, a clear red line on identifiable data and an easy way to report slips is safer than silence.

Who should lead the sessions?

The practice manager or clinical lead, because staff need to hear the rules from someone who can enforce them and who understands the work. An outside adviser can help you write the rules, but the session itself works best run by someone staff see every day.

What if a staff member refuses to sign off?

Treat it as a conversation, not a disciplinary matter. Find out which rule they disagree with. Often it is a workflow gap, such as no approved way to draft a referral letter. Fix the gap or document the exception, then repeat the sign-off.

Further reads

• AI for Fertility Clinics: Admin Jobs Only, and Where It Must Stop — Where AI must stop in a clinic doing very sensitive work.
• AI Chatbot for Physio Clinics: First-Visit Questions and Booking Hand-Offs — A patient-facing AI tool you might train staff on next.
• AI for Urgent Care: Wait-Time Texts, Check-In and Staff Hand-Offs — Check-in and text messages that need staff hand-offs.
• How to Stop AI Tools Training on Your Business Data — Settings to change before staff start using any tool.
• AI Literacy Requirements: What Your Staff Need to Know — What staff need to know about AI, in plain terms.
• How to Train Staff to Use AI in a Small Business — The general team-training method behind these clinic sessions.
• How to Handle Staff Who Over-Rely on AI — Spot staff who send AI drafts without reading them.
• Joining Instructions Template: Details and Reminders With AI — What goes in course joining instructions, a filled-in template, and an AI-drafted reminder sequence merged from the booking sheet.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help centre (Getting a Business Associate Agreement for the OpenAI API, including its section on BAAs for ChatGPT), OpenAI business data privacy page, Anthropic privacy centre (model training on commercial products), checked 4 November 2026.