HIPAA Compliance Policy for a Home Care Agency: Build It With ChatGPT

Draft it with ChatGPT one section at a time from a fact sheet about your agency, with no client information in the chat, since a policy describes rules rather than people. Your compliance officer then checks each section against your real systems, and a lawyer confirms covered-entity status, stricter local rules, retention, vendor agreements and breach decisions before staff sign.

The order matters. The tempting start is to ask ChatGPT for "a HIPAA policy", get thirty generic pages and file them. A better route is to settle three facts first (are you a covered entity, which vendors touch client data, how do carers communicate), feed those facts to the AI, and let it write policy that describes your agency instead of any agency. The sections below follow that route and end with the list a lawyer should work through.

Follow me on Instagram@sagnikteaches

First, decide whether HIPAA applies to you

HHS's guidance describes a covered entity as a health care provider that transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as billing a health plan. An agency that bills a public programme, long-term care insurance or a managed care plan electronically is likely to be covered. An agency that is entirely private-pay and bills clients directly may sit outside the definition, although a contract with a hospital, a payer or a referral partner can still require HIPAA-level handling.

Connect on LinkedInSagnik Bhattacharya

Do not let the AI answer this for you. Write down how you bill, who pays, and which contracts mention HIPAA or a business associate agreement (BAA), and ask your lawyer to confirm the status in an email you can file. Then write one sentence at the top of the policy that states the answer, since every other section hangs off it.

Subscribe on YouTube@sagnikteaches

The facts to gather before you open ChatGPT

The quality of a drafted policy is the quality of the facts behind it. A one-page fact sheet gives the AI something real to write from, and none of it is protected health information because it describes the agency, not the clients.

• Systems: the scheduling and care-notes software, the payroll provider, the email platform, the phone system, any answering service, cloud storage.
• Workforce: number of office staff, number of carers, whether carers use personal phones, whether any are contractors rather than employees.
• Paper: care plans in the client's home, timesheets, incident forms, where they are kept and who collects them.
• Vendors: every outside company that can see client data, including the IT support person and the shredding service.
• Roles: who the privacy officer and security officer are (one person can hold both in a small agency) and who deputises when they are away.

An illustration: a 25-carer agency uses one scheduling app, a cloud email account, a payroll service and an outsourced IT contractor. Carers use their own phones. Care plans are paper copies in a binder at the client's home. That description becomes the fact sheet, and every section the AI drafts will refer to those systems by name.

The sections a small agency's policy needs

HHS's pages and sample materials describe the main building blocks: privacy rules, security safeguards, breach notification and business associate arrangements, plus workforce training and sanctions. For a home care agency I would draft these twelve sections, one AI request each.

1. Purpose, scope and status: covered-entity statement, who the policy binds, and the version and review date.
2. Roles: privacy officer, security officer, deputies, and where staff report concerns.
3. What counts as client information: names, addresses, care needs, schedules, photographs and anything that identifies a person.
4. Minimum necessary and access: who sees what, such as carers seeing only their own rota and client list.
5. Client rights: access to records, amendments, a list of disclosures, and how requests are logged and answered.
6. Communication rules for carers: phones, messaging, photographs, voicemail, speaking about clients in public.
7. Paper and devices in the home: binders, laptops, tablets, how they are stored and returned.
8. Security safeguards: passwords, multi-factor sign-in, device locks, lost-device steps, email use.
9. Vendors and business associates: the register and the BAA process.
10. Using AI tools: what may and may not be entered, and which tools are approved.
11. Incidents and breaches: the reporting chain and the log.
12. Training, sanctions and records: induction, annual refresher, consequences and retention.

Prompting for one section at a time

Ask for a section per prompt, and give the AI your fact sheet each time. A long single request produces a long, vague answer. Here is a prompt for the carer communication section, using the illustrative 25-carer agency.

You are helping a home care agency draft section 6 of its HIPAA privacy and security policy: "Communication rules for carers". Write plain English a carer can follow on their first day. Do not invent legal requirements; where a rule depends on law or the agency's risk analysis, flag it with [LAWYER TO CONFIRM].

Facts about our agency:
- 25 carers, all employees, using their own smartphones
- Scheduling app is [APP NAME]; carers see only their own visits
- Office staff use [EMAIL PLATFORM]; no client details in subject lines
- Carers call the office duty line for anything urgent

Cover: texting and messaging, photographs, voicemail, talking about clients in public, family members who ask for updates, and what a carer does if they send something to the wrong person.
Format: short numbered rules, each with a one-line reason. End with a list of questions the lawyer should answer.

The output (illustrative) will read as a numbered list: use the scheduling app for visit changes; never put a client's name, address or condition in a text message; no photographs of clients, their homes or their paperwork on a personal phone unless the care plan and the client's written consent allow it and the image is uploaded through the approved app and deleted from the phone; never leave voicemails containing client details; if a family member asks for an update, refer them to the office. Every rule should have a reason attached, which is what makes carers follow it.

What you fix: the AI tends to write rules stricter than your practice, such as banning all text messages, which carers then ignore. Check each rule against what actually happens on a shift, and keep only the ones you will enforce. A rule nobody follows is worse than a looser rule that everyone does, because it creates a documented violation you did nothing about.

The business associate register

A business associate is an outside person or company that creates, receives, maintains or transmits protected health information on your behalf. HHS publishes sample BAA provisions, and notes that a BAA must set out permitted uses, require safeguards and require the associate to report breaches, among other things. A register is the simplest way to show you know who has your data.

The last row is the point of the AI section. Using ChatGPT to draft this policy needs no BAA because no client data enters it. The moment a carer asks it to tidy a visit note, that changes. OpenAI states it does not offer a BAA for ChatGPT Business, so the safe rule for most small agencies is that client information never goes into a general chat assistant. The plan-by-plan guide to HIPAA and ChatGPT explains the options if you later need more.

An AI use clause staff can follow

Ask the AI to turn your decision into a rule list and then read it aloud to someone who works shifts. Here is the shape of a workable clause. It is illustrative, so adapt it and get it reviewed.

Using AI tools at [AGENCY NAME]
1. You may use the approved AI tools listed in the register for office tasks that involve no client or employee information, such as drafting a job advert or a general newsletter.
2. Never enter a client's name, address, phone number, date of birth, condition, medication, visit notes, photographs or schedule into any AI tool unless the privacy officer has confirmed that tool is covered by a signed business associate agreement.
3. If you are unsure, ask the privacy officer before you paste anything.
4. If you enter client information into an AI tool by mistake, tell the privacy officer the same day. Do not delete the chat before they have seen it.
5. AI output is a draft. A person checks every fact in it before it is used.

Rule 4 deserves attention. Staff who fear blame hide mistakes, and hidden mistakes become late breach notifications. Say plainly that reporting a slip quickly is expected and that concealment is the serious offence.

The breach log and the sixty-day clock

HHS's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. A breach affecting 500 or more people also goes to HHS within that window, and for fewer than 500 the report to HHS is due within 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of one state or jurisdiction also needs notice to prominent media outlets serving that area, on the same 60-day limit. Business associates must tell you within the same 60-day limit. HHS also says an impermissible use or disclosure is presumed to be a breach unless a documented risk assessment shows a low probability of compromise.

That presumption is why a log matters. Ask the AI for a one-page template with these columns, then fill the first row with a real or practice incident so staff see it in use.

The risk assessment factors in that table come from the HHS page: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk has been reduced. The AI can draft the template, but a person with authority must decide whether an event is a breach, and the lawyer should be in that conversation for anything borderline.

Paper in the home and the carer's phone

Home care has risks that office policies miss. A care-plan binder sits in a client's kitchen where visitors can read it. A carer's phone holds a rota and call history. A family member photographs the notes. Ask the AI to draft the "paper and devices in the home" section from three situations you have actually met, such as a binder left in a car, a phone lost on a bus, and a relative reading the daily record. The output should say what the carer does in each: report the same day, change the app password, and note the event in the log.

A before and after shows the value of specifics. Before: "Carers must protect client information." After (illustrative): "If your phone is lost or stolen, call the office duty line within one hour. The office will sign you out of the scheduling app remotely and note the event in the incident log. You will not be penalised for reporting promptly." The second version tells the carer what to do in the first hour, and that is what a policy is for.

Client requests: the log nobody builds until they need it

HIPAA gives clients rights over their records, such as asking to see them or to correct them. Small agencies tend to handle the first request by email chain and lose the thread. Ask the AI for a one-page request log and a three-step procedure, then test it against a plausible case.

Illustrative case: the daughter of a client emails asking for a copy of her mother's care plan and last month's visit notes. The procedure should tell the office to do four things: check whether the daughter is the client's authorised representative and record how that was verified; note the date the request arrived; send the records by the method the policy allows, never by an open email thread if it is not secured; and record the date sent. Where the AI draft says "respond promptly" and nothing more, add the response period your lawyer confirms. If the AI draft skips verification altogether, that is the gap to fix first, because the commonest wrong disclosure is giving a relative something the client never agreed to share.

A short mistake story shows how this goes wrong. An office assistant answers a phone call from someone who says they are the client's son and reads out the next day's visit times. The son is genuine, but the client had asked that no one outside the household be told her schedule. The policy needed one line: verify who is calling against the contacts list and the client's sharing preferences before any detail is given, and when unsure, take a message and call back on the number on file.

What the lawyer must check before anyone signs

This is the list to hand over with the draft. It is a prompt for a lawyer's review, not legal advice, and your lawyer may add items for your state and payers.

1. Covered-entity status: confirm in writing whether the agency is covered, and whether any contract imposes HIPAA duties anyway.
2. State law: check where state privacy or health-record rules are stricter than HIPAA, and whether state breach-notification deadlines are shorter than 60 days.
3. Retention period: confirm how long HIPAA documentation and client records must be kept, and align with payer and state requirements.
4. BAA terms: read each signed BAA for breach-reporting timelines, subcontractor clauses and what happens to data when the contract ends.
5. Risk analysis: confirm a documented security risk analysis exists, since HHS describes it as the first step in meeting the Security Rule, and that the policy matches its findings.
6. Consent and authorisation wording: check client forms for photographs, family updates and sharing with referrers.
7. Carer communications: approve the phone and messaging rules, including contractors and any carers outside the main employee group.
8. Sanctions: check disciplinary wording against employment law so it can actually be applied.
9. Breach decisions: confirm who decides whether an incident is a reportable breach, and that their decisions are documented.
10. AI clause: confirm nothing in it conflicts with a vendor contract or payer rule.

Your compliance officer, not the lawyer, then checks that every sentence is true of your agency. Walk through the policy with the fact sheet open: does the policy say carers use the approved app when they do not? Does it name a tool you have replaced? A policy that describes a company you are not is a liability. The employee handbook tutorial covers where to carry these rules into staff documents, and the caregiver onboarding checklist shows where the training and sign-off sit.

A worked pass: four hours for a 25-carer agency

Illustrative timing for the agency described above, with the owner as privacy officer and a part-time compliance officer.

• Hour one: write the fact sheet and the vendor list, and email the lawyer to confirm covered-entity status. Ask the vendor for a BAA where one is missing.
• Hour two: run the twelve section prompts. Keep each output in its own document so one weak section can be redone.
• Hour three: the compliance officer reads each section against the fact sheet, deletes rules nobody will follow, adds the home-visit situations, and fills the first line of the breach log with a practice example.
• Hour four: assemble one document with a version number, review date and owners, then send it to the lawyer with the checklist above.

The lawyer's review is the part that takes calendar time rather than hours, so start it early. When comments return, make edits in the Word file, not in the chat, so the final text is never a copy of an AI session.

Making it live: training, sign-off and annual review

A signed policy no carer has read protects no one. HHS describes training and sanctions as administrative requirements for breach policies, so build both in. Keep training short and tied to situations: a 30-minute induction session that walks through the communication rules with three scenarios, an annual refresher with one new scenario drawn from your breach log, and a signature sheet or acknowledgement in your HR system. Store acknowledgements with the policy version they relate to.

Add a quarterly check: ten minutes with the vendor register, asking whether a tool has been added, a contract renewed or someone left who had access. Run the AI prompts again only for sections that change. The wider 90-day plan for a home care agency shows where this sits among other AI jobs, and the AI usage policy for a medical practice is a useful comparison when you write your own AI clause.

If you would rather map which tasks should and should not use AI before you write any of this, that is what my AI implementation consultation covers.

Questions agency owners ask about HIPAA drafting

Is every home care agency covered by HIPAA?

No. HHS says a health care provider is a covered entity only if it transmits health information electronically in connection with a transaction HHS has standardised, such as billing a health plan. A purely private-pay agency may fall outside, but contracts with referrers or payers can still impose the same duties. Get that status confirmed in writing.

Do I need a BAA with OpenAI to draft a policy?

Not if no protected health information goes into the chat. A policy describes rules, not clients. If you ever want AI to help with anything containing client details, you need a tool and plan that comes with a signed business associate agreement. OpenAI says it does not offer one for ChatGPT Business.

How long must we keep HIPAA documentation?

The Privacy Rule requires covered entities to keep the documentation it calls for, such as policies and procedures, for six years from the date it was created or last in effect, whichever is later. Client care records are a separate question set by state rules and payer contracts, so confirm those periods with your lawyer and write them into the policy.

Can carers text clients and families from their own phones?

Only if your policy says how. Many agencies allow scheduling messages through an approved app and ban client names, conditions and photos in ordinary text messages. Write the rule so a new carer can follow it on day one, and have your lawyer confirm it fits your risk analysis.

How often should the policy be reviewed?

At least once a year, and whenever something changes: a new software tool, a new vendor, a breach or a near miss. Put the review date, the reviewer and the version in the policy header so an inspector or insurer can see it has been kept alive.

Further reads

• ChatGPT for Clinicians: Does the Individual BAA Cover Your Practice? — What the individual clinician BAA does and doesn't cover.
• Is Claude HIPAA Compliant? Which Plans Offer a BAA — Which Claude plans offer a BAA, for later steps.
• HIPAA-Compliant AI Receptionist: A BAA and Retention Checklist — Checklist before an AI answers your client calls.
• AI Answering Service for Home Care Agencies: After-Hours Call-Outs — After-hours call handling with the privacy limits.
• Home Care Agency Software Pricing: What the AI Features Add — Pick software with the safeguards your policy assumes.
• AI for Home Health Agencies: Faster Replies to Hospital Referrals — Referral replies that keep client details inside safe tools.
• Home Care Agency Marketing Plan: Build One With AI and Local Data — A one-page plan built from your own local data: search terms, referral partners, family messages and a budget, with an AI prompt and a reality check.
• Home Care Agency Policies and Procedures: A Review-First AI Method — Start from the regulator's standard, draft with AI, and put a named person through a ten-point review before any policy reaches a carer.
• Home Care Agency Welcome Packet: Build the Admission Pack With AI — Build a home care welcome packet section by section: what to include, the prompts that draft it, and the manager sign-off that makes it safe to send.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: HHS Breach Notification Rule page (checked 4 November 2026); HHS sample business associate agreement provisions (published 25 January 2013); HHS 'Covered entities and business associates' page; HHS Guidance on Risk Analysis; 45 CFR 164.530(j) on the eCFR site; HHS Privacy Rule summary; OpenAI help article on business associate agreements (all checked 4 November 2026).