AI Usage Policy for a Medical Practice: Template and HIPAA Rules

An AI usage policy for a medical practice should include seven things: the tools staff may use, what protected health information (PHI) may never be entered, a register of business associate agreements (BAAs), human review of any AI output that reaches a patient or a record, patient disclosure, an incident-response procedure, and a staff sign-off with a review date.

The key caveat: the wording that follows assumes a small medical practice that is a HIPAA covered entity, and it is a general template, not legal advice. Have a lawyer or compliance adviser who knows your state and your specialty read it before it is final, and use the notes between sections to decide what to change. If you are drafting a general policy for another kind of business, how to write an AI usage policy for your small business is the broader version.

Follow me on Instagram@sagnikteaches

Filling in the brackets: length and time

Text in [square brackets] is for you to complete. The policy is in blockquotes; the notes between them explain what to choose. A realistic target is two to four pages. Anything longer will not be read, and a policy nobody reads protects nobody. Set aside about three hours to adapt it: one to list your tools, one to fill the register and one to write the incident contacts and the sign-off sheet.

Connect on LinkedInSagnik Bhattacharya

Section 1: purpose, scope and who it covers

1. Purpose and scope. This policy sets out how [Practice name] staff may use artificial intelligence (AI) tools, including chatbots, writing assistants, transcription and note-taking tools, scheduling and phone assistants, and AI features inside software we already use. It applies to all employees, contractors, students, locums and volunteers, on any device, whether practice-owned or personal.

Two choices matter here. First, define "AI tool" broadly. Many staff do not think of a built-in email "help me write" button or a phone app that summarises voicemail as AI, and those are exactly the features that process PHI by accident. Second, say that the policy covers personal devices and personal accounts. Most incidents happen when someone pastes a patient message into their own phone.

Subscribe on YouTube@sagnikteaches

Section 2: approved, restricted and banned tools

2. Tools. Only tools listed in the Approved Tools table below may be used for practice work. Each entry states what the tool may be used for and what data it may receive. A tool not on the list is not approved. Staff may request a new tool through [role], who will complete the vendor check in Section 5 before approval. Personal AI accounts must not be used for practice work.

Here is an illustrative Approved Tools table for a small practice. The entries are examples, so replace them with your own and verify the vendor position on the day.

Here is why the table separates plan from product. As of November 2026 OpenAI says it does not offer a BAA for ChatGPT Business, only for its API (for eligible organisations), sales-managed Enterprise and Edu accounts, and a separate in-product flow for eligible individual clinicians. Anthropic provides a BAA covering its first-party API and Enterprise plans, where the primary owner must turn on the HIPAA setting, and its page lists features that are not covered. Google says Workspace administrators must review and accept a BAA before PHI is used, and that third-party add-ons are outside it. The point is not to memorise vendors. It is that the same brand can be covered on one plan and not on another, and that a feature inside a covered plan can still be excluded. The table lists the plan, and the register in Section 4 records the evidence.

Section 3: what staff may never enter, and what they may

3. Protected health information. Staff must not enter, paste, upload, dictate or photograph PHI into any tool unless that tool, on that plan, is marked "PHI allowed" in the Approved Tools table and a signed BAA is recorded in the BAA register. PHI includes names, dates of birth, addresses, phone numbers, email addresses, record numbers, photos, insurance IDs, dates of service, and any detail from a clinical encounter that could identify a patient. De-identified examples may be used only if the person preparing them removes all 18 identifiers listed in the HIPAA Safe Harbor method, for the patient and for the patient's relatives, employer and household members, and has no reason to believe that what remains could identify the patient.

Do not rely on staff remembering a definition. Give them a short list of things that look harmless and are not, because those cause the slips: a first name plus a rare diagnosis in a small town, a date of service, a photograph of a screen, a voicemail transcript, a referral letter attached to a "summarise this" request. The 18 identifiers come from the Safe Harbor method in HHS's de-identification guidance: names; geographic units smaller than a state, including street address, city and all but the first three digits of the postal code (and those only where the area they cover holds more than 20,000 people); every part of a date except the year (birth, admission, discharge, death) and ages over 89; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or licence numbers; vehicle identifiers; device identifiers and serial numbers; web addresses; IP addresses; biometric identifiers such as fingerprints and voiceprints; full-face photographs and comparable images; and any other unique identifying number, characteristic or code. Paste that list into an appendix so staff check against it rather than memory. Note what it implies: an example that keeps the appointment date or the patient's town is not de-identified, however anonymous it feels.

A quick worked illustration for staff training: "Rewrite this reminder: Hi Mrs [surname], your appointment with Dr [name] is on 3 March at 2pm for your blood pressure check". Every identifier is in that sentence. The safe version is the template with placeholders, [patient first name], [clinician], [date], [time], which can go into a general tool because it contains no patient at all.

Section 4: the BAA register

4. Business associate agreements. The practice keeps a BAA register listing every vendor that creates, receives, maintains or transmits PHI for us. No tool may be used with PHI until its entry is complete. The register is reviewed every [six] months and whenever a vendor changes its terms, plan or sub-processors.

The register is the most useful page in the policy, because it turns a promise into evidence. Here is a filled-in sample (invented dates and owners):

Note the third row. A tool with no BAA belongs in the register too, marked "not approved", so the next person who thinks of using it sees the answer. The checks to run on each vendor are laid out in HIPAA-compliant AI assistants for a medical office: a BAA check by plan. The HIPAA Security Rule requires documented policies and procedures to be kept for six years from the date they were created or the date they were last in effect, whichever is later, so keep every dated version of this policy and the register, not just the current one. Your adviser can confirm which other records the practice should keep on the same schedule.

Section 5: vetting a new tool before approval

5. New tools. Before a tool is approved, [role] confirms in writing: (a) what data it will receive; (b) whether a BAA is available for the exact plan we would buy, and if so that it is signed; (c) which features are excluded; (d) whether prompts or outputs are used for training or retained, and for how long; (e) where staff sign in and how access is removed when someone leaves; (f) what happens to the data if we cancel.

These six questions fit on half a page and are the same ones to ask when you read any vendor's terms. A longer version, written for the buying stage, is in what to ask before buying any AI tool for a medical practice.

Section 6: human review and clinical responsibility

6. Review and responsibility. AI output is a draft. A clinician or other named staff member must read and take responsibility for anything that enters a patient record, is sent to a patient, or influences a clinical decision. AI must not be the sole source for diagnosis, triage, prescribing, test interpretation or advice to a patient. Staff must not describe AI output as their own clinical judgement without having reviewed it.

Spell out two things practices forget. First, the person who clicks "sign" owns the note, not the vendor. Second, patient-facing automation needs a hand-off path: a chatbot or phone assistant that cannot recognise an urgent symptom and send the patient to a human is a clinical risk. If your practice uses an AI scribe, the review step should be at least as strict as for a human scribe, and the clinician should read for omissions as well as errors. The pros, costs and traps of scribes are covered in whether an AI scribe is worth it for a small private clinic.

Section 7: patient transparency and consent

7. Patients. Where an AI tool records, transcribes or summarises a patient encounter, the clinician tells the patient before it starts, offers an alternative, and records the patient's agreement or refusal in the chart. Our privacy notice describes our use of AI. Patients who object are never disadvantaged.

Some states have recording and notice rules that go beyond the baseline health-privacy rules, so check yours. Sample spoken wording for a clinician: "I use a tool that listens and drafts my notes. I review everything it writes, and the recording is not kept. Are you comfortable with that, or would you prefer I type notes myself?" More wording that works is in telling patients you use AI note-taking.

Section 8: incident response

8. Incidents. If PHI is entered into an unapproved tool, or an approved tool behaves unexpectedly (sends a message to the wrong patient, stores data it should not, produces content that reaches a patient unreviewed), the person who notices it must: (1) stop using the tool; (2) tell [Privacy Officer] the same day; (3) not delete evidence until told; (4) write down what, when and who without repeating the PHI. The Privacy Officer decides whether it is a reportable breach, notifies the right people within the legal deadlines, and records the outcome and lessons.

Why the same-day rule and the no-blame line matter: the time limit for notification starts at discovery. HHS's Breach Notification Rule page says individual notice must be given without unreasonable delay and no later than 60 days after discovery, and business associates must tell the covered entity within the same outer limit. An impermissible use or disclosure is presumed to be a breach unless a risk assessment shows a low probability that PHI was compromised. Deciding that is the Privacy Officer's job, with your adviser, not the staff member's.

An incident, walked through

Illustration. A front-desk assistant, trying to be quick, pastes a patient's message into a free chatbot to get a polite reply. Nothing visible goes wrong. Two days later she mentions it in passing. Under this policy: the tool is stopped; the Privacy Officer logs the date, the tool, the type of data (name, medication question), and notes that no agreement was in place; once the Privacy Officer has recorded what happened, the chat is deleted from the account where the tool allows it; the Privacy Officer, with advice, decides whether notification is needed; the assistant is thanked for reporting and retrained; the register is checked for the same tool on other desks. The policy's value in that story is that every step already had an owner.

Section 9: training, sign-off and review

9. Training and sign-off. All staff complete AI-use training within 30 days of starting and annually after. Every person signs the acknowledgement below. This policy is reviewed every six months and after any incident. Version, owner and next review date are on the front page.

Here is a one-paragraph acknowledgement that works:

I have read the AI Usage Policy of [Practice name], version [number], dated [date]. I understand which tools I may use and that I must not enter protected health information into any tool not marked as approved for it. I will report any mistake to [Privacy Officer] on the day I notice it. I understand that breaking this policy may lead to disciplinary action.

Name: ______ Role: ______ Signature: ______ Date: ______

Many practices combine sign-off with a short session using a few scenarios; the playbook for getting staff to follow the rules, as opposed to merely signing them, is in how to roll out an AI policy so staff follow it.

Section 10: exceptions, sanctions and what the policy does not cover

10. Exceptions and consequences. Exceptions to this policy are granted only in writing by [owner], for a stated task, tool and period, and are recorded in the register. Breaches of this policy are handled under [disciplinary policy]. Reporting a mistake promptly is treated as a mitigating factor. This policy does not replace professional or regulatory guidance for clinicians, which continues to apply.

An exceptions clause looks like a loophole, and it is the opposite. Without one, staff with a good reason (a locum who needs a particular tool for a week) simply work around the rule. With one, the practice sees the request, decides, and writes it down. Keep the exceptions list short and dated: if the same exception appears three times, it is a sign that the approved list is missing a tool and the policy needs changing, not bending.

Also say what the policy leaves out. It does not tell clinicians which AI tools are clinically reliable, it does not set standards for diagnostic software or regulated devices, and it does not cover the practice's website or marketing, which have their own checks. Naming these gaps in the policy keeps it honest and tells your adviser where to look next.

A first-month rollout, in order

1. Week 1: inventory (2 hours). Ask every person, by anonymous form if you must, which AI tools they use for work, including features in email and phone apps.
2. Week 1: sort (1 hour). Approved, restricted or banned for each tool, using Sections 2 and 3.
3. Week 2: BAA register (3 hours). Fill it for every vendor that touches PHI; send requests for the ones missing.
4. Week 2: write and review (3 hours, then counsel). Fit the template to your tools; send it to your adviser.
5. Week 3: train and sign (1 hour per cohort). Run scenario training and collect signatures.
6. Week 4: log and revisit. Start the incident and near-miss log; check that every banned tool is blocked on practice devices where you can.

The near-miss log needs only four columns: date, what happened, what you did, and what changed in the policy or the register. Review it at the six-monthly policy review, and if the same slip appears twice, change the process rather than reminding staff again.

Five scenarios for staff, with the policy's answer

1. "Can I ask a chatbot to explain a lab result to a patient in plain English?" Not with the patient's data. The clinician explains it, or uses an approved tool within a BAA and reviews the output.
2. "Can I use the free version on my phone to write our newsletter?" No work use of personal accounts. Use the approved account, and no patient stories.
3. "The EHR has a new AI button. Is it covered?" Not until the Privacy Officer checks the vendor's list of covered features and updates the register.
4. "A patient asks if we use AI." Answer honestly from your privacy notice and offer the opt-out.
5. "Can I record the call to get a summary?" Only with an approved tool, a BAA and the notice rules for your state, and never on a personal device.

If the review of your own tools raises questions you would rather not settle alone, that is a good use of my AI implementation consultation, alongside your lawyer.

Questions practice managers ask about an AI policy

Does a small practice really need a written AI policy?

Yes. Staff are probably already using AI tools, and an unwritten rule is one nobody can be held to or trained on. Even a two-page policy gives you something to point to after a mistake and something to show a regulator, insurer or auditor that you thought about it before the mistake.

Can staff use ChatGPT if no patient information is entered?

That is for your policy to decide. Many practices allow general tools for non-patient work such as marketing copy and policy drafts, on an approved work account, and forbid them for anything containing protected health information unless a business associate agreement is in place for that exact product and plan.

How often should the policy be reviewed?

At least every six months while the tools change this fast, and straight after any incident, new tool purchase or vendor change to terms. Put the review date on the front page and in a calendar, and make one named person responsible.

Who should sign off the policy?

The practice owner or managing partner approves it. Every member of staff signs that they have read and understood it. Have a lawyer or compliance adviser who knows health privacy review the final version, because this template is a starting point and not legal advice.

Further reads

• A Worked AI Implementation Plan for a Small Medical Practice — A worked plan for rolling AI into a small practice.
• Dental Practice AI Mistakes: Consent, Data, and Over-Automation — Consent, data and over-automation errors seen in a practice.
• HIPAA-Compliant AI Receptionist: A BAA and Retention Checklist — A BAA and retention checklist for phone and front-desk AI.
• Do Small Medical Practices Need an AI Consultant? — When outside help is worth it for a small practice.
• AI Scribe Costs Compared: What Small Clinics Pay in 2026 — What AI scribes cost small clinics, plan by plan.
• AI Acceptable Use Policy for a Small Professional Firm — A shorter acceptable-use policy for professional firms.
• A Simple AI Risk Register for Small Businesses (With Template) — A simple register for the near-misses this policy asks staff to report.
• Best AI for Healthcare Providers: What to Buy First by Pain Point — A buying order for a small practice: price your missed calls, late notes and denied claims, then pick the phone agent, scribe or claim check.
• ABA Session Notes With AI: From Raw Session Data to a Draft Note — A practice-owner workflow for turning trial data into a draft ABA note: de-identify or use a BAA tool, a prompt, a worked example and sign-off.
• AI App for Medical Providers: Standalone, Add-On or Built-In? — Standalone app, add-on or built-in feature? A vendor-neutral look for small medical practices on cost, data flow, switching and fit, with a decision table.
• AI Tools for Medical Practices: A Stack for Three Doctors and Four Staff — The first three AI tools for a seven-person practice, scribe, phones and billing checks, with list prices, a monthly total and what to check first.
• AI Tools for Nurses Who Run a Team: Rotas, Handover and Audits — A nurse manager's guide to AI for rotas, handover templates and audit write-ups, with a clear list of what must never go into a prompt.
• AI Tools for Physicians: Seven Worth Paying For in Private Practice — Seven AI tools for a private-practice physician, scribes, clinical assistants, phones and claim checks, with what each does and what to verify.
• AI Website for Doctors: Page Plan, Contact Forms and Privacy Checks — A page plan, contact-form rules and a tracking audit for a doctor building a practice website with AI, with no patient details in the build.
• AI in Healthcare Billing: Patient Statements and Payment Plan Wording — Draft statement and payment plan wording with merge fields, reconciliation checks and a privacy-safe review route.
• AI in Skilled Nursing Facilities: Screening Hospital Referral Packets — A practical packet-screening queue, evidence checklist and human decision gate for skilled nursing admissions teams.
• AI-Powered Chatbot Best Practices: A Weekly Review Routine for Clinics — A concrete weekly clinic chatbot review with transcript sampling, a filled-in issue log and release checks for corrected answers.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: HHS Breach Notification Rule page, HHS guidance on HIPAA de-identification (Safe Harbor), 45 CFR 164.316 documentation requirements, OpenAI Help Center article on BAAs, Anthropic privacy centre BAA article and Google Workspace Admin Help on BAAs, checked November 2026. This template is general information, not legal advice.