ChatGPT for Medical Notes: A Safe Drafting Workflow for Small Practices

Yes, for some notes and not for others. A small practice can use ChatGPT to draft templates, letters, leaflets and de-identified note skeletons, then have the clinician complete them in the records system. Notes about a named patient, or anything dictated live, need a vendor that signs a business associate agreement (BAA).

The line is simple to state and hard to hold: data about a real person never goes into a chat plan that has no BAA. ChatGPT Business, for example, comes without one, according to OpenAI's help centre as checked on 4 November 2026. So the workflow below works by keeping the identifying material out, and by being honest about the jobs where that cannot be done.

Follow me on Instagram@sagnikteaches

Sorting a practice's notes into three lanes

Owners tend to ask "can we use AI for notes?" as one question. It is at least three, because "notes" covers very different documents. Sort them before you decide anything.

Connect on LinkedInSagnik Bhattacharya

Most of the time saving a small practice wants lives in the green lane, which surprises people. The hours go on rewriting the same five letters and the same four note layouts, and none of that needs a patient in the room.

Subscribe on YouTube@sagnikteaches

Green lane: build the note templates once

A template is a structure with prompts for the clinician, not a note. Ask ChatGPT to produce the structure, then edit it with a senior clinician and load it into your records system as a reusable form.

I run a small general practice. Draft a note template for a
routine follow-up visit for a long-term condition. Use these
headings: reason for visit, changes since last review, observations
(with blank fields for blood pressure, pulse, weight), medicines
reviewed (yes/no, changes), patient's concerns in their own words,
plan, safety-netting advice given, next review date. Keep each
heading to one prompt line a clinician can overwrite. No example
patient data. No clinical advice.

An illustrative result is a tidy page of eight headings with a short prompt under each, for example "Changes since last review: new symptoms, missed doses, side effects". The clinician's edits matter more than the draft. A typical pass removes one heading the practice does not use, adds "interpreter used", and reorders so the plan comes before the review date. The finished template is then the practice's, reviewed once, and used for every patient from then on with no AI in the loop.

Do the same for a handful of standard letters: results normal, appointment missed, repeat prescription query. Use bracketed placeholders for name and date, and keep the clinical sentence short and neutral. The letter wording gets checked by a clinician, and the practice manager keeps the approved copy in one shared folder with a version date.

Amber lane: de-identified drafting, step by step

Amber work is where a clinician has the facts in their head and wants help turning them into tidy prose. The safe version never lets the identifying facts reach the chat. The clinician writes a short generic summary, ChatGPT shapes it, and the clinician pastes the shape into the real record and fills in the specifics.

1. Write the generic summary yourself. Age band, relevant condition, the clinical points. No name, no date of birth, no address, no employer, no family details, no rare event that would single the person out.
2. Use placeholders. [PATIENT], [DATE OF VISIT], [CLINICIAN]. Never invent a plausible-looking fake name, because fake names get left in.
3. Ask for structure, not conclusions. Tell the tool to use only the points you gave and to list anything it added.
4. Copy the output into the records system and edit there. The real note is written in the record, by the clinician, with the chart open.
5. Delete the chat. The draft has served its purpose, and there is no reason to keep it.

The riskiest habit in amber work is the helpful detail. A clinician adds "he's the head groundskeeper at the local school" to explain a back injury. That sentence identifies a person in a small community far better than a name does. The test is whether a neighbour could recognise who this is.

Main example: a diabetes review note in a four-clinician practice

Take an illustrative four-clinician general practice. Each clinician spends about 7 minutes writing up a routine diabetes review and sees 10 such patients a week, so roughly 70 minutes a week each, or about 4.7 hours across the practice. The owner wants to cut that without sending patient data anywhere.

The practice does three things. First, the lead clinician and the practice manager use ChatGPT to build a review template with fixed fields for HbA1c, blood pressure, foot check, eye screening status, medicines and agreed goals. Second, a clinician uses the amber workflow to turn a typical visit into a model note, written from a made-up generic case: "Adult, type 2, HbA1c 58 mmol/mol on last check, no new symptoms, metformin dose unchanged, foot check normal, advised on activity." Third, the model note becomes an example inside the template that new locums can read. The template and the example note are the only AI-assisted artefacts.

In real consultations nothing is dictated into a chat. The clinician fills the template in the records system as they go. If this saves two of the seven minutes per review through better structure and fewer blank decisions, the practice recovers about 1.3 hours a week across all four clinicians. Those figures are illustrative, and a practice should time its own notes for two weeks before and after, not trust mine.

A sample of the draft, and what the clinician fixes

Here is an illustrative piece of AI output from the amber step, built on the made-up case above, followed by the edits a clinician would make.

Type 2 diabetes review. [PATIENT] attended for routine review. Glycaemic control remains good with HbA1c of 58 mmol/mol. No hypoglycaemic episodes reported. Foot examination normal. Continue current treatment. Review in three months.

Spot the problems. "No hypoglycaemic episodes reported" was never in the summary; the model added it because it is a typical line. "Glycaemic control remains good" is a judgement that the clinician may not want to make on one number. "Continue current treatment" hides which medicine. The clinician strikes the invented sentence, replaces the judgement with the number alone, names the medicine, and adds the eye screening status the draft left out. This is the whole case for the review step: the draft reads fluently, and fluency is exactly what hides the invention.

Green lane in practice: three more drafts with before and after

The same approach covers other documents where no patient exists yet. Each example below is illustrative, and each ends with a clinician's edit.

A repeat-prescription query letter

The practice sends the same message whenever a request arrives too early. The first draft from ChatGPT says "Your request for repeat medication cannot be processed at this time due to our policy." The clinician rewrites it: "We can't issue this yet because your last supply should still cover you until [DATE]. Please ask again on or after [DATE minus 7 days]. If you are about to run out, ring us and we will help the same day." The edit replaced a policy sentence with a date rule and a safety route. That is the pattern: AI gives a tidy shape, the clinician supplies the clinical safety net.

A plain-language after-care leaflet

For a minor procedure, ask for a one-page leaflet at a reading age of about 12, with headings for what to expect, what is normal, what is not, and when to ring. The risk is invented medical thresholds, such as "a temperature above 38 degrees means you should call". Strike every number the clinician has not approved, and replace each with the practice's own agreed wording. A leaflet with no figures that the doctor has not checked is slower to produce than a fluent one, and it is the only kind worth printing.

A referral letter shell

The shell holds the fixed parts: addressee line, reason for referral, relevant history, current medicines, what is asked of the specialist, urgency. Each is a labelled blank. A clinician fills them in the records system with real facts. A time check shows why shells help: if a referral takes 9 minutes to type and the shell trims the layout work to 6, a practice making 15 referrals a week recovers 45 minutes. The saving is modest and entirely safe, which is the best kind of AI win for a small practice.

A locum handover pack built without any patient data

A locum who has never seen your records system loses the first hour finding where things are. Ask ChatGPT to turn your own bullet list into a one-page handover: how to book a follow-up, which template to use for which visit, where letters go, who to call about a result, and the three habits of the practice that are not written down anywhere. You supply the bullets from the practice manager's head, and the output is a document with no patient data in it at all. After one real locum day, the practice manager adds the three things that tripped the locum up, and the handover improves each time it is used.

Which note types stay out of ChatGPT altogether

Some note types are red even when they look administrative. Keep these out of a general chat plan, with or without redaction.

• Safeguarding concerns and notes about children or vulnerable adults. Rare details, serious consequences if they leak, and a reader who would not forgive a slip.
• Mental health, sexual health and substance-use notes. The sensitivity of the category itself is the reason, regardless of how careful the redaction is.
• Anything a patient has said in confidence about a third party. A family member's details are someone else's data.
• Medico-legal and complaint responses. The wording is evidence, and the facts are specific.
• Test results and letters from hospitals as uploaded files. They arrive full of identifiers in headers and footers.

For these, the practice's own records system, with a covered tool if it has one, is the home. If a draft is wanted, the clinician writes it from scratch.

When a BAA-covered scribe is the only safe route

If the goal is to stop clinicians typing during the consultation, you need a tool that listens, and that means real patient data in real time. A general chat plan is the wrong place for it. The right category is an AI scribe from a vendor that will sign a BAA, and that tells you plainly what it keeps.

Ask every candidate four things in writing. Does it sign a BAA for the plan you would buy? Does it keep the audio, and for how long? Does it keep the transcript, and for how long? Does it use your recordings to train its models? Two answers show how much they differ. Heidi's support centre says sessions are transcribed in real time and the audio is never stored, while recordings you upload are handled separately. Nabla's help centre describes a 14-day storage period for encounters, counted from the moment an encounter is created, with a reminder email three days before deletion. Both were checked in November 2026; confirm them again in writing before you sign, since retention terms change. The cost and fit questions are in the scribe costs comparison and the tutorial on whether a scribe is worth it, and the patient-communication side is in rolling out a scribe without losing patient trust.

On the OpenAI side, the BAA routes are narrow. OpenAI's help centre says it does not offer a BAA for ChatGPT Business, handles Enterprise and Edu through sales, lets organisations with an established API history accept a standard BAA for the API, and offers a separate in-product BAA flow to eligible individual clinicians using ChatGPT for Clinicians. That product is designed for individual use by verified physicians, nurse practitioners, physician assistants and pharmacists, and OpenAI points practices that need one BAA covering several users to ChatGPT for Healthcare instead. An individual agreement is not a practice-wide cover, which is why I wrote up what the individual BAA does and does not cover. For the plan-by-plan view, read which plans suit a small practice.

The clinician review that turns a draft into a record

Every drafted artefact, from a template to a letter, passes through one named reviewer. For notes that reach a patient's record, that reviewer is the treating clinician, always.

1. Compare to your own memory and the chart. Every finding, dose, side and date matches what happened.
2. Look for the invented line. Read for sentences that sound routine but were never in your input. Ask the tool to list its additions, then check that list against the draft anyway.
3. Check negatives and numbers. A missing "no" or a swapped left and right is the classic slip.
4. Replace generic wording with specifics. "Continue treatment" becomes the named medicine and dose.
5. Sign in the records system, not in the draft. The signed note is the one that exists. The draft is deleted.

Teach new staff the invented-line test with a short exercise: give them a drafted note and the three facts it was built from, and ask them to circle everything unsupported. Most people find the first two quickly and miss the third, which is the point of practising.

Setting up the guardrails in a single page

A policy people read is shorter than one that covers everything. Aim for a one-page rule with these parts: the three lanes with examples, the approved tools and plans by name, the five amber steps, the reviewer rule, the red list above, and what to do after a slip. The slip procedure matters more than any other line: tell the practice manager the same day, delete the chat, note what was pasted, and decide whether a patient or a regulator needs to be told. Do not punish the report. A practice where people hide slips has the worst data position, because it never learns.

Use a business plan for the green and amber lanes where you can, because business plans do not train on your content by default, and give every user their own login. Do not connect drives, email or the records system to the workspace through apps (formerly connectors), since a connected app can pull real records into a chat on its own. If you want a template for the written policy, the AI usage policy tutorial for a medical practice goes through the clauses.

Checking after a month that the workflow holds

Four checks tell you whether this is working. Time a sample of ten review notes before and after the template change. Read five drafts from the amber lane and look for leaked specifics. Ask each clinician which template fields they delete every time, and remove them. Count the corrections made during clinician review: if a clinician fixes nothing for weeks, they have probably stopped reading carefully, and the review needs a spot check by a colleague.

If the time saved is small, the template is the likely problem, not the AI. Ask clinicians to bring their three worst-structured notes and rebuild the template around them. If clinicians keep wanting to dictate, treat that as the signal that it is time to evaluate a covered scribe properly, with a trial period, a patient notice and a rollback plan, rather than letting people work around the rules.

If you would like help sorting your own note types into the three lanes, that is what my AI implementation consultation covers, and the starting point is the contact page.

Practice owners ask these before approving ChatGPT for notes

Can a clinician dictate a real consultation into ChatGPT?

Not into a plan without a business associate agreement. A spoken consultation contains the patient's name, history and details that no redaction step will catch in real time. If dictation is the goal, choose a scribe tool that signs a BAA and read what it keeps.

Is a de-identified note still a clinical record?

No. A de-identified draft is working material. The clinical record is the note in your records system, written or approved by the clinician after the draft is refilled with real details and checked. Never file the draft as the record without that step.

Who owns the mistakes in an AI-drafted note?

The clinician who signs it. An AI draft can invent a finding, drop a negative or mix up a side, and the signature means the clinician vouches for every line. That is why the review step is not optional and not delegable to a receptionist.

What should the practice write down before anyone starts?

A one-page rule listing approved note types, the redaction steps, the tools allowed, who reviews, and what to do after a slip. Short enough to read in two minutes, signed by every clinician, and kept with the practice's other data policies.

Further reads

• What Is an AI Scribe and How Does It Work in a Consultation? — See how a scribe works inside a real consultation.
• A Worked AI Implementation Plan for a Small Medical Practice — A worked rollout plan for a small practice.
• Medical Practice AI Budget: What to Fund First and What It Costs — What to fund first and what it costs.
• 10 Admin Tasks a Small Clinic Can Hand to AI This Month — Ten admin jobs that need no patient data at all.
• Do Small Medical Practices Need an AI Consultant? — Judge whether you need outside help at all.
• What to Ask Before Buying Any AI Tool for a Medical Practice — Vendor questions to ask before any scribe trial.
• AI Scribe Security: Audio, Retention and BAA Vendor Questions — A contract-ready list of scribe security questions, evidence requests and a weighted vendor scoring sheet.
• Cliniko for Doctors: Fit, Cost and the AI Tools That Sit Around It — Cliniko is built for allied health. What that means for a doctor's practice, what it costs, and the AI scribes and phone tools that connect to it.
• ChatGPT for Occupational Therapy Goals: Drafting Without Client Data — How a private-practice occupational therapist can draft client goals with ChatGPT using de-identified inputs, then review and check funder wording.
• How to Train Employees on AI in a Clinic: Four Short Sessions — Four 30-minute sessions for clinic staff: rules, de-identified practice, consent wording and incident reporting, plus a sign-off sheet.
• Friends and Family Test Comments: Summarise Them With AI — A GP practice routine for coding Friends and Family Test free text into themes, a one-page report and a you-said-we-did poster.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help centre articles on business associate agreements and ChatGPT for Clinicians, and OpenAI's enterprise privacy page; Heidi support article on data and security; Nabla help article on its storage policy (all checked 4 November 2026).