AI for Nurse Practitioners: Prior-Auth Letters and Practice Policies

A nurse practitioner who owns a practice can hand AI any admin that contains no patient information: policy drafts, handouts, job descriptions, templates and letter structures. Anything with real patient details, such as a prior-auth letter built from a chart, needs a signed business associate agreement (BAA) for that product, or de-identified text.

The BAA gate is the whole game. Where health-privacy law such as HIPAA applies, a vendor that handles protected health information for you must sign a BAA, and a privacy toggle does not replace one. The good news for an owner is that the quickest wins, policies and templates, sit on the side of the gate that needs no agreement at all.

Follow me on Instagram@sagnikteaches

Sort every admin job by whether patient data is in it

Before choosing a tool, list the admin jobs a week actually contains and put each into one of two columns. Column one: no patient information needed. Column two: patient information needed. The first column can run on almost any business-grade AI plan today. The second waits for the gate.

Connect on LinkedInSagnik Bhattacharya

This split pays off even if you never sign a BAA. The no-data column gets you the biggest part of the saving, and the second column becomes a templates-and-fill-in routine that is still faster than writing from scratch.

Subscribe on YouTube@sagnikteaches

The BAA gate: what to check before a patient detail goes in

A BAA is a contract. It says the vendor will protect patient information in particular ways, report breaches, and handle it only for permitted purposes. It is attached to a specific product and plan, not to a company name. A vendor can sign one for its health-focused or API product and not for its everyday chat plans, so "OpenAI signs BAAs" or "Anthropic signs BAAs" is not an answer. The question is whether it covers the exact product you will open on Monday morning.

For ChatGPT, OpenAI has a product called ChatGPT for Clinicians. As of November 2026, OpenAI's help article says it is free at launch for verified US clinicians, that eligible roles currently include physicians, nurse practitioners, physician assistants and pharmacists, and that signing up needs a ChatGPT account, a valid NPI and a licence that a third-party provider can verify. It is designed for individual use: an eligible clinician can review and sign a BAA for that workspace under Settings, then Agreements, and OpenAI says not to share protected health information there until the BAA is in place. Drafting prior-authorisation letters is one of the documentation jobs it lists.

Three cautions. First, the BAA covers your own workspace. For an agreement that covers several users, OpenAI points practices to its separate ChatGPT for Healthcare product, so your front desk, your biller and a second provider are not covered by yours, and the login is not for sharing. Second, sign-up creates a new workspace beside your existing ChatGPT one, and you move between them with the account switcher, so drafting a patient letter in the wrong workspace is an easy slip; check the workspace name before you paste. Third, third-party GPTs and connected apps carry their own terms, and OpenAI warns against sending them patient information without the right permissions and agreements. For the ordinary business plans, the data-training default is off, but that is not a BAA: OpenAI's list of HIPAA-eligible products names ChatGPT for Clinicians, ChatGPT for Healthcare, Enterprise with a regulated workspace and the API with modified retention, not Plus or Business. Nothing on those plans should receive a chart extract. Eligibility and pricing can change, so read the help article yourself the day you sign up rather than trusting this summary.

Other routes exist: AI features inside your electronic health record, where your existing vendor contract already includes a BAA, and API access through a vendor that offers one. Anthropic, for instance, lists a HIPAA-ready offering on its Enterprise plans but not on Team or the individual plans. The same logic applies to each. Get the agreement, read its scope, confirm which people and which features it covers, and keep a copy. The practice-wide version of this check is in HIPAA-compliant AI assistants for a medical office: BAA by plan.

A five-line gate you can pin to the wall

1. Is there any patient information in this text? If no, carry on.
2. If yes, is the product named in a signed BAA we hold?
3. Does that BAA cover this person using it (me alone, or staff too)?
4. If either answer is no, can I de-identify it so that no name, date of birth, address, record number or distinctive detail remains?
5. If I cannot, write it by hand from a template.

De-identification is harder than it looks. A rare diagnosis plus a town, or an unusual occupation plus an age, can identify a person even with the name removed. Where the story is distinctive, treat it as identifiable.

Prior-auth letter: a worked example with numbers

Say a two-clinician practice sends about 14 prior-authorisation requests a week. Each letter takes 20 minutes to draft from the chart, so that is about 4 hours 40 minutes weekly. The owner wants a first draft in five minutes, with fifteen minutes saved on roughly half of them (the straightforward ones), and no more denials from missing information.

The owner holds a signed BAA for her workspace and does the letters herself. The routine has three steps.

Step 1: build a structured fact sheet from the chart. Not the chart itself, just the facts a payer needs. This is both a safety measure (less data in the prompt) and the thing that stops letters being rejected for missing information.

Patient: [initials only], age 54
Requested: MRI lumbar spine without contrast
Diagnosis: lumbar radiculopathy, onset 9 weeks ago
Conservative care so far: NSAIDs 6 weeks; physical therapy 8 sessions, 6 weeks; home exercise
Red flags: none documented. Neurological: left L5 dermatome numbness; reduced ankle dorsiflexion strength 4/5
Why imaging changes management: considering referral for interventional treatment if structural cause confirmed
Payer criteria quoted on their form: "6 weeks of failed conservative therapy"

Step 2: prompt for the letter.

Draft a prior-authorisation letter from a nurse practitioner to a payer's medical reviewer using only the facts below.
Structure: request, relevant history, conservative treatment tried (with dates and durations), examination findings, why the requested service changes management, a closing request for approval.
Quote the payer's criterion exactly and show how each part is met.
Do not add diagnoses, codes, dates or findings that are not listed. If a fact the payer is likely to want is missing, list it under "Missing information" instead of inventing it.
Under 350 words. Plain, professional tone.

[paste the fact sheet]

Step 3: check against the chart. An illustrative output is a 320-word letter in which the conservative-care paragraph reads "NSAIDs for six weeks and eight physical therapy sessions over six weeks, plus a home exercise programme", the examination paragraph reproduces the L5 findings, and a "Missing information" note at the bottom says "date of first presentation and any prior imaging not provided".

What to fix: the first draft often rounds. "Failed conservative therapy" may become "ineffective conservative therapy for more than six weeks" when the chart says exactly six. Replace with the chart's figure. Also check that the model did not turn "reduced strength 4/5" into "significant weakness", a stronger statement than the examination supports. Payers read for inconsistency, and a letter that overstates findings relative to the notes is a worse risk than a slightly plain one.

Time, illustrative: five minutes to assemble the fact sheet (which you needed anyway), one minute to run the prompt, six minutes to check and edit. Twelve minutes against twenty, so on the 14 weekly requests that is roughly 110 minutes back. If the "Missing information" note stops two letters a week from bouncing back for more details, each avoided round trip saves further staff time. For tracking what happens after a letter goes out, prior authorisation with AI: drafting letters and tracking status picks up where this leaves off.

A patient message, with and without the gate

Patient portal messages are another large chunk of an owner's evening. Take a message asking whether to continue a new blood-pressure medicine after a dizzy spell. With a BAA you may paste the message and the relevant medicine list into your covered workspace and ask for a draft reply. Without one, you can still use AI to help you with the shape of the reply by describing the situation generically.

Draft a reply from a nurse practitioner to a patient who reports dizziness after starting a new blood-pressure medicine.
Requirements: empathetic, 120 words or fewer, plain language a 12-year-old could follow.
Include: ask them to stop driving until they are seen; same-day appointment offer; clear safety-net line for chest pain, fainting or severe symptoms (call emergency services); do not change or advise on dosing in this message.
End with: "[practice name], [phone number]".

An illustrative output is a calm 100-word message with a same-day slot offer and the safety-net sentence. What you fix: models sometimes add reassurance such as "this is usually harmless" that you did not decide, and may soften the emergency line. Delete the reassurance, restore the emergency wording, and add the patient's name last, by hand, in your portal. Clinical decisions in the message are yours; AI supplied the tone and the structure. If you are building out the front desk's share of this work, how a small clinic can use AI at the front desk safely sets out which message types can be routed to staff.

Practice policies: the easiest saving, with no gate at all

Policies contain no patient data, so this is where a practice owner can begin tomorrow. Think of the documents an NP-owned practice needs: no-show and late-arrival policy, prescription refill policy, after-hours contact policy, telehealth etiquette, controlled-substance agreements (for you to adapt with counsel), onboarding checklist for a new medical assistant, social media policy for staff.

Draft a one-page refill policy for a small primary care practice owned by a nurse practitioner.
Include: how patients request refills (portal, pharmacy, phone), turnaround time of 2 business days, which medicines need a visit first (placeholder list for me to fill in), what happens when the patient has missed their follow-up, after-hours handling, who authorises.
Write it as a patient-facing policy in plain language, then a separate short staff checklist of 6 steps.
Flag every place where a licensing, payer or clinical decision is needed with [OWNER TO DECIDE].

The "[OWNER TO DECIDE]" flag is the useful trick. It forces the model to mark where it has guessed a rule instead of silently writing it in. In a typical output you will see three or four flags: which medicines need a visit, how long a patient can go without a follow-up, and the after-hours escalation path. Those are the decisions that make it your policy. Before it goes live, have it read by whoever advises you on state or regional rules for your practice, as scope-of-practice and prescribing rules differ by jurisdiction, and a model has no reliable way to know yours.

Three more policy drafts that take under ten minutes each

The no-show policy: ask for tiers (first miss, second miss, third miss) with wording for each, then decide the fee or discharge point yourself. The after-hours policy: ask for a decision table showing symptom type, who to call and expected response time. The staff onboarding checklist: ask for a week-by-week list for a new medical assistant, then add your EHR-specific steps. In all three, add your real numbers last. AI drafts the layout and the wording; you supply the thresholds.

The 'just this once' chart paste and the invented guideline

A pattern that causes trouble: a busy owner pastes a short chart extract into an everyday chat plan "just this once" because the letter is urgent, with the name removed but the whole history intact. No one notices at the time. The issue emerges later, when a colleague asks which tool the letter came from and nobody can say whether an agreement covered it. Whether the text counted as de-identified becomes a debate, and an unpleasant one.

The fix is boring and works: keep the gate on the wall, and make the fact sheet the only thing that ever goes into a prompt. A fact sheet with initials, age and the minimum clinical facts is far easier to defend than a chart extract, and it is better input anyway.

Another early failure is the invented citation. A prior-auth letter that quotes a clinical guideline by name and year may be citing something that does not exist or does not say what the letter claims. Tell the prompt "do not cite guidelines or studies", and add any reference yourself from a source you have opened. A wrong citation in a payer letter costs credibility with the reviewer who sees many of yours.

Appeals after a denial: where AI helps and where it must not guess

A denial letter usually states a reason in a sentence or two: "not medically necessary", "criteria not met", "insufficient documentation". An appeal has to answer that exact reason, with facts from the chart, so the structure is: quote the denial reason, restate the clinical picture, answer the reason point by point, attach what is missing, and request review by a clinician in the same or a related specialty if your payer's process allows it. AI is good at that skeleton and poor at knowing which of your facts is the decisive one, so you choose the facts.

Say a denial for a sleep study states "no documentation of excessive daytime sleepiness". You add a line to the fact sheet: "Epworth score 14 recorded at visit on [date]; patient reports falling asleep at work twice a month; BMI 33; witnessed apnoeas reported by partner". The prompt then reads, in part, "Answer the denial reason 'no documentation of excessive daytime sleepiness' using only these facts; do not add symptoms". An illustrative output opens with the denial reason in quotation marks, follows with a three-sentence summary, then a short paragraph that cites the score and the reported episodes. You fix two things: confirm the score and date against the chart, and delete any generic sentence about sleep apnoea risks, which the reviewer does not need and which you did not write.

Keep a library of the winning paragraphs. When an appeal succeeds, save the paragraph that answered the denial reason, with identifying detail removed, as a reusable block for the next similar case. Over a few months this becomes a wording bank by payer and by service, which is more valuable than any prompt, and it lives in your own files rather than in a chat history.

Who may touch the tool, and what to record

Once a BAA exists, the practice-side rules matter as much as the contract. Write down four things on one page. Who holds a login (named people only, no shared accounts). Which text may go in (the fact sheet, never a full chart export, and never images of cards or IDs). Where outputs are saved (in the EHR or the patient file, not left sitting in a chat). And when chats are deleted (for instance at the end of each week, after the letters are filed).

A short training moment for staff helps. Show the biller and the medical assistant the gate, show them one letter that went wrong and why, and make it normal to say "I am not sure whether this is covered" without embarrassment. If a staff member needs to use the tool and your agreement covers you alone, the answer is a different agreement or a different route, not sharing your login. Keep a simple log of the date you signed, the product, the scope and who is covered, so that a payer audit, an insurer question or a new partner has something to read. Review it every quarter, because products and terms change, and the check takes ten minutes.

Cost and what to fund first

For a practice owner the cost question is mostly about which plan, since the no-data jobs run on inexpensive business plans (ChatGPT Business Standard is $25 per user a month billed monthly or $20 billed annually, from two users; Claude Team Standard is the same $25 or $20 a seat for 2 to 150 seats). ChatGPT for Clinicians is free at launch for verified clinicians, which may not last, so check the help article before you budget. Weigh the saving: at 110 minutes a week on letters alone, even a conservative value on your hour dwarfs a monthly subscription. The cost that matters is your review time and the risk of skipping it. If you are choosing what to spend on first across a small medical practice, medical practice AI budget: what to fund first compares the options by cost.

A first-month plan for an NP-owned practice

1. Week 1. Draft the refill, no-show and after-hours policies. No patient data, no agreement needed. Have each reviewed by the right adviser.
2. Week 2. Decide the gate. Read the vendor's help page for your product, sign the BAA if you are eligible and want it, and write the five-line gate on a card. Record who is covered.
3. Week 3. Build the prior-auth fact-sheet template. Run five letters through it and tally what you had to fix.
4. Week 4. Add patient-message drafts for two or three recurring topics, such as refill requests and test-result queries. Keep a list of the phrases you always delete, and add them to the prompt.

At the end of the month you will know which of the three jobs actually saves you time. If you would rather map this with someone across your whole practice, that is what my AI implementation consultation covers, on a 1:1 call. For the wider set of AI guidance on this site, see the AI hub, and for scribes specifically, is an AI scribe worth it for a small private clinic is the next decision most owners face.

Questions NP practice owners ask about AI and BAAs

Can I put patient details into ChatGPT if I turn off training?

No. Switching off training is a privacy setting, not a business associate agreement. If the text contains protected health information, you need a signed BAA covering that specific product, or you de-identify the text first. Check the vendor's current agreement page before relying on either route.

Does a BAA make AI output safe to send to a payer?

No. A BAA covers how the vendor handles data. It says nothing about whether the letter is accurate. You still check every diagnosis, code, date and clinical statement against the chart before anything goes to a payer.

Which tasks need no BAA at all?

Anything with no patient information in it: policy templates, job descriptions, generic patient handouts, staff checklists and marketing copy. Once a real patient's details enter the prompt, the rules change.

Can my staff use my AI account?

Not with patient information. OpenAI's clinician workspace is built for individual use and its BAA covers your own workspace; for an agreement covering several users OpenAI points to ChatGPT for Healthcare. Never share a login. For any other tool, ask the vendor in writing who is covered before staff use it with patient details.

Further reads

• Best HIPAA-Compliant AI for Therapists: Which Vendors Sign a BAA? — Which vendors sign a BAA, seen from a therapy practice.
• HIPAA-Compliant AI Receptionist: A BAA and Retention Checklist — BAA and retention checks for a phone or chat assistant.
• Physical Therapy Prior Authorisation: Track Visits With AI — Visit-count tracking, a close cousin of prior auth.
• Best AI for Paediatricians: Vaccine Recalls and School Forms — Another clinic's admin jobs sorted by data risk.
• AI Scribe Costs Compared: What Small Clinics Pay in 2026 — What small clinics pay for scribes.
• 10 Admin Tasks a Small Clinic Can Hand to AI This Month — Ten more admin tasks a clinic can hand over.
• AI Tools for Nurses Who Run a Team: Rotas, Handover and Audits — A nurse manager's guide to AI for rotas, handover templates and audit write-ups, with a clear list of what must never go into a prompt.
• OpenAI for Medical Providers: Which Product Fits a Small Practice? — Which OpenAI products will sign a BAA, which will not, and how a solo clinician, small practice or developer should choose between them.
• Optometry Insurance Verification: A Front-Desk Workflow With AI — A front-desk routine for checking vision and medical eye insurance before the visit, with a call script, note template and safe uses of AI.
• Optometry Referral Letter Template: Draft With AI, Then Check — A referral letter template for GPs and ophthalmologists, a safe AI drafting method, and a pre-send checklist for laterality, numbers and urgency.
• AI Tools for Paediatricians' Offices: Seven Admin Jobs — Seven front-office jobs for AI in a paediatric practice, from phones to rotas, each with an example and a rule for using it safely.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help centre articles on ChatGPT for Clinicians and HIPAA-eligible products; OpenAI ChatGPT Business pricing page; Claude pricing and plan comparison page; general business associate agreement principles. Confirm current terms with each vendor.