HIPAA does not mention artificial intelligence. The law was written in 1996 and the security rule was last substantially updated in 2013, so it governs what happens to protected health information, not which software you happen to use. Most practices hear one of two things about AI: that it is flatly illegal in healthcare, or that everyone is already doing it. Neither is accurate.
A practice with 5 to 100 staff can use AI on real patient information today. Three things have to be true first.
A signed BAA decides whether PHI can go in
Any vendor that handles protected health information on your behalf is a business associate, and a business associate agreement has to be signed before the first record is sent. This applies to an AI vendor exactly as it applies to your practice management software or your billing company. No BAA, no PHI. There is no version of this rule that bends because the tool is new or useful.
The consumer tiers of the major chatbots do not come with a BAA. The business and enterprise tiers of the large vendors generally will sign one, but the terms differ and some cover only certain products inside the subscription. Ask for the executed agreement in writing, read which services it names, and file it before anyone logs in.
Write down every AI tool your staff currently touch, then request a BAA from each vendor. Anything that comes back without one becomes a tool for work that has no patient information in it at all.
Personal accounts are the real exposure
The common failure in a dental or medical office is not a vendor breach. It is a front desk coordinator pasting a patient message into a free chatbot on their own phone to get a politer reply. That is a disclosure of PHI to a vendor you have no agreement with, and you have no log of it and no way to answer questions about it later.
Paying for proper accounts costs roughly $30 per user per month for a general assistant. Buy them for the people who need them, name the approved tool in writing, and the behavior moves somewhere you can see it.
Minimum necessary applies to prompts
The minimum necessary standard does not pause because you are typing into a chat window. Asking a model to draft a referral letter does not require the whole chart. Give it the visit summary and the reason for referral, not the full history, and use initials or the chart number where a full name adds nothing.
Put one line in your policy: paste the least information that gets the job done, and never credentials, insurance identifiers or Social Security numbers.
Ambient scribes are the biggest time saver, with two conditions
Ambient documentation tools listen to the visit and draft the note. Practices commonly report getting 60 to 90 minutes of charting back per clinician per day, which is why this is the one AI purchase most clinical practices should look at first. Pricing generally runs between $100 and $300 per clinician per month.
Two conditions. The vendor signs a BAA that specifically covers the recording and transcription service. And you handle consent: several states require every party to a recording to agree, and regardless of your state the patient should be told and their agreement noted in the chart.
Pilot it with one or two clinicians for four weeks. Track minutes spent per note before and after, and count how often the draft needed real correction rather than a light edit. The clinician still signs the note and owns what is in it.
Front office work that never touches a chart
Plenty of useful work involves no PHI at all, so it needs no BAA and no debate. Recall and reactivation message templates with placeholders instead of names. Insurance verification call scripts. New patient welcome packets. Post operative instruction sheets written at a reading level people actually understand. Job postings, staff training outlines, website copy, responses to review patterns rather than to individual named reviewers.
Pick two of these this week. They cost nothing beyond the subscription and they let staff learn the tool on work that carries no risk.
Keep a folder an auditor can read
Four items. The signed BAAs. A one page policy naming approved tools and what may never be pasted into them. A training record with names and dates. A line stating that AI generated clinical content is reviewed and signed by a clinician before it enters the record.
Put those four things in one folder now, while there are only two tools to document. Reconstructing it after eighteen months of quiet adoption takes far longer.
If you want someone to work through this with you, the first call is free and runs about 30 minutes. We look at what your staff are already using, what your practice management vendor already includes, and which single workflow is worth starting with. Get in touch and pick a time.