Staff AI-use checklist for healthcare practices

Before anyone puts patient data into an AI tool

1. Keep a written approved-tools list, by plan.

   Only tools where your practice has a BAA for the exact plan you pay for go on it. The plan matters:

   • OpenAI: "We do not offer a BAA for ChatGPT Business." [source]
   • Otter: HIPAA compliance is only available on the Enterprise plan. [source]
   • Notion: you must be on the Enterprise Plan to sign the BAA. [source]
2. Confirm the BAA is actually in place, not just "available".

   Keep a copy and the date. How BAAs take effect varies:

   • Pearl's BAA takes effect when both parties execute it. [source]
   • Emitrr makes its BAA available for execution by subscribers; it isn't automatic. [source]
   • Twofold executes its BAA automatically at signup. [source]
   • Microsoft includes its BAA by default in the Data Protection Addendum for commercial services. [source]
3. No personal AI accounts for PHI.

   Staff often use free or personal accounts at work. These are the riskiest:

   • Microsoft's BAA covers commercial and GCC services; personal Copilot accounts fall outside it. [source]
   • ChatGPT personal plans can train on chats unless the user turns off "Improve the model for everyone". [source]
   • In the personal Gemini app, human reviewers read a subset of chats when Keep Activity is on. [source]
4. An individual clinician's BAA doesn't cover the rest of the team.
   • ChatGPT for Clinicians offers a single-user BAA for the verified clinician only. [source]

Set it up safely

5. Turn off or avoid features the BAA excludes.

   Many BAAs carve out specific features:

   • Copilot web-search queries sent to Bing are not covered by Microsoft's BAA. [source]
   • Gemini Notebook is not covered by the Google BAA. [source]
   • Claude Enterprise: connectors, Skills, Claude in Chrome, cloud Cowork and beta features are not covered. [source]
   • ChatGPT for Healthcare: improved memory, event-triggered tasks, Sites and Codex cloud are not covered. [source]
   • Fireflies: turning off Private Storage or downgrading disables HIPAA. [source]
6. Check training and data-retention settings at setup and after updates.
   • SimplePractice: starting June 17, 2026, de-identified Note Taker transcripts may be retained to improve its AI; retention can be managed per clinician, client or session. [source]
   • Google Workspace admins can set Gemini conversation retention from 90 days to indefinite. [source]
   • Grammarly may use de-identified samples unless you opt out. [source]

Train your people

7. Tell staff which tools are approved, which plan, and who to ask.

   A short list in onboarding and at the front desk beats a long policy no one reads.

8. Get recording consent where your state requires it.

   Ambient scribes and note-takers record visits.

   • SimplePractice notes that a number of states require consent from all parties to record a session. [source]
9. A clinician reviews AI-written notes before they go in the record.
   • SimplePractice requires clinicians to review and edit all AI-generated content before saving a note. [source]

Keep it current

10. Add each AI tool to your HIPAA risk analysis and vendor inventory.

    Treat it like any other business associate.

11. Re-check vendor terms on a schedule.

    Terms change mid-contract, so it helps to watch the vendors you use.

    • SimplePractice changed its transcript retention for AI improvement effective June 17, 2026. [source]
12. Re-approve a tool when you change plans.

    Downgrading can remove the BAA:

    • Fireflies: downgrading disables HIPAA. [source]

Next steps

Use the which-plan guide to check that the plan you pay for has a BAA, ask vendors the due-diligence questions, and compare terms in the BAA fine print tracker.