10 AI questions for your practice
AI tools are arriving in practices faster than the rules around them. These 10 questions help you see where your practice stands. Answer each one Yes, No, or Not sure. "Not sure" is a perfectly normal answer: It just tells you where to look first.
Your team
- Could you name every AI tool your staff used for work this month, including free apps and browser add-ons?
Why it matters: Free AI apps are easy to start using, and each one is a place patient information can end up.
- Have staff been told in writing which AI tools are OK for work and which are not?
Why it matters: Without written guidance, staff have to guess which tools are safe for work, and guesses vary.
Patient information
- Do staff know never to type or paste patient names, birth dates, or chart details into an AI tool your practice has not approved?
Why it matters: Many free AI chats are not covered by any agreement with your practice, so patient details typed there leave your control.
- Have you asked staff whether patient details have already gone into an AI tool?
Why it matters: Asking now lets you find and fix it on your own terms.
Vendors
- For each AI tool you use, have you checked whether the company saves what staff type in?
Why it matters: Some AI companies keep conversations or use them to improve their products unless you change a setting or pay for a business plan.
- Do you have a signed Business Associate Agreement with every AI vendor that handles patient information?
Why it matters: Under HIPAA, a vendor that creates, receives, keeps, or sends patient information for your practice needs a signed Business Associate Agreement before it does.
- Has someone reviewed the AI features already switched on inside software you use, like your EHR, phone system, or email?
Why it matters: Software you already trust may have added AI features recently, and they may be on by default.
When something goes wrong
- Has your insurer told you in writing whether your policy covers a loss caused by an AI tool?
Why it matters: Some policies now limit or leave out losses tied to AI, and the time to learn that is before a claim.
- If an AI tool produced something wrong that reached a patient, would staff know who to tell?
Why it matters: A fast, calm response keeps a small mistake small.
- Do you know how to quickly stop an AI tool from reaching your systems if you needed to?
Why it matters: If a tool starts sending data where it should not, or its company reports a security problem, you want to cut it off quickly.
What to do with your answers
- Circle every "No" or "Not sure."
- Start with questions 3 and 4. Patient information comes first.
- If question 4 turns up patient details in an AI tool, tell your practice's privacy lead right away. They can decide whether a formal breach review is needed.
- Give each circled item one owner and one target date. If you are not sure what fixing it looks like, start there.
No privacy lead yet? Naming one is the first item on your list.
If every answer is Yes, great. Make sure those habits are written down, because written policies hold up better than habits. Run through this list again whenever you add a new tool, vendor, or staff member.
This checklist helps you find the gaps. If you want a second set of eyes, Harborline can walk through your answers with you on a short call, and a HIPAA Risk Assessment can go further.