Your front desk coordinator just used ChatGPT to summarize a patient intake form. Your billing manager ran a claim note through it to clean up the language. Your clinical director asked it to draft a referral letter, name included. None of them thought twice about it.
This is happening in Nashville healthcare practices right now, and most owners have no idea. If your team is using AI tools without a vetted governance framework, you are carrying HIPAA exposure you have not assessed. Safe Network Solutions works with healthcare organizations across Tennessee to close that gap. Start with an AI governance review before a routine workflow becomes a federal investigation.
The Question Every Nashville Healthcare Practice Is Asking Right Now
“Can we use ChatGPT?” It is a fair question. The tool is fast, capable, and already on every employee’s personal phone. The problem is that most practices answer it informally, with a quick search, a shrug, and a “probably fine if we are careful.” That is not a compliance posture. It is a liability.
The Office for Civil Rights under HHS enforces HIPAA, and not understanding how a tool handles data is not a defense. Tennessee providers have faced enforcement for far less than an unmanaged AI rollout introduces. Penalties range from roughly $100 to $50,000 per violation depending on culpability, and they add up fast.
Why ChatGPT Is Not HIPAA Compliant by Default
The standard version of ChatGPT, the one at chat.openai.com, was not built for healthcare use. OpenAI’s standard terms do not include a Business Associate Agreement. No BAA means no compliant path to using the tool with Protected Health Information under 45 CFR Part 164.
A BAA is not optional. Under 45 CFR 164.308(b), covered entities must have written agreements with business associates before sharing PHI. Without one, any disclosure of patient information to a third-party vendor is a potential violation, regardless of intent. The consumer version can also train on user inputs by default, which means a symptom summary or a partial diagnosis note becomes PHI, leaving your control with no contractual safeguard. “HIPAA compliant” is not a feature you toggle. It is a legal relationship backed by accountability, and ChatGPT, as most staff use it, does not have that relationship with your practice.
What Counts as a HIPAA Violation with AI Tools?
PHI is more than a name and a diagnosis. Under 45 CFR 164.514, eighteen categories of identifiers can make health information individually identifiable. Dates, geographic data, phone numbers, and account numbers all count.Â
That means violations can happen even when staff believes they are being careful. Common examples include:
- Pasting a clinical note into ChatGPT to “clean up the language” before sending it to a specialist
- Summarizing a patient complaint that includes a name or date of birth
- Running billing documentation through a chatbot to check coding language
- Asking AI to draft a referral letter using details pulled from your EHR
None of these feel like a breach. All of them can be. The threshold is not malicious intent. It is whether PHI was disclosed to an unauthorized recipient without a valid BAA.
The BAA Problem: What Vendors Actually Offer
Some AI vendors do offer BAAs. Microsoft offers one for certain Azure-based services. Google Workspace for Healthcare includes a BAA. OpenAI offers a BAA only under its ChatGPT Enterprise and API agreements, not the standard consumer product. That creates a practical problem, because the version your staff uses on their browsers and phones is almost certainly not the enterprise configuration covered by a BAA. The enterprise version requires separate procurement, configuration, and user management. It is not the same product, and the two are not interchangeable.
Even when a BAA exists, it does not automatically make a tool safe. The agreement defines obligations, but your practice still has to evaluate data handling, access controls, audit logging, and breach notification against the HIPAA Security Rule. Safe Network Solutions evaluates AI tools for HIPAA compliance specifically, including BAA review, security risk analysis, and staff usage policy, as part of our compliance and regulatory support. If your team touches patient data with any AI product and you have not done this analysis, it is not a project for later.
What Your Staff Is Likely Already Doing
The gap between your official IT policy and actual staff behavior is almost always wider than leadership believes. Staff is not trying to create liability. They are trying to hit deadlines.
ChatGPT helps them draft, summarize, and communicate faster, and nobody told them where the line is, so they are drawing it themselves. The exposure shows up as personal AI accounts on work devices, EHR content pasted into public chatbots, and “low risk” administrative tasks that quietly include a date, a condition, or a name. It adds up.
How to Fix This Before It Becomes a Breach
Fixing this is not about banning AI. Practices that try to prohibit every tool lose the battle quickly, because enforcement becomes impossible. The better path is governance: clear policy, vetted tools, documented training, and ongoing oversight. Our program is built on NIST AI RMF 1.0 and crosswalked to HIPAA, CIS Controls v8, SOC 2, and NIST CSF 2.0. “
Every high-risk system gets a named owner, a data handling rule, a human override path, and a quarterly review. When a partner, insurer, or auditor asks how you govern AI, you hand them the evidence rather than a verbal summary. The same documentation discipline we cover in HIPAA compliance documentation for Nashville healthcare applies here, pointed at your AI tools. A security assessment gives you the technical baseline to start from.
Consumer ChatGPT is not HIPAA compliant because it has no BAA and can train on what you type. Staff is almost certainly using it with patient data already. Do not ban it. Govern it, with a vetted tool under a signed BAA, a one-page policy on what never goes into a prompt, and documentation you can hand an auditor. Assume usage exists until you have looked.
Is Your Practice Sure ChatGPT HIPAA Compliance Is Handled?
Most practices we review are surprised by what their staff is already pasting into AI tools. We run a discovery pass, review your vendor agreements and BAAs, and set up the policy and sanctioned tooling to match, so the productivity stays and the exposure goes.
You can also find us on Google to read what other Nashville businesses say about working with us.Â
Book a HIPAA AI Risk Review →
Frequently Asked Questions About ChatGPT HIPAA Compliance
Is ChatGPT HIPAA compliant?
Not by default. The standard consumer version at chat.openai.com does not come with a Business Associate Agreement and is not covered under terms that meet HIPAA requirements. OpenAI offers a BAA under its ChatGPT Enterprise and API products, but those require separate procurement and configuration. If your staff use the free or standard paid version with PHI, that is a compliance risk, not a gray area.
What happens if staff use ChatGPT with patient data?
Disclosing PHI to a vendor without a signed BAA is an unauthorized disclosure. Depending on the specifics, that can trigger self-reporting under the Breach Notification Rule, an OCR investigation, and civil penalties that scale with culpability. A pattern of employees using an uncovered tool without training or policy is hard to characterize as “unknowing” once leadership has been made aware.
What AI tools are actually safe for healthcare practices to use?
Safety depends on three things: a valid BAA, appropriate technical configuration, and a usage policy governing what data staff may enter. Some tools can be compliant in the right configuration, including Microsoft Copilot under a healthcare agreement, Google Workspace with a BAA, and certain EHR-integrated tools inside your existing business associate framework. “Can be compliant” is not the same as “is compliant by default.” Every tool needs evaluation.
Safe Network Solutions is a technology consulting firm located in Nashville, TN. We are focused on reducing our Clients’ stress and the time they spend handling IT related issues. As technology has become more integrated with daily business tasks, downtime is not an option. Whether your systems reside on-premise, in the cloud, or in a hybrid setup, you need a partner with expertise in a wide array of technologies, with a security focus.
