Using ChatGPT with Patient Data Without Breaching HIPAA
You can use ChatGPT for clinical admin, drafting and summarising without breaching HIPAA if no protected health information reaches it. The consumer versions of ChatGPT, Gemini and Claude are not covered by a Business Associate Agreement, so any patient-identifying data you paste is a disclosure. The fix is to anonymize before sending: strip names, dates, record numbers and the other identifiers, so the AI works on [PERSON_A] and [DATE_B] while the real values stay on your machine. PiiBlocker is a free Chrome extension that does this as you type on ChatGPT, Claude, Gemini, Perplexity, Grok, DeepSeek and Kimi. This guide covers what HIPAA requires, what to remove, and a process that holds up in an audit.
What HIPAA requires
HIPAA's Privacy Rule allows health information to be used freely once it is de-identified. There are two routes under 45 CFR 164.514(b). Expert Determination, where a qualified statistician certifies the re-identification risk is very small, and Safe Harbor, where 18 specified identifiers are removed. Safe Harbor is the one a practice can apply itself.
The 18 identifiers include names, all geographic subdivisions smaller than a state, all dates except year, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, licence numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photos, and any other unique identifying number or code.
A consumer AI chatbot without a BAA is not a business associate, so pasting PHI into it is a disclosure you cannot make. OpenAI and others offer BAAs for certain API and enterprise products, but not for the consumer apps most staff actually use. De-identification before sending removes the question: what leaves the practice is not PHI.
What to strip from a prompt
In practice, before any patient-related text goes into a chatbot:
- Patient, family member and provider names
- Dates of birth, admission, discharge, death, appointment dates
- Addresses, ZIP codes, phone and email
- Medical record numbers, account numbers, insurance IDs
- Social Security numbers and other government IDs
- Any number or code that could be looked up in your own system
What can usually stay: the clinical content itself, the year, the patient's age if under 90, and the question you want answered. "62-year-old with type 2 diabetes, HbA1c 8.4, on metformin. Draft a patient-friendly explanation of why we're adding a second agent" contains no identifier. The same text with a name, a DOB and an MRN is PHI.
A process that holds up
- Decide what the AI is for. Drafting patient letters, summarising guidelines, rewriting discharge instructions in plain language. Not uploading charts, not bulk records.
- Anonymize at the point of sending. In the browser, not by editing a document first. Manual redaction is where identifiers get missed.
- Check the placeholders before the message goes. The tool should show what it found and let you confirm. Anything it missed, mask by hand.
- Keep the mapping local. The link between
[PERSON_A]and the real patient must never leave your machine. The AI's reply comes back with placeholders; the tool swaps the real values back on your screen only. - Treat dates and ages carefully. Safe Harbor requires removing all dates except year and any age over 89. Automated tools catch dates of birth reliably; a stray appointment date in running text is the common miss.
- Write the policy. One page: what uses are allowed, what must be removed, which tool does it, who is responsible. This is what an auditor asks for first.
How PiiBlocker fits
PiiBlocker runs steps 2 to 4 for you. As you type into ChatGPT or any of the other six supported sites, it detects names, dates of birth, addresses, phone numbers, email addresses, government IDs, account numbers and medical conditions, and highlights them. Before the message is sent, a dialog shows what it found. Critical items are redacted automatically; the rest you confirm with one click. The AI receives placeholders. The reply is unmasked on your screen.
Everything runs in your browser. The free version makes no network calls, has no account, and stores nothing on a server. There is no third party to sign a BAA with, because nothing is sent to one.
One honest limit: PiiBlocker is a detection and masking control, not a Safe Harbor certification. It catches the identifiers that appear in ordinary text. It will not know that a device serial number in a note is a Safe Harbor identifier, and it cannot review a document you did not paste. Your policy and the confirmation step are what close that gap.
For practices and health systems, the enterprise tier adds managed deployment through Group Policy and an admin dashboard, so the same protection covers every workstation without relying on individual installs.
Frequently asked questions
Is it a HIPAA violation to use ChatGPT? Using ChatGPT is not a violation. Putting protected health information into a version not covered by a BAA is. If the information is de-identified before sending, it is not PHI and the rule does not apply.
Does ChatGPT Enterprise or the API with a BAA solve this? It changes the legal position for that product. It does not stop staff using the consumer app on their own account, which is where most real exposure happens. Redaction in the browser covers both.
Is removing the patient's name enough? No. Safe Harbor lists 18 identifier types. Dates, record numbers, ZIP codes and account numbers are the ones most often left in.
What about the UK and GDPR? The same approach applies. Patient data is special category data under UK GDPR, and anonymised data falls outside it. The identifier list is not fixed at 18, but names, dates, NHS numbers, addresses and contact details are the practical set.
Is PiiBlocker free for clinics? The core extension is free with no seat limit. The enterprise tier is for organisations that want central deployment and reporting.
Install PiiBlocker free from the Chrome Web Store, or see the full list of supported sites and detected data types at piiblock.com.