- Free ChatGPT is not HIPAA-compliant. Never paste patient information into it.
- AI inside a practice splits cleanly into administrative work (safe with the right tools) and clinical work (use only purpose-built, BAA-covered tools).
- Front-office tasks — intake, scheduling reminders, billing follow-up, marketing — are where AI delivers the fastest, safest wins.
- A signed Business Associate Agreement (BAA) is the legal line between safe and unsafe AI use in a healthcare setting.
- Clinical judgment, diagnosis, and treatment decisions stay with the provider. AI assists with the paperwork around them.
If you run an independent healthcare practice — dental, optometry, chiropractic, mental health, primary care, physical therapy — you have a problem that's specific to your industry. You're a clinician. You're also a small business owner. You're also, more often than you'd like, the office manager, the marketing director, the billing clerk, and the IT department.
AI can help with a lot of that. It can also get you in serious trouble if you use it carelessly. This guide is about the difference.
I'll be direct about the trouble part because it matters: the free version of ChatGPT, the free version of Claude, the free version of Gemini — none of them are HIPAA-compliant. None of them. If you paste protected health information (PHI) into a consumer-grade AI tool, you are very likely violating the law, and you are definitely violating the trust your patients have placed in you. Don't do it.
The good news: there are real, BAA-covered AI tools that handle PHI safely. And there's a large amount of work in a practice that doesn't touch PHI at all and is wide open for AI assistance today.
The line that matters: BAA vs. no BAA
A Business Associate Agreement (BAA) is the legal document an AI vendor signs that makes them a HIPAA-covered partner. Without a BAA in place, the vendor is not allowed to process PHI on your behalf, full stop.
Here's the rough state of play as of writing this:
- OpenAI offers BAAs on the Enterprise tier of ChatGPT. Not on the free, Plus, or Team tiers.
- Anthropic offers BAAs on Claude for Enterprise. Not on the consumer plans.
- Google offers BAAs on Google Workspace healthcare plans, which covers Gemini inside Workspace. Not on consumer Gemini.
- Microsoft Copilot offers BAAs on its enterprise commercial tier.
Several healthcare-specific AI vendors exist that come BAA-ready: Doximity GPT, Abridge, Nuance DAX, Suki, Heidi, Freed, and others. These are designed for clinical use and ship with the legal coverage assumed.
The rule: before you put a single piece of patient information into any AI tool, confirm a BAA is in place. If it isn't, the tool is for non-PHI work only.
Where AI delivers real value in a practice
There are five places AI earns its keep inside a private practice. Two of them touch PHI and require BAA-covered tools. Three of them don't touch PHI at all and can be done with consumer-grade tools today.
1. Marketing and patient-facing content (no PHI required)
Most private practices under-invest in marketing because the clinician doesn't have time and a marketing hire feels excessive. AI changes the math.
A practice can use Claude or ChatGPT to draft:
- Blog posts on common patient questions ("What to expect at your first dental cleaning," "Why your back hurts after sitting all day," "How to know if you need glasses")
- Newsletter content for existing patients
- Social media posts for Instagram, Facebook, or LinkedIn
- Website copy for service pages
- Email templates for common patient communications
None of this involves a specific patient, so none of it requires PHI. The office manager or owner can batch this work into a weekly hour, with Claude or ChatGPT as the drafting tool and the provider doing a final read for clinical accuracy.
A note for healthcare specifically: anything you publish that could be read as medical advice should be reviewed by the licensed clinician. AI drafts the post. The clinician confirms it before it goes live.
2. Intake and scheduling automation (PHI-adjacent, use BAA tools)
The intake process at most practices is a paperwork tax on every new patient. Forms get filled out on a clipboard, scanned, and re-typed into the practice management system. Insurance gets verified by phone. Reminders get sent manually or not at all.
Several vendors have built AI-assisted intake systems with BAAs in place: Klara, Solutionreach, Weave, NexHealth, Modento (dental), Yapi (dental), Spruce. These handle structured intake, eligibility checks, and reminder cadences without you pasting PHI into anything you shouldn't.
The result for a typical small practice: 30–60 minutes a day of front-desk time recovered, fewer no-shows, and a more accurate intake record going into the visit.
3. Clinical documentation (PHI, use clinical AI vendors)
This is the place AI is changing healthcare fastest. AI scribe tools — Abridge, Nuance DAX, Suki, Freed, Heidi, Sunoh.ai — listen to the patient encounter (with consent) and generate a draft of the clinical note before the provider has left the room.
The before/after on this is dramatic. Providers report 1–2 hours a day of charting time recovered. Notes are more complete. Patient eye contact improves because the clinician isn't typing during the visit.
The non-negotiable: every note is reviewed and signed by the provider. AI drafts. The clinician confirms. This is not a place for "trust the model and move on."
If your practice is in a specialty where these tools are well-supported (primary care, internal medicine, behavioral health, urgent care, specialty consults), the ROI calculation is short. If you're in a specialty where the tools are still maturing (highly procedural specialties, pediatrics with parent-as-historian), evaluate carefully and pilot before standardizing.
4. Billing and revenue cycle (PHI, use BAA-covered tools or established RCM vendors)
AI is making real progress on billing — denial management, code suggestion, payment posting, eligibility verification, prior authorization. The vendors in this space (Waystar, Availity, Olive, Inbox Health, Candid) are built for HIPAA-covered workflows.
For a small practice, the higher-leverage move is usually selecting one of these established platforms rather than building anything custom. Billing is too consequential and too regulated to be the place a practice experiments with consumer AI tools.
5. Internal operations (no PHI, use whatever you like)
Everything that isn't about a specific patient is fair game for consumer-grade AI tools:
- Drafting hiring posts and screening candidate emails
- Writing staff communications and policy updates
- Building training materials for new hires
- Summarizing CE content for the team
- Researching equipment purchases or vendor comparisons
- Drafting vendor emails
- Building spreadsheet logic for financial reporting
Use Claude for nuanced writing. Use ChatGPT for structured tasks. Use Gemini if you're already inside Google Workspace.
A starter sequence for a practice that hasn't started yet
If you're a practice owner reading this and you haven't built any of this yet, here's the order I'd recommend:
Week 1 — Non-PHI experiments. Open Claude or ChatGPT. Have it draft a single newsletter email or blog post. Spend an hour learning what good and bad output looks like. The cost is your time and a single subscription.
Weeks 2–4 — Marketing cadence. Commit to one piece of patient-facing content per week. Newsletter, blog, social — pick the channel where your patients actually pay attention. Use AI to draft, you to edit, your clinician to fact-check.
Month 2 — Intake or scheduling vendor. Evaluate two BAA-covered intake or scheduling AI vendors. Pilot one. The criteria: does it integrate with your practice management system, does it actually save the front desk time, and is the patient experience at least as good as today.
Month 3 — Clinical documentation pilot (if applicable). If your specialty supports AI scribes, pilot one with a single provider for thirty days. Measure charting time, note quality, and provider sentiment. If it works, expand.
Month 4 and beyond — Tighten and expand. Pick one workflow at a time. Owner, cadence, tool, measured outcome.
What you should never automate
Diagnosis and treatment decisions. Always. AI can summarize a chart, suggest a code, draft a note. It does not diagnose. It does not prescribe. It does not decide what care a patient needs.
Patient communication where empathy matters. Bad news, sensitive findings, end-of-life conversations — these are human work. AI can help you organize your thoughts; it does not write the message.
Anything that requires the licensed clinician's signature. Every consult note, every prescription, every referral letter gets read by the provider before it goes out. No shortcuts.
Compliance work. HIPAA, OSHA, state licensing — get human expertise on this. AI is a research assistant; it is not your compliance officer.
Patient data handling outside BAA-covered tools. Never. There is no shortcut here, no time-saving worth the risk.
A specific note on telehealth and mental health
Mental health practices have an additional consideration. AI tools that "listen" to a session must have explicit patient consent. The therapeutic relationship is the product, and patients are sensitive — appropriately so — to a third party in the room, even a digital one.
The same caution applies to any practice working with sensitive populations: pediatrics, geriatric care, gender-affirming care, immigrant health, anywhere trust is fragile. Lead with patient consent and clarity. The legal floor (consent for recording) is not the ceiling on what good practice looks like.
Tools, by name
For a private practice starting from zero, here's a minimum stack:
- A consumer-grade AI for non-PHI work — Claude (Anthropic) for nuanced writing, ChatGPT (OpenAI) for structured tasks. Pick one to start.
- A BAA-covered AI for any PHI-adjacent administrative work — Google Workspace healthcare plan, Microsoft 365 commercial, or OpenAI Enterprise.
- An intake or scheduling vendor with AI features — depends on specialty. Weave, NexHealth, Klara, Solutionreach are common starting points.
- A clinical AI scribe (if specialty supports) — Abridge, Nuance DAX, Suki, Freed, Heidi. Pilot before standardizing.
- A billing platform with AI features — Waystar, Availity, Candid, or your existing RCM partner.
Monthly cost depends heavily on which clinical and operational vendors you bring in. The marketing-only side of this stack runs under $50 a month. A full clinical and intake stack can run several thousand a month. The clinical-side investment usually pays back inside a quarter if it works for your specialty.
The short version
AI inside a private practice splits cleanly into administrative work (safe with the right tools, fast ROI, low risk) and clinical work (use only purpose-built, BAA-covered tools, with the provider in the loop on every output).
The owner of an independent practice is doing five jobs at once. AI is a way to give some of those jobs back to the people who can do them — including the most important person in the building, who should be spending more time with patients and less time fighting paperwork.
If you'd like the system designed for your specific practice, with the tooling chosen for your specialty and the workflows fitted to your team, the Daring Brief is the place to start.