Healthcare AI readiness
AI data governance before Claude or ChatGPT
We help healthcare organizations prepare for AI with data classification, vendor and BAA review, DLP, identity controls, approved integrations, audit logs and staff training. Only then do we help configure and manage the right Claude or ChatGPT environment. A product name or an “Enterprise” label alone does not make an AI workflow suitable for patient information.
Start with the data, not the model
AI can help with administrative work, documentation, search and drafting. The same convenience can also expose patient identifiers, confidential files, credentials and unreviewed output. Before choosing a tool, we map what information exists, who owns it and which use cases are actually worth approving.
| Data or workflow | Governance decision before AI is enabled |
|---|---|
| Public website and approved reference material | Usually the lowest-risk starting point; confirm accuracy, ownership and the review process |
| Internal operating documents | Limit by role and repository, remove unnecessary secrets, and decide which connectors are approved |
| Patient records, images, messages and filenames containing identifiers | Treat as PHI. Use only an eligible product and feature with the required BAA, configuration and safeguards—or keep it out of the AI workflow |
| Credentials, security rules and privileged administration | Restrict tightly. Never place passwords, keys or unrestricted administrative access into a prompt |
| Clinical, legal, financial and personnel decisions | Qualified people remain responsible for review and decisions; AI output is not accepted blindly |
The controls we put around an approved AI workflow
We match the controls to your systems and obligations rather than copying a generic AI policy.
Data inventory and minimization
Identify repositories, owners, sensitive records and unnecessary retention. Approve specific use cases and sources rather than connecting every file by default.
Vendor and subprocessor review
Review the exact product, feature, contract, region, retention, training policy and integrations. A vendor may offer a BAA only for particular healthcare products or API features.
DLP and access
Apply data-loss-prevention rules, role-based access, SSO, MFA, device requirements and joiner/leaver processes. Restrict connectors, exports and unapproved personal accounts.
Logging and retention
Set organizational retention and audit logging. Know what prompts, responses, connected files and administrator actions are retained, where and for how long.
Secure configuration
Manage approved models, agents, plugins, browser features and API keys separately. Test with synthetic or non-sensitive examples before allowing production data.
People and ongoing management
Train users on approved sources, prompt practices, reporting and output review. Reassess vendors, permissions and use cases as products and risks change.
Claude and ChatGPT require feature-level decisions
Both vendors offer business and healthcare controls, but their coverage is not interchangeable and does not automatically include every feature or integration. We check the current documentation and contract for the exact setup you plan to use.
| Decision | What we verify before any PHI is used |
|---|---|
| Claude | Anthropic’s current documentation describes HIPAA-ready API access for eligible organizations with a signed BAA and HIPAA-enabled organization. Coverage is limited to supported API features. Claude Console usage, Claude Code, third-party integrations and other listed features have important exclusions. |
| ChatGPT | OpenAI publishes business controls such as SSO, role-based access, audit options and retention controls. Its current BAA availability is aimed at qualifying healthcare customers; eligibility and the exact workspace, applications, plugins and API usage still need to be confirmed. |
| “Enterprise” or admin controls | SSO, DLP, SCIM, audit logs and retention settings help governance but do not by themselves authorize PHI. A BAA and the product’s covered scope still matter. |
| Other AI tools and connectors | Review each service and subprocessor independently. An integration’s own terms may apply even when the model provider offers a BAA. |
Sources checked for this guide: Anthropic’s API retention and HIPAA-readiness documentation and OpenAI’s business privacy, security and compliance documentation. Product terms change, so we review them again during implementation.
A practical healthcare AI rollout
We help select and manage the approved environment rather than simply handing staff a login.
For implementation of an approved workflow, see our AI and automation services.
Healthcare AI governance questions
Can we use Claude or ChatGPT with patient information?
Not by default. First confirm that the exact product and feature is eligible for PHI, obtain any required BAA, enable the covered organization configuration, and complete your own risk, access, DLP and retention review. If those conditions are not met, keep patient information out.
Does an Enterprise subscription include a BAA?
Do not assume so. Admin controls and a subscription tier are not the same thing as a signed BAA or covered feature scope. Review the executed agreement and current documentation for the product and workflow you intend to use.
Can AI be used safely without any patient data?
Yes, many administrative workflows can use public documents, approved policies or synthetic examples. Data minimization, account controls and output review are still important because internal files can contain other confidential information or credentials.
Can AI make clinical or compliance decisions for us?
No. AI can assist with drafting and research, but qualified people remain responsible for clinical judgments, HIPAA decisions, legal conclusions and final approvals. Review sources and output before acting.
Build the governance once, then use AI with confidence
We review your current data, Microsoft 365, security controls and proposed AI use cases, then provide a concrete rollout plan and managed configuration.