Skip to main content
We use AI tools, mainly Claude and Claude Cowork, for a lot of practice work: drafting, planning, documenting procedures, marketing, systems. You’re encouraged to use them. There’s one rule that governs everything you put in: real client information never goes through them.

​
Why

No consumer or small-team AI plan comes with a business associate agreement. That means an AI tool isn’t a permitted place for PHI, no matter which plan we’re on. Upgrading plans doesn’t fix it. What you type in is what matters. This is the same reason the internal chat is initials-only. Same principle, same bar.

​
The three-color rule

Every piece of work you might take to an AI tool falls into one of three colors. Green: use freely. No client information involved. Marketing copy, website and social content, scheduling logic, SOPs and checklists, business strategy, systems build work, aggregate statistics with no names attached, general clinical questions that don’t reference a specific client. Go ahead. Yellow: sanitize first. Work that involves a client’s situation but can be done without identifying them. Before pasting:
  • Replace the name with initials or a case label (“J.D.,” “Client A”), every time, the same standard as internal chat.
  • Drop date of birth, address, and phone unless the tool can’t do the job without them.
  • Include only the specifics the task actually needs.
Examples of Yellow work: drafting a coverage-estimate explanation from an insurance card (initials plus plan details, no DOB or address), a client-advisory document that references a court order (initials plus only the facts the advisory needs), and billing help where a claim or member ID is the point (initials-only otherwise). Red: never, sanitized or not. Full therapy or session notes. A full Social Security number. Full legal name plus date of birth plus clinical detail together. Anything where the combination would identify someone even with a name removed. This work stays in PracticeOS.

​
If PHI slips through

AI tools can’t intercept information before it’s sent. Once you’ve pasted it, it’s been received. So this is a backstop for accidents, not a reason to skip sanitizing:
  1. Don’t just abandon the task. Relabel with initials or a case label and continue, so the exposure doesn’t repeat for the rest of that conversation.
  2. Tell the practice manager the same day, as a privacy incident. See Breach and incident reporting. A single accidental paste, reported, is handled as a mistake.

​
Not sure which color?

Don’t paste it. Ask Zack or Helen. Same norm as everything else in this section.

​
Clinical use

AI tools don’t make clinical decisions here, and they don’t write your notes for you. Using AI to draft a session note from a recording or transcript is Red: that’s session content. Using it to help you phrase a general treatment plan template with no client details is Green.

​
The source

This page formalizes SOP 19. The SOP has the fuller rationale and gets updated first when the rule changes. See the SOP library.