Can clinics and therapists use ChatGPT with patient notes? HIPAA and Alberta's HIA
Short answer: not in a consumer account. Identifiable patient information needs a tool your privacy law allows, which in the US means one covered by a business associate agreement (BAA). For everyday drafting, the safer habit is to keep identifying details out of the prompt altogether.
United States: HIPAA and the BAA question
Under HIPAA, a vendor that handles protected health information for you needs a BAA. OpenAI's help centre lists which services can get one:
| OpenAI service | BAA available? |
|---|---|
| API Platform | Yes, self-serve once eligible |
| ChatGPT Enterprise and Edu | Yes, through OpenAI's sales team |
| ChatGPT for clinicians | Yes, separate in-product sign-up for eligible clinicians |
| ChatGPT Business | No |
| Free, Plus and Pro | Not listed as covered |
Masking details helps, but it doesn't automatically make text "de-identified" under HIPAA. HIPAA's standards cover more than names and numbers, including most dates and small geographic areas. If you need to send patient information, use a BAA-covered tool; use masking on top of it, not instead of it.
Alberta: what the privacy commissioner expects
The Office of the Information and Privacy Commissioner of Alberta's guidance for small custodians under the Health Information Act says:
- A privacy impact assessment is required, and must be submitted to the OIPC before you implement a new system that collects, uses or discloses identifying health information.
- You need legal authority under the HIA for each purpose. Secondary uses, like the provider training its AI on your data, may not have it.
- Ask the provider whether it trains on your data and whether information is processed outside Alberta or Canada.
- Tell patients whether and how AI is used, and let them opt out.
Other provinces have their own health privacy laws and commissioners; check yours.
A safer everyday workflow
- For referral letters, summaries and patient handouts, work from a version with the patient's name, health number, address, date of birth and contacts removed or tagged.
- Keep clinical facts general enough that they don't identify someone on their own.
- Restore the real details in your own system, not in the AI tool.
- Review every clinical statement before it leaves your hands.
Stand-In's Health pack catches health card and patient ID numbers along with names and contact details. It's a way to reduce what leaves your device, not a substitute for a BAA or a privacy impact assessment.
Do this in one step with Stand-In
Drop in a PDF, scan, Word or Excel file. Stand-In swaps every name, SIN/SSN, account number and address for a tag like [PERSON_1], then puts the real details back in the AI's answer. It runs on your device; nothing is uploaded.
Sources: OpenAI, Getting a business associate agreement · OIPC Alberta, Guidance for small custodians on the use of AI (Nov 2023)