Can employees use ChatGPT and stay HIPAA-compliant?

Potentially, but not simply because an organization uses ChatGPT. HIPAA obligations depend on the organization’s role, the information involved, the service and configuration used, and the safeguards and agreements in place.

There is no blanket yes or no.

A covered entity or business associate should not assume that any consumer AI account is suitable for handling PHI. Assess the service and account, applicable agreements, organizational risk analysis, and safeguards before enabling a workflow.

When it may be possible

Use a service and configuration reviewed and approved for the intended data and use case, with applicable agreements and safeguards.

When to pause

If PHI would be shared with a service not approved for that use, pause until privacy, security, and legal stakeholders review it.

What this cannot certify

A product or technical control alone does not make an organization HIPAA-compliant.

A six-point review before employees use ChatGPT

Treat this as an ongoing governance process, not a one-time software rollout.

1. Identify PHI

Check prompts, uploaded files, outputs, and stored conversation histories.

2. Review the service

Verify product, account type, settings, terms, and intended use.

3. Confirm agreements

Determine whether a business associate agreement is required and covers the service and use.

4. Apply safeguards

Assess access controls, authentication, risk analysis, training, and technical safeguards.

5. Set retention rules

Understand storage, access, retention, deletion, and record-handling requirements.

6. Document oversight

Assign owners, review changes, maintain records, and prepare incident response.

HIPAA compliance is broader than prompt redaction.

Redacting sensitive information can reduce exposure in supported workflows, but it does not replace vendor review, required agreements, organizational risk analysis, access controls, workforce training, retention policies, or incident response.

People & policy

Define approved use cases, train employees, and provide a clear review path.

Technology & configuration

Use suitable access, data-protection, logging, and configuration controls.

Oversight & response

Review risks, document decisions, and plan for suspected exposure.

Add an AI interaction security layer - not a compliance shortcut.

SecurePledge helps protect sensitive information in supported AI interactions. It complements broader privacy, security, and compliance controls; it does not certify that a workflow or organization is HIPAA-compliant.

Masker

Masker protects AI usage across browsers, AI gateways, desktop applications, and AI agents through a unified security and governance platform. It brings security controls together to help organizations manage AI interactions and apply policies across supported environments.

Redactor

Redactor helps protect personally identifiable information (PII) and protected health information (PHI) by redacting sensitive data in real time. It replaces sensitive information with safe, format-preserving data across supported images, documents, and PDFs before the information leaves your network.

Protector

Protector helps organizations control AI usage within employee browsers and guide users toward secure AI adoption. It supports visibility and security controls for browser-based AI workflows, helping teams manage unauthorized AI tools and reduce the risk of sensitive information being submitted through prompts.

Governor

Governor is the unified governance layer built into every layer of Masker. It supports policy enforcement, auditability, and compliance-related oversight by providing visibility into AI interactions and helping organizations identify and investigate potential policy breaches.

Real-World Applications

Healthcare cybersecurity illustration showing patient records exposed through an AI chat tool

AI Incidents

Patient Data Exposure Through AI Tools: The Johns Hopkins Case

A recent data breach at Czech online supermarket Rohlík highlights a growing challenge for businesses: protecting the sensitive information stored

Cybersecurity shield protecting AI conversations and customer data from unauthorized access

AI Incidents

Rohlík Data Breach: The Hidden Risk of Exposed AI Conversations

A recent data breach at Czech online supermarket Rohlík highlights a growing challenge for businesses: protecting the sensitive information stored

Make AI use a reviewed, governed decision.

Start with the workflow, the data, and the safeguards – not assumptions.

HIPAA and ChatGPT: common questions

Can employees paste PHI into ChatGPT?

Only after the specific service, account, configuration, agreements, and workflow have been reviewed and approved for that use.

Does using ChatGPT automatically violate HIPAA?

Not automatically. The answer depends on the entity, use case, data, service arrangements, and applicable safeguards.

Does a business associate agreement solve everything?

No. Where required, it is one part of the assessment. Risk analysis, safeguards, policies, and oversight still matter.

Does redacting PHI guarantee HIPAA compliance?

No. Redaction can reduce exposure in supported workflows but does not replace broader requirements.

What should a healthcare organization do first?

Inventory AI use cases, identify the data involved, review the service and settings, involve privacy and security teams, and document approval.