Artificial intelligence (AI) can help organize questions for a medical visit or explain unfamiliar terms. Health information is also highly sensitive. Decide what the task needs before uploading records or connecting an account.
Direct and indirect sharing
You can share health information directly by uploading a record or connecting a health service. You can also expose it indirectly through email, calendars, receipts, pharmacy notices, insurance messages, or family care conversations. A calendar entry or refill pattern can reveal more than a name alone.
Understand the HIPAA boundary
HIPAA applies to covered entities and business associates acting in those roles. HHS explains that, in most cases, it does not protect information downloaded or entered into a personal app unless that app is provided by a covered entity or its business associate.
A consumer app's copy may instead be governed by its terms, privacy policy, consumer protection law, and applicable state privacy law. That does not remove the healthcare provider's duties for the record it holds. Avoid assuming either that every health app is covered or that no health app can be covered.
If you handle someone else's patient information for work, use the organization's approved services and verify the applicable agreement and configuration. A paid personal subscription is not evidence of approval or BAA coverage. Read Personal and Business AI Accounts for the distinction.
Share less for a simple task
For preparing appointment questions, a brief description may be enough. Leave out identifiers, portal credentials, insurance numbers, clinician contact details, and unrelated history. Keep precise facts that matter to the question; do not round medication doses or timing to make them less identifying. If you cannot share a necessary fact appropriately, use a different route.
Check training, memory, retention, search, and connected-app settings yourself. A temporary chat can reduce persistence in some services, but it does not mean no processing or retention occurs. Labels can reduce exposure while leaving people identifiable from context.
You and your clinician make the decisions
Use AI to prepare questions, not to diagnose a condition, establish that food is safe for an allergy, or decide on treatment. Check significant information with a qualified clinician. Do not change medication or delay urgent care because of an AI response.
Close the loop
Save useful questions in your own protected notes. Remove unnecessary chats, uploads, memories, and share links using the relevant controls. Disconnect a temporary connection and check permission at the source. These steps cannot recall information already disclosed or promise immediate erasure of every copy.
Keep going
- Safer AI Recipes, including preparing appointment questions.
- Short-Lived AI Access Checklist.
- Personal AI Security Checklist.
Sources
- HHS guidance on health information in personal devices and apps
- HHS FAQ on transmitting records to an app chosen by an individual
General information, not medical or legal advice.
The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.