The front desk is drowning
Ask any practice manager where the pressure is and you'll hear the same list: phones that never stop, appointment reminders, rescheduling, intake forms, insurance questions, refill requests and a patient portal inbox that refills as fast as it's cleared.
AI can help with a lot of that. In healthcare, though, every shortcut has to pass one test first: where does the patient data go?
Where AI helps a practice
- Appointment reminders and rescheduling. Automated, two-way reminders cut no-shows and let patients move appointments without a phone call.
- Answering common questions. Hours, directions, what to bring, which insurance you accept. An assistant can handle these from approved content.
- Intake and forms. Digital intake that flows into your systems instead of being re-typed from a clipboard.
- Drafting replies. Staff get a first draft of a portal or email reply to review, edit and send.
- Summaries. Long message threads or referral documents summarized for the clinician who needs the key points.
Where it goes wrong
Staff using free AI tools
The most common risk isn't a sophisticated attack. It's a well-meaning staff member pasting a patient message into a free chatbot to get help writing a reply. That data has now left your control.
Vendors without the right agreements
Any vendor that handles protected health information on your behalf generally needs a business associate agreement. Many AI tools don't offer one on their standard plans. Ask before anyone uses it, and check with your compliance advisor on what you need.
AI assistants that see too much
Tools like Microsoft Copilot can surface anything a user has access to. If old shared folders or broad SharePoint permissions expose patient records or HR files, an AI assistant makes them easy to find.
Apps connected without review
Note-takers, scheduling add-ons and browser extensions can be granted access to mailboxes and files with a single click. Each one is a path for patient data.
A safer way to start
- Write an AI use policy. Approved tools, what data never goes into AI, and who to ask. Have every staff member acknowledge it.
- Inventory connected apps. Find every AI and third-party app with access to your email, calendar and files, and remove what you don't need.
- Fix oversharing before you turn on an AI assistant. Review sharing links and site permissions so AI can only reach what each person should see.
- Lock down sign-ins. Strong MFA everywhere, protected admin accounts and alerts on unusual access.
- Choose vendors that will sign the right agreements for any tool that touches patient data.
- Re-check regularly. New staff, new apps and new settings change your exposure every month.
A note on compliance
No tool or assessment makes a practice compliant on its own, and you should be wary of anyone who says otherwise. What you can do is know where your gaps are, close them in order of risk and keep a record that you're managing it.
Where to start
Our free governance, security and compliance assessment takes about ten minutes. It scores your practice on AI policy, identity, data sharing and the controls cyber insurers ask about, and lists your top five gaps. No system access required.
Take the free governance, security & compliance assessment
For Microsoft 365 practices, our AI Governance, Security & Compliance Program adds a read-only scan, a fix plan and monthly re-checks. See the program.