ChatGPT, HIPAA, and Your Dental Practice: 7 Vendor Questions

Is ChatGPT HIPAA compliant for a dental practice? Not the free or personal version: anything your staff paste into it leaves the practice with no Business Associate Agreement behind it. A business tier can handle patient information only after the vendor signs a BAA for that product and you configure it the way the agreement requires.

That answer matters now because AI is already in the building. Front-desk staff at practices across Memphis, Germantown, and Collierville paste appointment notes into chatbots, and providers are trialing AI scribes that draft the chart note from the exam. Some of you have a scribe you never chose: Henry Schein One launched its new Dentrix Ascend tiers in March 2026 with AI Voice Notes in every one.

The vendors moved faster than the practices. In a 2026 study run by veterinary software vendor Digitail with AAHA, veterinary AI use reached 83.7%, and nearly half of practices had no one who owns AI decisions. This post is not anti-AI. It is the buyer’s side of the conversation: use it, on terms you have checked.

Your Staff Are Already Using AI: Here Is What That Means for HIPAA

HIPAA has no AI chapter, and it does not need one. Any outside company that creates, receives, stores, or transmits protected health information (PHI) for you is a business associate, and you need a signed BAA first. HHS’s guidance on HIPAA and cloud computing is explicit that this holds even when a vendor says it never looks at the data.

An AI scribe that records an exam is a business associate. A chatbot your hygienist uses to rewrite a treatment plan with a patient’s name in it is receiving PHI too, and without a signed BAA that is a disclosure, not a service. Whether either is safe depends on the account tier and the contract behind it.

• Consumer chatbots (free or personal accounts, apps on a staff phone) have no agreement with your practice, and depending on settings, conversations may be used to improve the vendor’s models.
• Business tiers your practice buys can come with admin controls, retention settings, and, from some vendors, a BAA. None of it protects you until you sign the agreement and turn the settings on.

When PHI lands in a consumer tool, HIPAA presumes the disclosure is a reportable breach unless your documented risk assessment shows a low probability the information was compromised.

Privacy is not the only risk. SecurityWeek reported in late September that attackers were publishing malicious Custom GPTs to deliver ClickFix attacks, which trick users into running malware. A tool you have not approved is a tool nobody is watching.

AI Scribe HIPAA Compliance: Seven Questions to Ask Any Vendor

What should a practice ask an AI scribe vendor before signing? Seven things: whether it will sign a BAA for the exact product you are buying, how long it keeps audio and transcripts, whether your data trains its models, where the data is stored and who else processes it, who can see it and whether you get access logs, how you revoke access and delete everything, and how fast it will tell you about a breach. Get every answer in writing.

AI scribe HIPAA compliance comes down to answers you can hold a vendor to. Ask before the free trial.

1. Will you sign a BAA, and which product does it cover?

This is the first gate. A good answer names the specific product and plan you are buying; a BAA for an enterprise plan does nothing for the free app a staff member downloaded. We sign a BAA with every healthcare practice we support, and any vendor that hears your patients’ voices should clear the same bar.

2. How long do you keep the audio, transcripts, and drafts?

AI scribes create three kinds of data: the recording, the transcript, and the draft note. Ask how long each is kept, whether you can shorten that, and whether audio is deleted once the provider signs the note. Retention is negotiable, but only before you sign.

3. Does our data train your models?

Ask whether your recordings, notes, or prompts train the vendor’s AI, whether that is on or off by default, and where the contract says so. If the vendor only uses “de-identified” data, ask who de-identifies it and how.

4. Where is the data stored, and who else processes it?

Many AI scribes run on a model built by a different company. Ask for the list of subcontractors that handle your data and where they store it. HIPAA requires your vendor to hold its own agreements with those subcontractors, so ask the vendor to confirm they exist.

5. Who can see our data, and can we see the access logs?

Some vendors have employees review recordings for quality. Ask who, and whether you can turn it off. Then ask for per-user access logs, unique logins, and multi-factor authentication.

6. How do we revoke access and delete everything when we leave?

You should be able to remove a departed employee’s access the same day, from your own admin screen. At contract end, ask for an export of your notes and written confirmation that everything else was deleted.

7. How fast will you tell us about a breach?

HIPAA’s outer limit for a business associate to notify you is 60 days after it discovers a breach. That is too long when you have your own patients to notify. Ask for a shorter window in the BAA and a named contact who calls you directly.

Consumer ChatGPT vs. Business Tiers vs. Microsoft Copilot: Where PHI Can Go

Most practices have several kinds of AI tools. Here is how they sort out.

Business tiers from OpenAI and other vendors are marketed with stronger data controls than the consumer apps. Whether a given plan comes with a BAA, and whether your data is excluded from training, are questions to answer in writing for the exact plan you buy. Tier names and terms change often.

Microsoft Copilot is several products. The consumer Copilot app, Microsoft 365 Copilot Chat, and Microsoft 365 Copilot have different terms, and your plan and sign-in decide which one staff get. Microsoft offers a HIPAA BAA for in-scope Microsoft 365 services, so confirm the experience your staff use is in scope. Microsoft 365 Copilot also answers from the files each person can already open, which is why our Microsoft Copilot readiness checklist starts with a permissions audit.

If the vendor will not sign a BAA, the tool is not for PHI. No setting, upgrade, or promise on a sales call changes that.

So, Is ChatGPT HIPAA Compliant?

No software is HIPAA compliant on its own. Compliance describes how your practice uses a tool: the agreement, the settings, who has access, and whether you wrote it down. A consumer chatbot fails the first test because there is no agreement. A business tier can pass when every piece is in place.

Dental, Veterinary, and Med Spa: How the Rules Differ

The seven questions are the same in every exam room. What changes is which law stands behind them.

Dental practices: HIPAA applies, and your software may already have AI

A dental practice that bills insurance electronically is a HIPAA covered entity, so everything above applies in full. Two dental-specific points:

• Check what you already have. On Dentrix Ascend, AI Voice Notes comes with every tier launched in March 2026. Ask Henry Schein One the seven questions and confirm your existing agreement covers it.
• Watch the integrations. Open Dental’s open API makes it easy for third-party AI tools to connect to your charts. Every connection is a new vendor with access to PHI, and each needs its own BAA.

The stakes are local: Tennessee ranked second in the nation for people affected by healthcare breaches in the first half of 2026, at 4.6 million, according to HIPAA Journal. Sorting out which tools touch PHI is part of the dental office IT support we provide in Memphis.

Veterinary clinics: AI scribe data privacy outside HIPAA

HIPAA protects human health information, so your patients’ records are not PHI. That does not make veterinary AI scribe data privacy optional, because an exam recording captures client names, phone numbers, and sometimes payment details.

• Tennessee’s breach notification law (Tenn. Code Ann. § 47-18-2107) covers personal information such as a client’s name paired with a card or account number.
• The AVMA’s Principles of Veterinary Medical Ethics expect veterinarians to protect client privacy and keep records confidential.
• Cloud practice management brings AI with it. Clinics moving from server-based Cornerstone or AVImark to IDEXX ezyVet or Covetrus Pulse should vet every AI feature that comes along.

A veterinary AI vendor may not offer a BAA, and animal records do not need one. Ask for a data processing agreement instead, with questions 2 through 7 answered in writing. Our veterinary IT support team in Memphis runs this kind of vendor review, and our guide to HIPAA for Memphis veterinary practices covers when human health information pulls a clinic into HIPAA.

Med spas: it depends on how you operate

A med spa is a HIPAA covered entity when it is a health care provider that conducts standard electronic transactions, such as insurance claims or eligibility checks. Either way, before-and-after photos and treatment notes are your most sensitive data, and AI photo tools and booking chatbots touch both. Run them through the seven questions, and require a BAA whenever you are a covered entity.

Writing the One-Paragraph AI Rule Your Front Desk Will Follow

A ban sounds safer, but it pushes AI onto personal phones, where you cannot see it and no agreement covers it. The realistic goal is AI used only through tools you have checked, and most front desks will follow one clear paragraph. Here is a version you can adapt:

Our AI rule: You may use [approved tool names] for practice work, signed in with your practice account. Never put patient or client names, birthdates, chart notes, X-rays, photos, or insurance details into any other AI tool, including free ChatGPT, Gemini, or AI apps on your personal phone. [Name] owns AI decisions for our practice and approves every new AI tool or feature before anyone uses it with practice data. If you are not sure, leave the details out and ask [Name]. If something slips, tell [Name] the same day. You will not be in trouble for reporting it.

Naming approved tools gives staff a yes, not just a no. Listing the data types removes guesswork. Naming an owner closes the gap the Digitail/AAHA study found in nearly half of practices. The no-blame line matters most, because you can only assess a slip you hear about.

Put every AI tool in your risk analysis

The paragraph covers behavior. Your HIPAA risk analysis covers systems, and every AI tool that touches ePHI belongs in it next to your practice management software and email, as HHS’s guidance on risk analysis expects.

The proposed HIPAA Security Rule overhaul would add a written technology asset inventory, but it is still a proposal, with final action targeted for July 2027 and none of its provisions mandatory yet. Our breakdown of the proposed HIPAA Security Rule changes covers what may change. The rule is stalled. Enforcement is not. If your last risk analysis predates your AI tools, our Memphis HIPAA compliance services include a Security Risk Assessment that lists every one.

Get an AI Readiness Check for Your Memphis Practice

Your team is going to use AI. Decide which tools, on what terms, before a vendor or a curious staff member decides for you.

Not sure which AI tools already touch patient data in your practice? Schedule your free IT assessment and we will inventory the AI tools across your front desk and operatories, run each through the seven questions, and tell you which need a BAA, a settings change, or a hard stop. We help practices adopt AI inside HIPAA, not around it. Prefer to talk first? Call (901) 306-7575 to reach our Memphis team directly.