AI for Nurses: HIPAA, Patient Privacy and What Never to Paste Into an AI Tool

The most important rule for nurses using AI is also the shortest: do not put patient information into an AI tool unless your employer has approved that exact tool for that exact use. This page explains why and gives you a checklist. It is part of the AI for Nurses hub and is general information, not legal advice. For your facility's rules, ask your privacy or compliance officer.

Caution: AI chatbots are not clinical decision support. Do not use them for diagnosis, dosing, triage or care decisions. If you think a patient detail has already been pasted into an AI tool, tell your supervisor or privacy officer promptly, following your facility's incident process.

What counts as patient information

Under the HIPAA Privacy Rule, protected health information (PHI) is individually identifiable health information held by covered entities (such as most hospitals and clinics) and their business associates. HHS explains that health information counts as de-identified only if it meets a legal standard: either an expert determination, or the "Safe Harbor" method of removing 18 types of identifiers, including names, geographic detail smaller than a state, all elements of dates (except year) related to the person, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, account numbers, device identifiers, full-face photographs and any other unique identifying code, with no actual knowledge that what is left could identify someone (see the HHS de-identification guidance and the rule text at 45 CFR 164.514). HHS also notes that even partial identifiers, such as patient initials, do not meet Safe Harbor.

The practical lesson: "I took the name out" is usually not enough. A rare diagnosis, a unit, a date and an age can identify a person. Do not rely on your own quick edit to de-identify a patient story for a general chatbot.

Why a general chatbot is the wrong place

• Your employer likely has no agreement with a consumer chatbot provider covering patient data, and HIPAA generally requires one when a vendor handles PHI on your employer's behalf.
• You may not know where the text is stored, who can review it, or whether it can be used to improve the product. Settings and policies differ by tool and change often.
• Employer policy may be stricter than the law, and breaking it can affect your job and license.

What is generally safe, and what is not

• Generally lower risk: blank templates, study notes, generic education text from public sources, non-clinical emails, public articles.
• Off limits in a general tool: anything from a chart, report sheets, photos of patients or screens, dictation of a patient encounter, family messages about a patient, discharge instructions for a real patient, de-identified-by-you case stories.

If your employer offers an approved AI tool

Some health systems provide AI tools under contract, with their own rules. Use only what your employer approves, only for the uses it approves, and follow the training you were given. "Approved for documentation" does not mean "approved for everything".

A quick pre-send checklist

• Is anything here about a real patient, or could a coworker guess who it is?
• Is this tool approved by my employer for this use?
• Am I asking for a clinical decision? If yes, stop and use clinical resources and the care team.
• Would I be comfortable if my privacy officer read this prompt?

Related: is it safe to share personal info with AI chatbots?, AI for nursing work emails and handoff templates.

Want more ready-made prompts for this kind of work? Get the free AI prompt pack for nurses (PDF).

Frequently asked questions

Is it okay to paste a patient story if I remove the name?

Not in a general chatbot. Removing the name rarely meets the HIPAA de-identification standard, and combinations of details can identify someone. Use fictional examples or ask your privacy officer.

Does HIPAA apply to nursing students?

Schools and clinical sites usually apply privacy rules to students during clinical placements. Follow your program and site policies and never put clinical-site information into a general AI tool.

Can AI read my handwritten notes or take a photo of a chart?

Not with a general tool. Photos of charts, screens or patients contain PHI.

What should I do if I pasted patient information by mistake?

Tell your supervisor or privacy officer promptly and follow your facility's incident process. Do not try to hide it.

Is there an AI tool that is HIPAA compliant?

Compliance depends on the vendor's agreement with the covered entity and how the tool is configured and used, not on a label. Only your employer can approve a tool for patient information.