How can healthcare workers use AI for paperwork safely?

Much of a healthcare worker's day goes to writing that is not care itself: appointment letters, staff schedules, policy updates, form instructions, minutes of team meetings. These are exactly the kinds of tasks where a chatbot such as ChatGPT can save time. The risk is not the writing. The risk is what gets pasted into the chat box, because health information is among the most protected personal data there is.

This guide covers paperwork and administration only. It is not medical advice, and AI output should never decide anything about a patient's care. Always follow your employer's policies first; many organizations have rules about which AI tools staff may use, and those rules come before any general advice.

What AI is good for in the office

Safe tasks share one feature: they need no real patient details to do well.

When a task seems to need a patient's details, the safer approach is to have the AI produce a template with placeholders, then fill in the real information yourself inside your organization's approved system.

Where the data goes matters

A hosted chatbot runs on its maker's servers, not on your computer. When you paste text in, it leaves your organization. What happens next depends on the product and plan. OpenAI, for example, says it does not train its models on data from its ChatGPT Team and Enterprise business plans, while individual Plus subscribers can opt out of training in their data controls settings. A personal account that your employer has never reviewed is a different situation from a tool your organization has approved under a contract.

Privacy laws set the outer limits. In the United States, the HIPAA Privacy Rule governs health information held by covered organizations. In Canada, provinces have their own health privacy laws, such as Ontario's PHIPA. In Québec, Law 25 has been tightening the rules for businesses in stages since 2022. Québec's privacy regulator, the Commission d'accès à l'information, notes for example that since September 22, 2023 a privacy impact assessment is required in cases the law sets out, including before personal information is sent outside Québec, and that products offered to the public must be set to their most private settings by default. The commission itself suggests asking a privacy lawyer about specific situations, and so should you.

A worked example: a de-identified summary

A clinic coordinator has a long internal email thread about rearranging a patient's follow-up appointments, transport and forms. She wants a short summary for the colleague taking over. Here is a safe way to do it.

1. Copy only what the summary needs. Leave out anything clinical; the summary is about logistics.
2. Replace every identifier with a placeholder. The name becomes [PATIENT], dates become [DATE 1] and [DATE 2], the address becomes [HOME], the file number disappears entirely.
3. Read it once more. Look for indirect clues: a rare job title, a small town, a family member's name.
4. Send the cleaned text with a clear request:

Below is a de-identified email thread about appointment logistics. Summarize it for a colleague who is taking over the file.
Use at most six bullet points: what has been booked, what is still pending, who is responsible for each pending item, and any deadline.
Keep the placeholders such as [PATIENT] and [DATE 1] exactly as written. Do not guess at missing details.

[paste the cleaned thread]

1. Put the details back yourself, in your organization's own system, and check the summary against the original thread before you send it.

What patient information must stay out?

The clearest checklist comes from the US government's guidance on the HIPAA "Safe Harbor" method for de-identifying health information. It lists 18 types of identifiers to remove, and they apply to the patient and also to relatives, employers and household members. In summary, with Canadian equivalents added:

• names, and any address detail smaller than a state or province (street, city, postal code)
• every part of a date except the year (birth, admission, discharge, death), and exact ages over 89
• phone and fax numbers, email addresses, web addresses and IP addresses
• social insurance or Social Security numbers, medical record numbers, health plan numbers and account numbers
• licence and certificate numbers, vehicle and device identifiers and serial numbers
• fingerprints, voice prints and full-face photos
• any other number, characteristic or code that is unique to the person

Two points are easy to miss. The guidance says identifiers must come out of free-text notes as well as form fields, and it gives the example of a note mentioning a patient's very specific job title. It also says removing the list is not enough if you know the rest could still point to the person. In a small community, "the only pharmacist in the village" identifies someone as surely as a name.

Outside the United States the legal tests differ, but the list is a sound practical floor. If you are unsure whether something identifies a patient, leave it out, and ask your privacy officer.