HIPAA AI Policy Template: What to Block Before Your Clinical Team Uses ChatGPT

Clinical and operations teams at healthcare organisations are using ChatGPT and other AI tools every day — for drafting patient communications, summarising notes, and researching treatments. Without guardrails, protected health information (PHI) ends up in AI training data.

This guide covers the minimum AI usage policy every healthcare organisation should have in place, and how to implement it with Pretzel in under 30 minutes.

The 18 HIPAA PHI Identifiers

HIPAA's Safe Harbour method defines 18 categories of information that must be de-identified before they can be used or shared. All 18 can appear in AI prompts:

1. Names
2. Geographic data (zip codes, addresses)
3. Dates (except year) — birth dates, admission dates, discharge dates
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and licence numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers (fingerprints, voice prints)
17. Full-face photographs
18. Any other unique identifying number or code

Recommended Pretzel Rules for Healthcare Teams

Rule 1: SSN and Medical Record Numbers Pattern rule matching SSN formats (###-##-####). Action: Block.

Rule 2: Date of Birth Patterns Pattern rule covering common date formats adjacent to demographic keywords. Action: Warn with required justification.

Rule 3: Patient Name Blocklist If your EHR exports a patient roster, import patient names as a keyword blocklist scoped to clinical staff. Action: Block.

Rule 4: ICD-10 Code Detection Pattern rule matching ICD-10 code formats in context of clinical keywords. Action: Warn.

Rule 5: Insurance Member IDs Pattern rule matching common payer formats. Action: Block for external AI sites, Allow for internal tools.

One-Click Healthcare Template

Pretzel ships with a pre-configured Healthcare policy starter kit covering all five rule categories above. Activate it from the Console in one click, then adjust the scope to your clinical team division.

Start free at mykka.ai — the Healthcare template is included on all plans.