What can a practice use AI for without patient information? AI Guide for Doctors' Offices, Dental Offices and Med Spas
By Capital Growth Studio · Published · 5 min read
This article shows doctors' offices, dental offices and med spas how to use AI for marketing and office work without patient information.
HIPAA is a federal law that protects patient health information. A business associate agreement (BAA) is a contract that HIPAA requires. A practice signs it with each vendor that handles patient information for the practice. So HIPAA is the law, and a BAA is one contract under that law.
As of October 2026, the free and personal plans of ChatGPT, Claude, Gemini and Copilot do not come with a BAA. HIPAA lets a practice give patient information to such a vendor only under a BAA. So these plans are not safe for patient information.
Laws change, so check the current rules before you act (links at the end of this article).
Want help with AI in your practice? Apply for a free consultation
What counts as patient information?
Patient information is health information that is linked to a person. HIPAA calls it protected health information (PHI). HHS lists 18 types of identifiers that link health information to a person. Common examples in a practice are:
- names, addresses, phone numbers and email addresses
- dates of birth, visits and treatments
- full-face photos, such as many before-and-after photos
- x-rays and scans, which often show the patient's name and dates
- medical record and health plan numbers
Notes, messages and forms about a patient are patient information too. So removing the name is not enough.
What can a practice use AI for without patient information?
AI can help with tasks that use only public facts, for example:
- service pages, for example about cleanings, implants or injectables
- answers for a website FAQ
- first drafts of provider bios
- Google Business Profile posts about services, hours and events
- text for Google Ads
- job posts, staff checklists and office policies
- translations of public pages
A person checks every draft before it goes live, because AI can state wrong facts. If you build your own website, our guide to building your own website or hiring a designer covers builders such as Squarespace and Wix.
What needs extra care in dental and med spa marketing?
Dental offices and med spas use AI for the same tasks. Three points need care:
- Before-and-after photos. Smile makeovers and skin treatments often use them. Do not upload patient photos to a general AI tool, because a full-face photo is one of the 18 identifiers.
- Ads for injectables (med spas). Google treats Botox as a prescription drug term and limits how ads can use it. Our guide to advertising Botox explains the limits.
- Offers. AI can draft the text of a new-patient offer. A person checks each price, date and term before it posts.
How do you keep patient details out of AI tools?
- Write a one-page AI policy. It lists the tools that staff can use and the information that never goes in. Our AI policy guide shows what to include.
- Use made-up examples in prompts, not real patient cases.
- Keep patient messages in your patient portal or practice software.
- Keep website forms short. Link to your patient portal for intake forms and health questions.
Our guide to Google Analytics on medical websites covers website tracking.
Where can you check the current rules?
Laws and regulations change, and amendments, court decisions or agency guidance can change how a rule applies. We checked the sources in this article on October 20, 2026. Before you act, read the current official text for each place where you work:
- Federal: HHS Office for Civil Rights, Business Associates guidance
- Maryland: Md. Code, Health-General § 4-302 (confidentiality of medical records)
- Virginia: Va. Code § 32.1-127.1:03 (health records privacy)
- District of Columbia: D.C. Code § 3-1205.14 (discipline of health professionals, including for willful breach of patient confidentiality) and D.C. Code § 28-3851 (definitions for the data breach notification law; personal information includes medical information)
If your business works in any other state, we strongly recommend that you check that state's current law and its latest amendments, because they may change how these rules apply to you.
Capital Growth Studio is not a law firm. This article is general information, not legal advice. For advice on your situation, speak with a licensed attorney.
Frequently asked questions
Is ChatGPT HIPAA compliant?
As of October 2026, ChatGPT Free, Plus, Pro and Business do not come with a BAA. So they are not for patient information. OpenAI offers a BAA only for some healthcare and enterprise products. Your compliance advisor decides if your practice needs one.
Can staff use the free ChatGPT for office tasks?
Yes, for tasks with no patient information, such as job posts, checklists and website text.
Can we use AI to make graphics for our posts?
Yes, if the prompt and the uploads contain no patient information. A full-face photo of a client is one of the 18 HIPAA identifiers, so it does not go into a general AI tool.
