HIPAA AI Policy Template: What to Block Before Your Clinical Team Uses ChatGPT

Clinical and operations teams at healthcare organisations are using ChatGPT and other AI tools every day — for drafting patient communications, summarising notes, and researching treatments. Without guardrails, protected health information (PHI) ends up in AI training data.

This guide covers the minimum AI usage policy every healthcare organisation should have in place, and how to implement it with Pretzel in under 30 minutes.

The 18 HIPAA PHI Identifiers

HIPAA's Safe Harbour method defines 18 categories of information that must be de-identified before they can be used or shared. All 18 can appear in AI prompts:

1. Names
2. Geographic data (zip codes, addresses)
3. Dates (except year) — birth dates, admission dates, discharge dates
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and licence numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers (fingerprints, voice prints)
17. Full-face photographs
18. Any other unique identifying number or code

Recommended Pretzel Rules for Healthcare Teams

Rule 1: SSN and Medical Record Numbers Pattern rule matching SSN formats (###-##-####). Action: Block.

Rule 2: Date of Birth Patterns Pattern rule covering common date formats adjacent to demographic keywords. Action: Warn with required justification.

Rule 3: Patient Name Blocklist If your EHR exports a patient roster, import patient names as a keyword blocklist scoped to clinical staff. Action: Block.

Rule 4: ICD-10 Code Detection Pattern rule matching ICD-10 code formats in context of clinical keywords. Action: Warn.

Rule 5: Insurance Member IDs Pattern rule matching common payer formats. Action: Block for external AI sites, Allow for internal tools.

What the Healthcare Starter Template Actually Covers

Pretzel's Healthcare starter template ships with Rule 1 (SSN detection) and a keyword set covering patient name, date of birth, medical record, diagnosis, and health plan beneficiary language — activate it from the Console in one click, then scope it to your clinical team division.

Rules 2, 4, and 5 above (date-of-birth pattern matching, ICD-10 code detection, insurance member ID formats) aren't pre-built. Add them as custom pattern rules yourself, or describe what you need to the Pretzel Console AI assistant — it proposes ready-to-approve rules for you to review.

Start free at mykka.ai.