AI & Data Privacy

By John Martines · April 5, 2025 · 8 min read

HIPAA, GDPR, and common-sense practices for protecting client data when using AI tools.

The biggest barrier to AI adoption isn't the technology — it's the fear of doing something illegal with sensitive data.

That fear is justified. Using consumer-grade AI tools like free ChatGPT with HIPAA data, financial records, or confidential client information is not just wrong — it's a compliance violation and potential malpractice.

This guide walks you through what data is sensitive, what AI tools are safe for what, and the practices that keep you compliant.

What Data Is Actually Sensitive?

Personally Identifiable Information (PII)

PII is information that can identify an individual. NEVER put this into consumer AI tools without a Business Associate Agreement (BAA):

  • Names, addresses, phone numbers, email addresses
  • Social Security numbers, tax IDs, passport numbers
  • Financial account numbers, credit card numbers
  • Dates of birth, driver's license numbers
  • Customer lists or employee directories

Protected Health Information (PHI)

If you're in healthcare (medical practice, dental, behavioral health, pharmacy), PHI includes:

  • Patient names, MRNs, medical record numbers
  • Diagnoses, treatment plans, medications
  • Lab results, imaging reports, clinical notes
  • Insurance information, billing records
  • Even de-identified data that could be re-identified (rare combination of age, sex, and zip code)

HIPAA compliance is non-negotiable. A single breach can cost $100K–$1M+ in fines, not counting legal costs and reputational damage.

Financial and Legal Data

Sensitive business data that should NOT go into generic AI:

  • Financial statements, tax returns, payroll data
  • Client contracts, confidential agreements
  • Proprietary product designs, trade secrets
  • Litigation information, legal strategies
  • Pricing information, vendor contracts
The Critical Question: Does Your AI Tool Have a BAA?

A Business Associate Agreement is a legal contract that says the AI vendor:

  • Will NOT use your data to train their model
  • Will NOT share your data with third parties
  • Will encrypt your data at rest and in transit
  • Has security measures in place and will notify you of breaches
  • Will delete your data when you ask (or when the contract ends)

Tools With BAAs (Safe for Regulated Data)

  • ChatGPT Enterprise: Yes, BAA available; $55+/user/month
  • Claude (Anthropic): Yes, BAA available for API access
  • Microsoft Copilot Pro: No BAA for free tier; may be available for enterprise
  • Google Gemini: Limited BAA for certain enterprise tiers
  • OpenAI API: Yes, BAA for business customers

Tools WITHOUT BAAs (NOT Safe for Regulated Data)

  • ChatGPT free tier (anything you type can be used to train models)
  • Google's free Gemini
  • Claude free tier (read the usage policy)
  • Most free or cheap AI tools

> If you can't get a BAA, don't use the tool with regulated data. Period. No exceptions.

What AI Vendors Actually Do With Your Data

The Three Models

#### Model 1: "We Train on Your Data"

Some vendors explicitly use your data to improve their models. This is cheap for them, but dangerous for you.

  • Risk: Your confidential information becomes part of the training data (potentially accessible to others)
  • Compliance: Usually not HIPAA-compliant, not GDPR-compliant
  • Example: Early versions of ChatGPT (free tier) used data for training

#### Model 2: "We Don't Train, but We Log"

Your data isn't used for model training, but it's stored and logged (for safety, quality monitoring, abuse prevention).

  • Risk: Logs can be breached. Employees might review your data. Data might be retained indefinitely.
  • Compliance: Risky — data you send is still being stored and processed
  • Example: Some API tools without BAAs

#### Model 3: "Zero Retention, Encrypted"

Your data is processed but not stored. Encryption happens both in transit and can happen locally on your device.

  • Risk: Very low if configured correctly
  • Compliance: Can be HIPAA-compliant, GDPR-compliant, or close
  • Example: ChatGPT Enterprise with BAA, Claude API with data processing agreement, some on-premise models

How to Check

Before signing up for any AI tool with sensitive data, ask:

  • "Is there a Business Associate Agreement available?"
  • "Do you use my data to train your models?"
  • "Do you log or store my requests? For how long?"
  • "Can I request deletion of my data?"
  • "Are you SOC 2 Type II certified?"
  • "What's your data breach response process?"

Get the answers in writing. If the vendor won't answer or acts evasive, don't use them.

A free account opens the rest of this article and the whole library.

All articles