Healthcare systems face privacy risks as clinicians adopt AI tools

Health systems are navigating complex privacy and security challenges as clinicians increasingly use artificial intelligence tools with patient data. OpenAI has announced an integration with Epic, a major electronic health record system, allowing authorized clinicians to bring patient information into ChatGPT for Healthcare to summarize histories and flag changes. While the integration is read-only and limited to organizations with business associate agreements (BAAs), UCSF Health is currently serving as a pilot partner.

In contrast, the use of individual-level tools like OpenEvidence has created friction between clinical staff and institutional security. While some systems like Penn Medicine have moved toward enterprise-wide deployment, others, such as MaineHealth, have issued notices instructing staff not to enter protected health information (PHI) because the institution lacks a formal BAA with the vendor. This highlights a growing tension for Chief Information Officers who must balance the clinical demand for AI efficiency with the legal necessity of institutional data protection.