Patient Data and ChatGPT: What Clinic Staff Must Never Paste

Picture a receptionist at a dental clinic doing something that should make your stomach drop. A patient has sent an OPG report on WhatsApp with a long, worried question. She copies the patient's name, the report text and the question into ChatGPT and types, "write a nice reply". The reply is lovely. The habit is dangerous.

She isn't careless. Nobody has ever told her where the line is. In many clinics, staff have started using AI tools on their own phones, and the doctor has no idea what has already been pasted. So let me draw the line clearly.

Why is pasting patient data into ChatGPT a problem?

When you type into a public AI chat tool, that text leaves your clinic. It sits on another company's servers. Depending on the tool, the plan and the settings, it may be kept, reviewed or used to improve the tool. You don't control any of that, and you can't take it back.

Now think about what a clinic holds. Infertility history. A skin condition someone hides from their family. A biopsy result. In IVF and fertility work, the simple fact that a couple visited is private. In my book Rich Doctors Walk Away, the compliance rule is short: get consent before using any patient information, keep records secure, limit who can access them, and follow India's data protection law. Pasting a report into a chat window breaks at least two of those in one click.

Rule: If a stranger reading the text could work out who the patient is, it does not go into a public AI tool.

What exactly must staff never paste?

Here is the list I give clinics. Print it.

The last row surprises people. A dermatology clinic in a small town might see only one patient with a particular rare condition. Remove the name and the number, and the locality plus the condition still points to her.

So what can staff safely use AI for?

Quite a lot, actually. I'm not against AI. I build clinic systems on it. The trick is to give it the work, not the patient.

• Drafting message templates. "Write a warm WhatsApp reminder for a consultation tomorrow at 11, in simple Hindi and English." No patient needed.
• Rewriting a reply. The staff member writes a rough reply with no identifiers, and asks AI to make it clearer and kinder.
• Writing SOPs and checklists. Opening the clinic, handling a reschedule, what to say when someone asks "kitna lagega?"
• Role-play practice. "Pretend you are an anxious parent calling about a child's ear pain. I'm the front desk." Great training, zero risk.
• Explaining general topics in plain words for the team's own understanding, checked by the doctor before anything reaches a patient.

Anything the AI writes that goes to a patient still gets read by a human first. And no medical advice comes out of a chat tool and goes to a patient. Ever.

What about AI built into our CRM or WhatsApp system?

That's a different question, and a fair one. A business tool that you have chosen, with a written agreement, access controls and settings you've checked, is not the same as a staff member's free account on a personal phone. Even then, have your lawyer look at what the agreement says about where data is stored and whether it's used for training. We set clinics up this way through our CRM, WhatsApp and AI work, and the data question always comes before the clever features.

What should the one-page staff policy say?

Keep it to one page, in the language your team actually reads. Here's the version I'd start with:

1. Public AI tools (ChatGPT, Gemini and others) are allowed only for the uses on the approved list: templates, rewriting replies with details removed, SOPs, training and general learning.
2. Never paste names, numbers, addresses, file numbers, reports, prescriptions, photos, screenshots, voice notes, bills or insurance papers.
3. Before pressing enter, ask: "Could someone work out who this is?" If yes, delete it.
4. Use only the clinic's approved AI account for clinic work, never a personal one.
5. Every AI-written message to a patient is read and approved by a staff member before sending. Anything clinical goes to the doctor.
6. AI never gives medical advice, diagnoses or result promises to patients.
7. If you pasted something by mistake, tell the practice manager the same day. No punishment for reporting. We fix it together.
8. This policy is part of your joining and leaving checklist, and you sign it.

Point seven matters most. If people fear punishment, they hide mistakes. If they know they can speak up, you hear about problems while you can still act. Then ask your lawyer what else you need to do once a mistake comes to light.

How do you roll this out without a lecture?

Do it in the Monday team meeting. Fifteen minutes.

Show two examples on screen. One bad: a pasted report with a name. One good: the same question rewritten as "A patient asks whether she can travel two days after the procedure. Help me write a kind reply that says the doctor will advise." Ask the team to spot the difference. Then hand out the policy and get signatures.

Then check. Once a month, the practice manager asks each person, "What did you use AI for this week?" Not to catch anyone out. To keep it normal to talk about. And if you're unsure where your clinic stands legally, confirm with a lawyer who understands health data in India. If you want a second pair of eyes on your whole setup, book a growth call.

The short version

• Never paste anything into a public AI tool that could identify a patient, including photos, screenshots, voice notes and rare details.
• Use AI for templates, cleaned-up rewrites, SOPs and role-play, never for patient-specific clinical replies.
• Business AI tools inside your CRM still need a checked agreement and access controls.
• Put it all on one signed page, and make it safe for staff to report mistakes.
• Confirm your legal duties under India's data protection law with a lawyer.