Orange County medical practices can use AI safely, but only inside HIPAA's rules. The short version: standard consumer ChatGPT must never touch patient information, HIPAA-eligible AI tools require a signed Business Associate Agreement (BAA) before any protected health information (PHI) goes near them, and a BAA alone does not make you compliant. Start with use cases that avoid PHI entirely, then expand carefully with the right agreements and training in place.

The One Rule That Matters Most

Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on your behalf is a Business Associate and must sign a BAA. Without that contract, the vendor is not authorized to handle patient data, full stop.

This is where most practices get into trouble. The standard ChatGPT tiers, Free, Plus, and self-serve Business, are not HIPAA compliant and cannot be covered by a BAA. A staff member pasting a patient's symptoms into a personal ChatGPT account to draft a note is a HIPAA violation, even if it never leaves your office network.

OpenAI does offer HIPAA-eligible paths: the API for healthcare workloads and sales-managed ChatGPT Enterprise, including a dedicated ChatGPT for Healthcare product launched in January 2026, but only after your organization signs a BAA. The consumer tiers remain off-limits for PHI.

Safe Starting Points That Don't Touch PHI

The fastest way to get value without risk is to begin with tasks that involve no patient data at all:

General patient-education content. Drafting plain-language explainers about a procedure or condition, with a clinician reviewing before publication.

Internal administrative writing. Staff memos, vendor emails, policy drafts, job postings, none of which contain PHI.

Answering staff questions. "How do I phrase this non-clinical message?" or "Summarize this public guideline." No patient involved.

These build your team's comfort and habits before any patient data is on the table.

Where PHI Is Involved: Do It Right

Once you want AI helping with scheduling, intake, or clinical documentation, all of which touch PHI, the bar rises:

Sign a BAA with any AI vendor that will handle patient data, and confirm the specific plan is covered (not just the vendor generally).
Confirm no training on your data. Your BAA and the vendor's terms should explicitly bar using PHI to train or improve their models without separate written authorization. That is increasingly treated as a baseline requirement for AI vendor agreements.
Apply minimum-necessary use. Staff should enter only the PHI a task actually requires. This is a policy-and-training matter, not something the tool enforces.
Control access. Role-based access, audit logs, and offboarding when staff leave.

A BAA is necessary but not sufficient. As HHS guidance on cloud computing makes clear, the practice remains responsible for compliance even when a vendor is under a BAA. For the most sensitive workflows, some practices avoid the cloud entirely and run a local, on-device model where data never leaves the building, the approach behind our OpenWriter case study.

A Practical First 90 Days

Weeks 1–2: Inventory what AI your staff already use and write a one-page AI usage policy that bans PHI in consumer tools.
Weeks 3–6: Roll out approved, non-PHI use cases and train the team.
Weeks 7–12: If a PHI use case has clear ROI, evaluate HIPAA-eligible vendors, sign BAAs, and pilot with access controls.

The Bottom Line

AI is genuinely useful for Orange County medical practices in scheduling, documentation, and patient communication, but only when HIPAA comes first. Keep PHI out of consumer tools, require a BAA for anything that touches patient data, layer policy and training on top, and start with low-risk use cases while you build the right foundation.