Healthcare AI acceptable use policy template
An AI acceptable use policy tells staff which AI tools they may use, what patient data can go in, and who checks the output. Our full, editable template has 11 sections and a staff acknowledgment. It ties PHI to tools covered by a business associate agreement and requires human review of AI output.
What the template covers:
Purpose
Scope: every workforce member and every AI tool, free or paid
Approved tools, by plan and whether PHI is allowed
Prohibited uses
Rules for protected health information: minimum necessary, de-identification, uploads
Human review of AI output
Patient-facing AI disclosure
Incident reporting
Training
Enforcement
Review cadence, plus a signed staff acknowledgment
Primary link (button):
"Get the full template" → `/resources/blog/healthcare-ai-acceptable-use-policy`
Supporting line under the button: The blog post is the canonical, maintained version of this policy, with notes on the hardest sections.
Related: AI vendor BAA checklist for approving the tools you list in Section 3. Shadow AI in healthcare if staff already use unapproved tools.
Compliance notes
- PHI only in tools with a BAA. A vendor that "creates, receives, maintains, or transmits PHI" for you is a business associate (45 CFR 160.103) and needs a contract with the 164.504(e) elements.
- BAA coverage is plan-specific. OpenAI says ChatGPT Free, Plus, Pro and Business are not eligible for its BAA. Anthropic says Claude Free, Pro, Max and Team plans can't enable HIPAA. Name exact plans in Section 3.
- Minimum necessary applies to prompts and uploads. (45 CFR 164.502(b)). De-identified means Safe Harbor or Expert Determination (164.514(b)).
- Patient-facing AI needs disclosure. in California (AB 3030), Utah (SB 149, SB 226) and Texas (Bus. & Com. Code 552.051(f)).
Rivvi is a HIPAA-compliant AI workspace you can list in Section 3, with a BAA on the free plan for you and two colleagues. No card. No clock. Get started for free.
These templates are a starting point, not legal advice. Review them with your compliance lead or counsel before use.