Dental employees can use ChatGPT and other AI tools for appropriate business tasks, but practices should establish clear rules before employees enter patient, confidential, or sensitive information into an AI system.
AI can potentially help with administrative tasks, writing, brainstorming, training materials, and workflow improvement. But unmanaged use can introduce privacy, cybersecurity, accuracy, and compliance risks.
A practical dental AI policy should address four areas:
Approved Tools + Approved Data + Human Review + Access & Security
1. Decide Which AI Tools Are Approved
Employees shouldn't have to guess which AI platforms they can use.
Create an approved list based on factors such as:
- Security
- Privacy
- Data handling
- Account controls
- Business requirements
- Vendor agreements
New AI tools should go through a basic review before employees use them for practice-related work.
This becomes increasingly important as AI features are added to software employees already use.
2. Define What Information Employees Can Enter
This should be one of the clearest sections of your AI policy.
Employees should not assume they can enter information into an AI tool simply because the website or application is easily accessible.
Establish rules for information such as:
- Patient information
- Clinical information
- Employee information
- Passwords
- Financial information
- Confidential business information
If protected health information may be involved, the practice should evaluate the relevant HIPAA, privacy, security, contractual, and vendor requirements before approving that use.
A useful employee rule is:
If you're unsure whether information is appropriate to enter into an AI tool, don't enter it until you ask.
3. Require Human Review of AI Output
AI can produce incorrect, incomplete, or misleading information.
Employees should not assume an answer is accurate simply because it sounds confident.
Human review is especially important when AI-generated material affects:
- Patient communication
- Business decisions
- Policies and procedures
- Documentation
- Financial information
- Clinical workflows
The person using AI remains responsible for determining whether the output is appropriate for its intended use.
AI should assist employees—not eliminate judgment.
4. Protect AI Accounts Like Other Business Systems
If your practice approves an AI platform, apply normal cybersecurity practices.
Where appropriate:
- Use individual accounts
- Enable MFA
- Avoid shared passwords
- Limit administrative access
- Remove accounts when employees leave
- Review connected applications
- Monitor important integrations
AI tools should not become an unmanaged technology environment outside your normal security processes.
What Can Dental Employees Use AI For?
Depending on the tool and your practice's policies, potential lower-risk uses could include:
- Brainstorming marketing ideas
- Drafting general office communications
- Creating training outlines
- Summarizing non-sensitive information
- Developing checklists
- Improving general business writing
Tasks involving patient information or other sensitive data require additional scrutiny.
The important distinction isn't simply:
“Do we allow AI?”
It's:
“Which AI tools do we allow, for which tasks, using what information?”
A Simple 5-Rule Dental AI Policy
A basic policy can begin with five rules:
- Use only approved AI tools for practice business.
- Do not enter patient or sensitive information unless that specific use has been approved.
- Verify AI-generated information before using it.
- Protect AI accounts with appropriate security controls.
- Ask before connecting an AI tool to another practice system.
The policy can become more detailed as your practice's use of AI grows.
Why Dental Practices Choose IT Services of Utah
IT Services of Utah has been helping businesses for more than 30 years and supports dental practices throughout St. George and Washington County, Utah.
We can help practices evaluate the technology and security surrounding AI adoption, including:
- Account security
- Microsoft 365
- Data protection
- Cybersecurity
- Access controls
- Vendor integrations
- HIPAA-focused IT considerations
Our goal is to help dental practices adopt useful technology without creating unnecessary security or operational risk.
Frequently Asked Questions
Should we completely ban ChatGPT at our dental practice?
Not necessarily. A defined policy may be more practical than ignoring AI use or assuming employees aren't using these tools. The appropriate approach depends on the practice's risks, workflows, approved platforms, and data requirements.
Can employees enter patient information into an AI tool?
Employees should not assume they can. Before protected health information is entered into an AI system, the practice should evaluate that specific tool and use case for applicable privacy, security, contractual, and HIPAA considerations.
Do we need a written AI policy?
As AI use grows, a written policy can clarify approved tools, prohibited information, security requirements, human-review expectations, and how employees request approval for new AI applications.
Does Your Dental Practice Have an AI Policy?
AI adoption is moving faster than many workplace policies.
Start with four questions:
Which tools are approved? What data is allowed? Who verifies the output? How are the accounts secured?
For dental practices in St. George and Washington County, Utah, IT Services of Utah can help evaluate the technology, cybersecurity, and data-protection considerations surrounding workplace AI.
Schedule a Dental AI Readiness Assessment with IT Services of Utah to identify AI-related technology and security gaps before unmanaged AI becomes another source of risk.
