A lab result arrives as a PDF. The medication list sits in a patient portal. The visit notes are in an app. The obvious move is to open a chatbot, upload the file and ask what it says in plain English.
That move puts a medical record inside a general-purpose AI service. The privacy rules written for medical data do not travel with the file.
TL;DR
- HIPAA protects the copy your provider holds. The rule puts the duty on covered entities and the vendors they contract: “A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter” (45 CFR 164.502(a)).
- A consumer chatbot is not automatically your provider’s business associate. The regulation defines a business associate as a person who, for a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter” (45 CFR 160.103).
- Two other rules reach consumer apps. The FTC’s Health Breach Notification Rule covers vendors of personal health records and PHR-related entities, and it excludes HIPAA-covered entities (16 CFR 318.1), while Washington’s My Health My Data Act requires consent before a company collects or shares “consumer health data” (RCW 19.373.030).
- Consumer tiers still use what you paste. Google’s Gemini documentation states that “Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes”, and Anthropic uses your inputs and outputs for model training unless you opt out.
- Two ways to keep a record out: strip identifiers before you paste, or run the model on your own machine. The redaction guide and the local models for sensitive data guide cover both.
What HIPAA covers, and what it leaves behind
Protected health information is not a special file format. It is “individually identifiable health information” that is transmitted or maintained in any medium, which covers a PDF uploaded to a chat window as readily as an electronic health record (45 CFR 160.103). The rule binds three kinds of organization: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with covered transactions.
The part that matters when you paste a record into a chatbot is the business associate definition. A business associate is a person who, for a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter”, and does it on behalf of that entity. A vendor that takes PHI from a clinic under contract is inside that perimeter. A general-purpose chatbot is not, unless it has signed that role for your provider.
Analysis: this is where the protection is lost, and it is lost quietly. The duties in HIPAA attach to whoever holds the record under a covered arrangement. The copy sitting on the clinic’s server is covered. The copy you typed into a consumer chat box sits with a company that is not a covered entity and has no business associate agreement with your clinic, so none of the Privacy Rule’s duties travel with it. HIPAA does not stop the paste. It simply stops applying.
A business associate contract is not a vague promise. The rule requires the contract to establish the permitted uses of the information, require appropriate safeguards, obligate the vendor to report breaches back to the covered entity, and at termination to “return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form” (45 CFR 164.504(e)(2)).
The rules that do reach consumer apps
Two regimes fill part of the gap, and neither gives you what HIPAA gives.
The FTC’s Health Breach Notification Rule applies to “vendors of personal health records, PHR related entities, and third party service providers”, and it explicitly excludes the covered parties: “This part does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity” (16 CFR 318.1). Its reach is narrower than the headlines suggest. A personal health record under the rule is “an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual”, so a chat log of pasted results is not automatically one. The rule bites hardest on health-tracking apps, where the definition of health care services or supplies covers “any online service such as a website, mobile application, or internet-connected device that provides mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms”.
Washington’s My Health My Data Act is broader. “Consumer health data” means “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status” (RCW 19.373.010). Since March 31, 2024, a regulated entity may not collect it “except: (i) With consent from the consumer for such collection for a specified purpose; or (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested”, and sharing needs consent “that is separate and distinct from the consent obtained to collect consumer health data” (RCW 19.373.030). Information that is protected health information under HIPAA is exempt (RCW 19.373.100), so this is the law that covers the copies you upload yourself. The same chapter also makes it “unlawful for any person to implement a geofence around an entity that provides in-person health care services” (RCW 19.373.080).
Vendors now write consumer health data policies because of this. Anthropic’s, effective January 12, 2026, “applies only where Anthropic acts as a data controller”, which covers using Claude.ai or another product as a consumer for personal use. It lists what it collects, including what you hand over “if you elect to connect a third-party application to Claude.ai that contains your consumer health data”, and “Other information that may be used to infer or derive consumer health data” (Consumer Health Data Privacy Policy).
What the vendors say they do with it
The business and API tiers write different promises than the consumer tiers, and the difference is large.
OpenAI’s platform documentation is blunt about the API: “As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)”. Retention is the catch. Abuse monitoring logs “may contain certain customer content, such as prompts and responses”, are generated for all API feature usage by default, and are “retained for up to 30 days, unless longer retention is required by law”. Customers approved in advance by OpenAI for Zero Data Retention or Modified Abuse Monitoring can have customer content excluded from those logs, and for healthcare customers there is a third path: “For customers who have executed an OpenAI Business Associate and Healthcare Addendum, once your org ID is provisioned with Safety Retention, BAA-eligible endpoints can be used for processing PHI, even if data is retained” (Data controls in the OpenAI platform).
Anthropic’s business terms are a one-line promise: “Anthropic may not train models on Customer Content from Services” (Commercial Terms of Service, effective June 17, 2025). Its consumer policy, effective September 10, 2026, says something different: “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings”, and even after an opt-out, it still uses inputs and outputs for model improvement when “your conversations are flagged for safety review” or when you have explicitly reported the material to Anthropic (Privacy Policy).
Google Cloud’s HIPAA story is the same shape as OpenAI’s. The business associate agreement “for Google Cloud includes the entire Google Cloud infrastructure, not only a subset of Google Cloud”, the covered-products list includes Cloud Healthcare API, and the documentation is candid that “The U.S. Department of Health and Human Services (HHS) doesn’t offer a certification program for HIPAA compliance. Complying with HIPAA is a shared responsibility between you and Google” (HIPAA compliance on Google Cloud). On training, Google states it “won’t use your data to train or fine-tune any AI/ML models without your prior permission or instruction” (data governance documentation). On logging, the Gemini Enterprise Agent Platform documentation records that with Grounding with Google Search, Google “collects and stores logs” containing “queries derived from End User prompts and contextual information” for “up to three (3) days”, and that “There is no way to disable the storage of this information if you use Grounding with Google Search” (data governance documentation).
Consumer Gemini is where the reading gets uncomfortable. The Gemini Apps Privacy Hub lists the purposes Google uses Gemini data for and states that “These uses extend to the generative AI models and other machine-learning technologies powering our services.” It adds that “Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes”, and it tells users not to put confidential information in a chat if they would not want a reviewer to see it or Google to use it to improve its services. It also notes that chats reviewed by human reviewers “are not deleted when you delete your activity. Instead, they are retained for up to three years”. The setting that changes this is Keep Activity: “If Keep Activity is off and you don’t submit feedback, Google also does not use your future chats to improve its AI models” (Gemini Apps Privacy Hub).
How to keep the record out of the chat
Strip the identifiers first. Name, date of birth, medical record number, address, phone, email, clinician name. The redaction guide has the mechanics, including how to keep dates that still matter clinically.
Get the record from the source. You have a right of access to your own protected health information, and the rule requires a covered entity to “act on a request for access no later than 30 days after receipt of the request”, with one extension of no more than 30 days if it tells you why in writing (45 CFR 164.524). A copy you requested and edited is a copy you control.
Use the tier with the contract. When a real record has to be processed, the API and business tiers with a business associate agreement and the retention controls set out above are the documented path.
Run it locally. If the record never leaves the machine, none of this applies. The sensitive personal data guide covers the hardware, and deleting your data afterward covers the clean-up on the cloud side.
Check what is connected. Health app integrations are a separate consent under Washington’s law (RCW 19.373.030), and Anthropic’s policy notes you can “revoke your consent to third-party integrations that may provide Claude.ai access to consumer health data at any time in your Settings”.
What this means
The legal floor for a consumer chatbot is low, and it is low by design of the rule’s scope rather than by accident. HIPAA is a contract-shaped regime: it protects you when a covered entity or a contracted vendor handles your record, and it stops there. Everything you do yourself moves the data outside that regime. The FTC rule and the state consumer health data laws cover parts of what is left, and the largest vendor policies add their own terms on top, which is where the retention numbers come from.
The practical consequence is that the question is not whether a chatbot is compliant with HIPAA, because for a personal account it usually is not the relevant question at all. The question is what the vendor’s own terms say the data will be used for, how long it is kept, and whether anyone reads it. Those answers are published, they differ by product, and they change.
The bottom line
A medical record pasted into a consumer chatbot is no longer covered by the rules you associate with medical data, because you took it out of the hands of the people those rules apply to. What replaces that protection is a set of vendor terms: training opt-outs that have exceptions, abuse monitoring logs with retention periods, human review for some conversations, and retention measured in days for abuse logs and up to years for reviewed chats. Read the terms for the product you actually use before the upload, strip the identifiers either way, and keep the sensitive documents on hardware you control.
For more on what these vendors collect and keep, see our privacy coverage.