Three decisions settle it: which tasks staff may use an AI assistant for, whether the workflow needs a privacy impact assessment (PIA), and who owns the tool. Write all three on one page.
Write the rule
List the tasks staff may use an AI assistant for, and the assistants the clinic has reviewed. If your rule bars patient information in AI tools, decide whether masked copies are allowed, and write that sentence down.
Review each assistant's terms for training, retention and where data is stored. Sending a masked copy to an AI provider is still a disclosure to that provider, so that review stays with the clinic.
Check whether you need a PIA
Your privacy lead confirms the applicable law, approvals and any PIA filing.
Use PHI Mask in Canada for product facts and provincial review guidance.
Name one owner
One person buys the seats, gives each person their activation key, and keeps the invoice. If staff already pay personally, PHI Mask will prorate and refund unused prepaid time on each personal purchase when the clinic takes over the seats.
Where PHI Mask fits
PHI Mask masks names, dates and identifiers in text, PDFs and screenshots before ChatGPT, Claude, Gemini, Copilot and other AI sites receive them. Your file is masked in your browser and never sent to us.
Your privacy lead owns the assessment. The answers they need are in Answers for your privacy officer. To buy, see Buying seats for your clinic.