Multi-site healthcare practice · ~60 staff
Patient data was being entered into a public AI tool.
Front-desk staff across three sites were using an unapproved AI tool to draft patient letters. The practice administrator suspected it but could not prove it, and had no rule to point to. Reporting came from practice-management exports that no one checked against each other.
Representative profile. Counts are illustrative.
The work
What we did, and why
The practice administrator knew staff were drafting patient letters in an unapproved AI tool, but had no written rule to point to when asking them to stop. The AI Use Policy gave the practice one firm rule: no patient-identifiable data outside its own Microsoft account. It also named an owner for the exceptions that clinical work always produces.
The AI security and governance assessment found more than the letter-writing tool. A clinical lead had bought a transcription tool on a company card, and it worked well. Instead of banning it, we checked what it could reach, and the policy allowed it to stay. The vendor's logging and data-retention settings, which were off by default, were switched on as a condition.
The reporting work was routine but useful. Practice management, scheduling, and billing were connected in the practice's own Microsoft cloud account. One combined view of visits, billing, and no-shows replaced three exports the administrator had been merging by hand. The AI security subscription enforces the patient-data rule across the account, and the monthly report shows blocked and approved activity by site.
The result
Where the company stands now
Patient letters are now drafted in an approved tool inside the practice's own account. The monthly AI report shows blocked and approved activity by site, and reporting on visits, billing, and no-shows comes from one dashboard.
For leadership
What changed for the people running it
When asked about compliance, the administrator can now point to a written policy and a monthly report. The clinical lead kept the transcription tool she preferred, under a written rule.
This is a representative profile, drawn from the kinds of companies we work with. Figures are illustrative. We publish named results only with a client's written permission.
More profiles
How was the unapproved AI tool confirmed at all three sites?
The assessment confirmed the letter-drafting tool at all three sites. It also found a transcription tool the clinical lead had bought on a company card.
Why did the transcription tool stay?
It passed an access review, and the clinical lead kept it under the written rule. Patient letters moved to an approved tool inside the practice's own account.
What does the monthly AI report show by site?
It shows blocked and approved activity by site. Visits, billing, and no-shows are reported from one dashboard.
Next step
Your company would start with a written assessment.
Every engagement on this site began by writing down what the company already ran. You keep the assessment whether or not you hire us for the work that follows.