Multi-site healthcare practice · ~60 staff
Patient data was being entered into a public AI tool.
Front-desk staff across three sites were using an unapproved AI tool to draft patient letters. The practice administrator suspected it, could not prove it, and had no rule to point to. Reporting came from practice-management exports no one checked against each other.
Representative profile. Counts are illustrative.
The work
What we did, and why
Healthcare made the policy urgent. The practice administrator knew staff were drafting patient letters in an unapproved AI tool and had nothing to point to when asked to stop it. The AI Use Policy gave the practice one hard rule: no patient-identifiable data outside the practice's own Microsoft account. It also named an owner for the exceptions that clinical work always produces.
The AI security and governance assessment found more than the unapproved tool. A clinical lead had bought a transcription tool on a company card, and it was good. Rather than ban it, the assessment checked what the tool could reach, and the policy kept it. Logging and a data-retention setting the vendor had not switched on by default came with it.
The dashboard side was ordinary and valuable. Practice management, scheduling, and billing were connected in the practice's own Microsoft cloud account. One matched-up view of visits, billing, and no-shows replaced three exports the administrator used to merge by hand. The AI security subscription enforces the patient-data rule across the account, and the monthly report shows blocks and approvals by site.
Where they stand
The outcome
Patient letters are drafted in an approved tool inside the practice's own account. The monthly AI report shows blocks and approvals by site. Reporting on visits, billing, and no-shows comes from one dashboard.
For leadership
What changed
The administrator can answer the compliance question with a document and a report instead of a hope. The clinical lead kept the tool she liked, under a rule.
This is a representative profile, drawn from the kinds of companies we work with. Figures are illustrative. We publish named results only with a client's written permission.
More profiles
Your turn next
The same method, applied to your systems.
Every engagement on this site started with a written assessment of what the company already ran. Yours starts the same way, and the assessment is yours to keep either way.