GuidesSafety and privacy

Is AI safe for my office?

AI tools like ChatGPT and Claude can save your team hours a week, but there are real privacy and security points to understand first. Here are the plain-English rules.

The one rule

If you wouldn't want it on a billboard, don't put it in an AI tool. On a free or personal account, what you type into ChatGPT, Claude or Gemini leaves your building. Treat public AI tools like a public conversation.

What never goes into a public AI tool

Patient names, dates of birth, or any protected health information

Client financial data: account numbers, tax returns, investment details

Employee personal information: SSNs, salary data, performance reviews

Proprietary business information: trade secrets, unreleased products, internal strategy

Passwords, API keys and access credentials of any kind

Legal documents under NDA or attorney-client privilege

Customer payment information: card numbers, bank details

What's safe once you de-identify it

Email templates and FAQ answers. Remove names before pasting.

Meeting summaries. Say "the client", not the name.

Writing and editing. Use generic details, then add specifics yourself.

SOPs, checklists and training material, reviewed before you share them.

Brainstorming and planning. It gives options; you decide.

The de-identification test

Before you paste anything, ask: could someone trace this back to a specific person, client or patient? If yes, replace the details.

"Jane Smith's appointment on March 5" becomes "a patient's upcoming appointment."

"Invoice #4521 for Acme Corp, $12,500" becomes "a mid-size client invoice for a consulting project."

"John in accounting made errors on the Q3 report" becomes "a team member's report needs corrections in Q3 data."

ChatGPT and Claude Team and Enterprise plans both state your data isn't used for training, and Gemini for Workspace has enterprise data protections. They're better for sensitive work, but your team still needs written rules.

When in doubt, de-identify first. If you can't de-identify it, don't use AI for it.

Full guide: https://www.stephenthorn.com/free-resources/ai-office-safety-guide/