14d • General discussion
HIPAA and your data, in plain words
Before you run anything with client information, read this. It is the most important post in here.
I am a BCBA. I know how it feels to be handed an AI tool and wonder if you just broke HIPAA. So I built this whole thing around one rule. Your client data stays on your computer, and the AI sees as little of it as possible.
I know this post is long, but its important. HIPAA violations are no joke, and the AI companies don't sign BAAs.
Your data stays local.
Everything runs through Claude Code on your own machine. The systems open your files right there, do the math or the writing, and show you the result. Your files are not uploaded to me, to a server, or to anyone else. There is no cloud database of your clients sitting somewhere.
Most systems never touch a client name.
The money and billing systems, like projections, underpayment, auth and cancellation tracking, and scheduling, read your export on your computer and pull out totals and patterns. The report you get back has no client names in it. Just payers, codes, dates, and dollars. When a system needs a specific client or claim number so you can act on it, that goes into a worklist file that stays on your machine, and the AI does not read those rows. A plain script writes them straight to disk.
The one system that reads a real document protects it first.
The denial and appeal writer has to read the actual letter. Before it does anything, it swaps every name, date of birth, member ID, and claim number for a placeholder. It writes the appeal over the placeholders. Then it puts your real values back on your computer and checks the result to make sure nothing slipped through.
Every system tells you its setup before you run it.
You always know what a system does with your data before you hand it a file. No surprises.
About Claude and your inputs.
Whether Anthropic uses what you type depends on your Claude plan and your settings. It is not the same on every tier, so check your plan's data settings. And remember the design already keeps client data out of the AI's hands as much as possible. Most of what you run never puts a client record in front of the model at all.
What is still on you.
Your clinic is the one responsible for HIPAA, not me and not a tool. This gives you a workflow built to keep client data local and de-identified. It does not replace your own policies, your training, or your compliance person. If your setup ever requires a business associate agreement with a vendor, that is between you and that vendor. The whole point of this design is to keep protected information from reaching one in the first place. I am a BCBA, not your lawyer, so treat this as a careful workflow and not legal advice.
Two habits that keep you safe.
First, you are always welcome to strip client names out of a file before you drop it in. The systems still work by claim number, date, and code. Second, before you share or screenshot any report, give it a quick look. The shareable reports are built to be name-free, but a glance is good hygiene. Keep the worklists that do have names on your own machine and do not email them around.
If you are ever unsure whether something is safe to run, ask in the community before you do it. I would rather answer the question than have you guess.
Matt, BCBA
0
0 comments
HIPAA and your data, in plain words
Powered by