What Are We Exposed To, and What Is Our Policy? The One Page Every Practice Owner Should Write
Your staff are already using AI, so the policy question is not whether to allow it. It is whether the rules exist in writing or in each person's private judgement. Exposure comes in three shapes, and in a clinic the one most policies address is not the one most likely to reach a patient.
What this settles
What your staff are permitted to do with AI, written down in one page, before an incident or a privacy complaint writes it for you.
In this article
There is a version of this question that sounds like compliance, and it is the wrong one. You are not deciding whether your staff may use AI. That was decided months ago, quietly, by people finishing notes after hours. You are deciding whether the rules they follow exist in writing or in each person’s private judgement about what seems reasonable.
Written or not, you have a policy. The only question is whether you wrote it.
Exposure is three shapes, not one
Almost every AI policy on the internet is a security document, because security teams wrote the templates. That framing captures one of the three ways a practice actually gets hurt, and it is not the one that shows up most often on a Tuesday.
Data leaves the clinic. Someone pastes a patient history, a referral letter, or a half-finished note into a tool nobody vetted and nobody logged. This is the one the templates address, it is real, and under PHIPA the obligation for it sits with the practice rather than the tool.
It speaks in your name. A drafted reply goes out saying a service is covered when it is not, giving instructions that contradict the chart, or promising a callback nobody can make. Nothing leaked. A patient was simply told something untrue by your practice, and the correction is a clinical and relationship conversation rather than a technical one.
Nobody can vouch for it. Work gets produced that no person can explain or stand behind, and its origin only becomes interesting later, during an audit, a dispute, or a handover when the person who generated it has left.
A policy that covers only the first shape reads as thorough and leaves the two that touch patients wide open. That is the specific failure worth avoiding, and it is why this belongs in the same conversation as what you should refuse to automate rather than in an IT folder.
What people actually do with a policy
The forty-page version is not safer than the one-page version. It is less safe, because nobody reads it, and an unread rule protects nothing. The test of a policy is whether a receptionist at 4:50pm can remember it without looking it up.
What has to be on the page
One page, in plain language
Short enough to remember under deadline pressure
A rule people follow without asking
The fourth item is the one that changes behaviour most and appears least. If the person who sends the email is accountable for it regardless of what drafted it, the incentive to check arrives automatically, and you do not need a rule for every tool that has not been invented yet.
What are you exposed to today?
Scorecard
What is your actual exposure right now?
Check every one that is true of your practice this week.
0 of 6 checked
Ask before you legislate
The instinct after seeing that list is to send a policy. Do the survey first: ask three people which tools they used this week and what they put into them, framed as a survey and not an investigation. What comes back is your real current policy, and it is almost always both more widespread and more reasonable than practice owners expect.
That conversation is also the only reliable way to find the AI your team already adopted without telling you. A policy written without it regulates an imaginary clinic, and the gap between the written rules and the actual behaviour is where every unpleasant surprise lives.
An unread rule protects nothing. The measure of a policy is whether someone under deadline can remember it.
What to do this week
Write the page. Four headings, five sentences, plain language, a date, and your name on it. Then send it with the reasoning attached, because a rule people understand is a rule that survives contact with a busy Tuesday, and a rule handed down without explanation gets quietly optimised around. Revisit it when the tools change, which will be sooner than feels reasonable.
Not sure what your practice is already exposed to? Book a free consult and we will walk the three shapes with you and draft the one page against how your clinic actually runs. See more on PHIPA and Guardrails.
The decision brief
One page for the person you are going to forward this to.
- The decision
- What your staff are permitted to do with AI, written down in one page, before an incident or a privacy complaint writes it for you.
- What getting it wrong costs
- The rules get set by whoever is least cautious, one paste at a time. Two failures reach you: an unlogged disclosure of personal health information that you cannot reconstruct, and a confident wrong answer sent to a patient in the practice's name. The first is a privacy obligation you already hold. The second arrives as a relationship problem rather than an IT one.
- What you can do this week
- Ask three staff what AI tools they used this week and what they put into them. Do not make it a disciplinary conversation, make it a survey. Whatever comes back is your actual current policy, and it is the honest starting point for the written one.
- What to tell your team
- Use these tools, nothing identifying a patient ever goes into anything not on the list, and anything a patient will read gets checked by a person first. You are still accountable for what you send, whoever drafted it.
Frequently asked questions
Does a small clinic really need a written AI policy?
It already has one. If nothing is written down, the working policy is whatever each person decides is reasonable, and that standard varies enormously between a cautious biller and a clinician finishing notes at nine at night. Writing it down does not add bureaucracy, it replaces a dozen private policies with one shared one. For a practice this is a single page, not a compliance programme, and it is the document a privacy commissioner would ask to see first.
What should a clinic AI policy actually say?
Four things, in plain language: which tools are approved, that nothing identifying a patient goes into anything else, that anything a patient will read or anything reaching a chart gets human review before it is sent, and that the person sending remains accountable regardless of what drafted it. A fifth line asking staff to report what is working keeps the list current, because the tools change faster than the policy does.
How do we stop staff pasting patient information into AI tools?
Give them somewhere better to paste it. Prohibition alone fails because the underlying pressure is real: a clinician has twelve notes outstanding and the tool genuinely helps. Practices that approve a specific tool with Canadian residency, say plainly what it may and may not receive, and explain the reasoning get far better compliance than practices that ban everything and quietly rely on people ignoring the ban.
What is the biggest AI risk for a clinic?
It is genuinely two, and most policies address only one. The privacy exposure is real and you already hold the obligation for it. But the likelier day-to-day failure is a confident wrong answer reaching a patient in the practice's name: a result misread, an instruction that contradicts the chart, a date nobody can hit. It arrives as a clinical and relationship problem rather than a security incident, which is exactly why a security-shaped policy misses it.
Before You Spend
All 10 decisionsThe decisions an owner or CEO makes before the first dollar of AI budget leaves the building. One decision per article, each ending in a page you can put in front of your leadership team.
Found this useful?
Share this with your network on LinkedIn, it helps more than you think.
Enjoyed this read? Get the next one in your inbox.
When there is something worth your time, you will be first to know. No spam, unsubscribe anytime.
Keep reading
What Should We Refuse to Sign? Five AI Contract Terms Decided Once, at Signature
Data ownership, training rights, exit, price, and liability are settled the day you sign and renegotiated almost never. In a clinic one of them is not just commercial, it is a privacy obligation you already hold. Here is what each clause decides, what the standard wording quietly grants, and the version worth asking for instead.
Read article
Agent Washing: How to Tell a Real AI Agent From an Automation With a New Sticker
Every clinic product renamed itself an agent this year, and the word stopped carrying information. A five-scenario quiz trains your eye, and five questions expose what a vendor actually built, because the label decides the price you pay, the way it fails, and the oversight your practice owes it.
Read article
Shadow AI in a Clinic: The Adoption Decision Your Staff Already Made For You
Your staff already made the call on AI. Not you, not a partners' meeting, one paste into a personal chat window at a time. In a clinic each of those pastes is an unlogged disclosure of personal health information. A short exposure check shows where you stand, and the fix is smaller than a policy document.
Read articleHave software that should be smarter?
Let’s map a free AI-transformation roadmap for your product.