Understand the boundaries to protect patient privacy.

IT TAKES 10 SECONDS. A confusing lab value, an odd medication combination, a wound that doesn’t look like anything in the textbook, and your phone is in your pocket. Pulling up an AI chatbot on your personal phone for a quick second opinion feels no different than looking something up on Google. But it is different. The gap between “feels harmless” and “reportable HIPAA problem” is exactly where a lot of well-meaning nurses are about to land.

I don’t want to scare you. I want to offer practical advice about the device in your pocket. The one you pay for and use to log into your own accounts that have nothing to do with what your hospital has licensed.

Two devices, two worlds

Picture this: A nurse on her personal phone, typing a patient question into a consumer chatbot. Ten feet away, a colleague pulls up nearly identical information on the hospital’s AI-embedded EHR terminal. Same question, two different legal worlds.

Think of it as inside and outside the boundary of a city. It’s a line HIPAA draws around how patient information can be stored, accessed, and shared. Your hospital’s system sits inside that boundary because the hospital signed a Business Associate Agreement (BAA) with the vendor. This contract legally obligates the vendor to protect patient data the way the hospital itself must, and then some. That’s true whether the tool is built into your EHR directly or is a separate app your hospital has vetted and licensed for clinical use.

BAA’s include reference tools when they’re integrated with patient data rather than used for general lookup only. Inside that boundary, data are encrypted, audited, and logged. When something goes wrong, the institution carries the regulatory weight.

A consumer AI app on your personal phone almost never has that agreement with your employer. Your phone and app weren’t built or vetted for this. The moment you type a patient’s age, diagnosis, or even a “hypothetical” case identifiable to anyone on the unit, that information has left the city limits for a destination with no audit trail that your compliance office can control and no guarantee of retention or deletion.

Why does that matter? Most consumer AI tools are built to learn from what’s typed into them. Your question or prompt is being used for further use by the AI tool. That’s how the product improves. Without a BAA, there’s no wall or city limit stopping a patient detail from becoming part of the data the tool draws on for someone else’s query later, and no way for you or your hospital to pull it back. If a tool is free, general-purpose, and not contracted with your employer, assume it retains what you type.

Nurses have named this exact uncertainty themselves. A 2024 phenomenological study by Rony and colleagues found frontline nurses describing real unease about where AI tools draw their data from and who else can see them once they’re entered.

“Inside the city limits” isn’t a free pass

Here’s the wrinkle: Being on an approved device doesn’t mean every use of it is automatically clean. In 2026, as described by Adler, patients filed suits against several health systems over AI scribe and ambient-documentation tools that recorded clinician–patient conversations for transcription. The central allegation in these still-unresolved cases isn’t about data storage, it’s about consent. Did patients clearly agree to being recorded before it started?

The cases haven’t been decided, and the allegations haven’t been tested in court, but the lesson doesn’t depend on the outcome. A tool your hospital sanctioned, on an approved device, backed by a BAA, still raises separate, important questions: Did the patient agree to it? Does your unit’s process actually document that? If your unit rolls out an ambient-listening tool, consider asking those questions. (See Inside and outside the city limits.)

“But I didn’t use a name”: Why that doesn’t save you

A lot of nurses assume stripping the name out of a question or prompt is enough. It isn’t. HIPAA’s Safe Harbor standard requires removing 18 specific identifiers beyond name, including exact dates, ZIP code, medical record number, device identifiers, and more. Even full removal isn’t a guarantee. Foufi and colleagues, building automated de-identification tools for clinical narratives, found that names, dates, locations, and the free-text notes nurses write carry the densest concentration of identifying detail in a record and that generic text tools routinely miss them without rules built specifically for clinical narrative.

That’s how re-identification works in practice. Not by decoding one hidden name, but by combining a handful of details—like a patient’s age range, a rare medication combination, a specific unit, an unusual complication—and cross-referencing that against something public like a local news story that points back to one real person. Typed into your personal phone, “My 67-year-old post-op patient with this odd arrhythmia and rare combination of meds” may feel anonymized, but it often isn’t. That’s exactly the kind of query the hospital’s licensed tool was built to contain, and your personal phone wasn’t.

Who actually carries the risk

Your hospital’s protections don’t automatically extend to you once you’ve stepped outside its sanctioned system. Institutions negotiate BAAs precisely, so the organization carries the compliance burden for approved tools. Reach for your own phone instead, and you’ve stepped outside that framework.

Federal law treats unauthorized access to patient information as a matter of degree. In 2023, the U.S. Department of Health and Human services fined a Washington hospital $240,000 after investigators found 23 security guards accessing patient records with no job-related reason. The fine landed on the institution, and the guards lost their jobs. Straightforward unauthorized access carries one level of exposure; access obtained by misrepresenting your reason carries more; access used for personal gain carries the most—up to 10 years in federal prison under the harshest tier.

Most personal-device AI use that raises a flag never becomes a case. But “rarely a federal case” isn’t the same as “not a disclosure.” For nursing, state board discipline or termination can follow well before anything reaches that level. As AI systems trained on large personal datasets move deeper into clinical workflows, the exposure isn’t only external hackers. Dailah and colleagues note that internal, casual data handling carries real weight for patients and staff alike.

The same logic extends to liability coverage. Institutional insurance protects the institution first, and many personal policies exclude “non-approved” technology use. It’s worth a call to your own insurer if you carry independent coverage.

Know who to ask

If your organization has received American Nurses Credentialing Center Magnet® or Pathway to Excellence® designation, you likely already have a venue for asking questions about technology use. Shared governance structures typically include an IT or technology committee where nurses can ask whether a tool is sanctioned before it becomes an incident. If you don’t know whether that committee exists on your unit, ask your nurse manager or informaticist.

What pragmatic compliance looks like

None of this means AI has no place at the bedside. Nursing scholars, like Rony and colleagues, increasingly frame AI literacy as part of professional readiness, not an optional add-on. Nurses need working knowledge of how these tools handle data so they can use them safely, rather than avoid them out of fear.

• Know which screen you’re on. If your hospital has licensed a clinical decision–support tool, documentation assistant, or ambient scribe, use it there. Make sure you’re on an approved device.
• Treat your personal phone’s AI app like a personal email account. You wouldn’t email a patient’s labs to your Gmail. A consumer chatbot on your own device is functionally the same disclosure. There’s a reason it’s called personal.
• On your personal phone, keep it general, but better not to ask at all. “What are the mechanisms behind serotonin syndrome” is safe. “My patient on X, Y, and Z presenting with these symptoms” isn’t—even without a name.
• Document like AI isn’t the reason for your clinical decision. If an approved tool informs your care, your documentation should reflect your independent nursing assessment not “AI suggested X, so I did X.” Always document your professional judgement so there’s no discussion about the role of the professional nurse in patient care.

Privacy is one piece of a much bigger conversation about the ethical use of AI in nursing. I’ll devote another column to that topic.

The bottom line

The instinct to reach for AI at the bedside isn’t the problem. The reach is often a good one, creating knowledge and memory for the nurse. The problem is the device. The hospital’s tool carries institutional protection, but even that protection has limits. Bring the same rigor to your personal phone that you already bring to a patient’s chart. If your employer hasn’t sanctioned and protected it, walk the 10 feet to the terminal built for exactly this question.

Roy’s Rule: AI is a tool. Your nursing knowledge is what makes the difference.

Roy L. Simpson is a nurse informatician with 5 decades of experience at the intersection of nursing and technology. He currently serves as professor, co-director, and assistant dean for AI education at the Nell Hodgson Woodruff School of Nursing at Emory University in Atlanta, Georgia.

American Nurse Journal. 2026; 21(10). Doi: 10.51256/ANJ102614

References

Adler S. Lawsuit alleges AI platform illegally recorded patient-clinician conversations. The HIPAA Journal. April 14, 2026. hipaajournal.com/lawsuit-ai-platform-illegally-recorded-patient-clinician-conversations

Dailah HG, Koriri M, Sabei A, Kriry T, Zakri M. Artificial intelligence in nursing: Technological benefits to nurse’s mental health and patient care quality. Healthcare. 2024;12(24):2555. doi:10.3390/healthcare12242555

Foufi V, Gaudet-Blavignac C, Chevrier R, Lovis C. De-identification of medical narrative data. Stud Health Technol Inform. 2017;244:23-7. doi:10.3233/978-1-61499-824-2-23

Rony MKK, Numan SM, Akter K, et al. Nurses’ perspectives on privacy and ethical concerns regarding artificial intelligence adoption in healthcare. Heliyon. 2024;10(17):e36702. doi:10.1016/j.heliyon.2024.e36702

Rony MKK, Parvin MR, Ferdousi S. Advancing nursing practice with artificial intelligence: Enhancing preparedness for the future. Nurs Open. 2023;11(9):e2070. doi:10.1002/nop2.2070

U.S. Department of Health and Human Services. Yakima Valley Memorial Hospital resolution agreement and corrective action plan. 2023. hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/yakima-ra-cap/index.html

Key words: HIPAA, patient privacy, Business Associate Agreement, approved devices