Is ChatGPT HIPAA Compliant? Quiz

Answers and explanations appear as you take the quiz.

1. Why are consumer ChatGPT plans such as Free or Plus unsuitable for protected health information?
   • They encrypt data too heavily
   • OpenAI does not sign a business associate agreement for those plans
   • They only work in English
   • HIPAA bans all AI tools
2. Under HIPAA, which of these is a business associate?
   • A patient reading their own chart
   • A hospital's parking contractor that never sees patient data
   • A vendor that creates, receives, stores or transmits PHI on a covered entity's behalf
   • A health plan
3. A vendor advertises its chatbot as 'HIPAA certified.' What does the guide say about that claim?
   • There is no official government HIPAA certification, so the badge is marketing
   • It means HHS audited the product
   • It replaces the need for a BAA
   • It is required by the Security Rule
4. A patient pastes their own lab results into ChatGPT. How does HIPAA apply?
   • The patient has violated HIPAA
   • OpenAI becomes the patient's covered entity
   • The lab must report a breach
   • HIPAA does not restrict what patients do with their own information, but the data then falls under OpenAI's terms
5. What does the Safe Harbor method of de-identification require?
   • Removing only the patient's name
   • Encrypting the file
   • Removing 18 kinds of identifiers, including dates more specific than the year
   • Getting the patient's verbal permission
6. A clinician turns off model training in ChatGPT settings, then pastes a patient note. Why is this still a problem?
   • Turning off training does not create a BAA
   • The setting only works on weekends
   • Training settings delete the account
   • It isn't a problem once training is off
7. Why does the guide call a BAA 'necessary but not sufficient'?
   • BAAs expire after 30 days
   • The organization still has to do a risk analysis, configure access and retention, and disable features outside the BAA's scope
   • BAAs only cover paper records
   • A BAA must also be approved by the FDA
8. After someone pastes PHI into an unapproved chatbot, what does the guide say generally has to happen?
   • Nothing, if the chat is deleted
   • The employee must pay a fixed fine
   • The patient must be discharged
   • A breach risk assessment weighing the nature of the PHI, who received it, whether it was viewed and how well the risk was mitigated