Healthcare practices across Vancouver, WA, and Portland are fielding pitches for AI tools that promise faster documentation and fewer administrative hours. Any AI healthcare IT decision comes down to two things: what data the tool touches and what healthcare compliance requires once it does. This piece covers where AI already shows up in practice operations, what HIPAA (the Health Insurance Portability and Accountability Act) requires, and what to check before signing with a vendor.

Where AI already fits into medical practice technology

Most Vancouver and Portland practices are not deciding whether to adopt AI. They are already running pieces of it inside tools they pay for every month. Microsoft 365 Copilot can draft a patient letter or summarize a long email thread inside Outlook. Scheduling software increasingly includes AI-driven no-show prediction. Dictation tools built into electronic health record (EHR) systems use natural language processing to turn a spoken note into structured text.

A dedicated AI budget or a formal rollout plan is not usually the entry point. AI arrives inside whatever mix of medical practice technology a location already runs on, whether a tool was chosen deliberately or arrived as a feature update inside software the practice signed up for years ago. The compliance points below apply either way.

The clearest near-term value tends to come from administrative tools rather than diagnostic ones. Appointment reminders, intake forms, billing queries, and staff scheduling are lower-risk starting points than anything touching a clinical decision.

How HIPAA applies to AI healthcare IT decisions

HIPAA does not stop applying just because a tool includes AI. Any system that creates, stores, or transmits protected health information (PHI) needs a signed Business Associate Agreement (BAA) before patient data goes near it. That single requirement is where most HIPAA AI decisions start and, for a lot of tools, where they end. Public, consumer-tier AI tools such as the free version of ChatGPT do not sign a BAA, so entering a patient’s name, symptoms, or treatment details into one is a HIPAA violation regardless of intent.

The steadier route runs through platforms a practice already has a compliance relationship with. Microsoft covers Microsoft 365 Copilot under its existing HIPAA Business Associate Agreement for eligible enterprise plans, so AI features inside Outlook, Word, and Teams can be used with PHI once the tenant is configured correctly. The right Microsoft 365 setup for a medical practice is a bigger conversation than turning Copilot on.

Federal guidance has also started addressing AI directly. The U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights, has confirmed that nondiscrimination protections under Section 1557 extend to AI-driven patient care decision support tools, so any tool that helps assess risk, recommend care, or flag eligibility carries obligations beyond data security. Healthcare compliance now extends past where the data lives to cover what the tool decides.

Washington adds a state layer on top of HIPAA. The My Health My Data Act protects health-adjacent data collected outside a clinical record, such as website chatbot logs or online intake forms, that HIPAA does not typically reach. A practice running an AI-powered scheduling assistant or chatbot on its website should check whether that data falls under this law.

Common mistakes practices make when adopting AI too quickly

A single staff member introducing a tool without anyone reviewing what data it touches is the most common starting point. Drafting appointment reminders in a free AI chatbot can move patient names and visit reasons outside the practice’s controlled environment the moment that information is typed into the chat window, often without anyone else in the practice aware it happened.

Vendor due diligence gets skipped almost as often. Practices that would never sign an EHR contract without confirming cybersecurity safeguards are in place sometimes adopt an AI scribe or a patient-facing chatbot on nothing more than a demo and a sales call.

A written policy is the piece most practices are missing entirely. Staff need to know which tools are approved for patient information, which are not, and where to check before trying something new. Without one, adoption happens tool by tool, unevenly, with no one accountable for the pattern it creates across the practice.

What to ask before choosing an AI-enabled tool

A handful of items should be confirmed with any AI vendor before signing anything, since checking up front can save months of cleanup later.

• Will the vendor sign a HIPAA Business Associate Agreement, and which of its services does that agreement cover?
• Where is the data processed and stored, and is any of it used to train the vendor’s models?
• What happens to a patient’s information if the practice cancels the contract?
• Does a person review AI-generated output before it reaches a patient record, or does the tool act without oversight?

For tools built into certified EHR systems, there is a federal answer to lean on. The Office of the National Coordinator for Health Information Technology (ONC) requires certified EHR developers, under its Health Data, Technology, and Interoperability rule, to disclose specific details about the predictive algorithms inside their products. A practice can request that information directly from the vendor. That disclosure requirement is currently under review for a possible rollback, so confirming with a vendor whether it still applies at the time a contract is signed is a sensible step. Working through this list as part of a wider IT roadmap and vendor review keeps the approach consistent across every AI decision the practice makes.

How the right IT partner supports safe AI adoption

The AI tool itself is usually the smallest part of safe adoption in a medical practice. Safe adoption depends on the fundamentals underneath it, including who has access to which systems, how data is backed up, and whether the network is monitored for anything unusual. Reviewing those fundamentals before a new AI tool goes live catches problems earlier than reviewing them after a breach.

Centerlogic works with practices across Vancouver and Portland to bring AI into an existing IT environment without adding risk the practice cannot see. That includes checking vendor contracts for HIPAA coverage, configuring Microsoft 365 tenants so Copilot and other AI features stay inside the practice’s compliance boundary, and setting up access controls that keep patient information visible only to the people who need it.

Practitioners considering their next AI tool or trying to understand what is already live inside their current software can book a consultation with Centerlogic to walk through what safe AI healthcare IT adoption looks like for their specific systems.

FAQs

Can our practice use ChatGPT or similar public AI tools with patient information?

Not without a signed Business Associate Agreement. Public consumer versions of tools such as ChatGPT do not sign a BAA, so entering a patient’s name, symptoms, or treatment details into one creates a HIPAA violation regardless of the practice’s intent.

What is a Business Associate Agreement, and does every AI tool need one?

A Business Associate Agreement is a contract that sets out how a vendor may handle protected health information. Any AI tool that creates, stores, or transmits PHI needs one before it goes near patient data. Tools that never touch PHI, such as scheduling software running on de-identified data, do not require one.

Does Washington state law add anything beyond HIPAA for AI tools?

Yes. Washington’s My Health My Data Act covers health-adjacent data collected outside a clinical record, such as website chatbot logs or online intake forms, that HIPAA does not typically reach. Practices running patient-facing AI tools on their website should check whether that data falls under this law.

Is Microsoft 365 Copilot safe to use with patient records?

Copilot inside eligible Microsoft 365 enterprise plans is covered under Microsoft’s existing HIPAA Business Associate Agreement, but that coverage depends on correct tenant configuration and licensing. A practice still needs its own access controls and staff training for that coverage to hold up in practice.

Do patients need to be told when AI is involved in their care?

Disclosure requirements vary by use case, and federal guidance is trending toward greater transparency. Tools that support clinical decisions, such as risk scoring or diagnostic support, carry non-discrimination and oversight obligations under Section 1557 that go beyond simple data security.