Is it safe to share {X} with {Y}?
No, it is not safe to share medical records with ChatGPT under normal circumstances. When you enter information into ChatGPT, OpenAI may retain that data for up to 30 days for safety review and model improvement unless specific API agreements are in place. Medical records contain protected health information that, once entered, leaves your direct control and enters third-party infrastructure without HIPAA-compliant safeguards by default.
Why this matters
- OpenAI's standard consumer platform is not a HIPAA-covered entity, meaning there is no Business Associate Agreement protecting your medical data by default.
- Prompts entered into ChatGPT can be reviewed by human trainers as part of OpenAI's safety and quality processes, exposing sensitive diagnoses, medications, or treatment histories to third parties.
- Data submitted through the consumer interface may be used to improve future model versions, creating a persistent risk that medical details persist beyond the original session.
For enterprise
Employees who submit patient or personal medical records into ChatGPT outside of IT-approved, HIPAA-compliant tools expose their organization to serious regulatory liability under HIPAA and equivalent frameworks. This includes internal HR medical records, patient intake data, or clinical notes shared informally to speed up documentation tasks. Most enterprise data governance and acceptable use policies explicitly prohibit this, and violations can trigger mandatory breach notification requirements.
Compliances at risk
What counts as Medical Records?
- Medical histories
- Clinical notes
- Hospital records
- Treatment records
- Electronic health records (EHRs)
Why people share Medical Records with ChatGPT
- To summarize patient history
- To review treatment information
- To prepare referrals
- To generate clinical documentation
What actually happens when you paste Medical Records into ChatGPT
When you paste Medical Records into ChatGPT, that data is transmitted from your device to external servers operated by the AI provider.
Depending on system configuration and policies, the data may be logged, temporarily stored, or reviewed for safety and quality purposes. Retention can last from days to weeks, and in some cases may extend beyond the immediate session.
Statements such as “we do not train on your data” do not eliminate risks related to retention, logging, or internal access. These controls vary by product and setting, and are not always visible to end users.
From a governance perspective, any non-zero retention window introduces exposure risk when sensitive data is shared without controls, auditability, or enforcement.
Risks of sharing Medical Records with ChatGPT
- Patient privacy violations: Protected health information may be exposed without authorization.
- Regulatory penalties: Improper disclosure can violate healthcare privacy regulations such as HIPAA.
- Medical identity theft: Health records can be exploited for insurance fraud or identity misuse.
Real incidents
- Training data extraction : Researchers extracted memorized personal and sensitive information.
- Italy temporarily bans ChatGPT : Regulators raised concerns over GDPR compliance.
- Italy fines OpenAI €15M : Privacy regulators found GDPR violations in ChatGPT's data processing.
Is this allowed under policy or law?
Safer ways to handle Medical Records
Medical Records should not be shared with consumer AI tools without controls in place. If AI assistance is required, organizations should use systems that enforce data redaction, access controls, and policy enforcement before data leaves their environment.
- Automatically redact sensitive fields before sending data to AI models
- Prevent unauthorized data from being entered into external tools
- Maintain audit logs and visibility into how data is used
- Ensure compliance with frameworks like GDPR, CCPA, and SOC 2
Platforms like Wald are designed to enable safe AI usage by ensuring sensitive data never leaves your control unprotected.
How Wald.ai handles this safely
Wald adds a governance layer to AI usage, helping organizations monitor and control how sensitive data like Medical Records is shared.
AI DLP
Identifies Medical Records in context and enables teams to:
- Observe AI usage
- Detect sensitive data in prompts
- Allow, warn, or block actions
- Maintain audit logs
LLM Pack
Provides controlled access to multiple AI models (ChatGPT, Claude, Grok, and others) through a single governed environment.
- Centralized model access
- Policy enforcement
- Usage visibility
- Auditability
