
Can OpenAI Dots Be Enabled on Patient Records?
Review OpenAI Dots for healthcare billing, PHI exposure, HIPAA terms and AI agent controls before connecting patient records in Epic.
Research topic
Research on HIPAA for AI agent workflows, with tokenization, access controls and evidence for teams handling sensitive business data.

Review OpenAI Dots for healthcare billing, PHI exposure, HIPAA terms and AI agent controls before connecting patient records in Epic.

Assess open-weights AI agent deployments for PHI, PII and tokenization, including self-hosting controls for claims and patient-account tasks.

Review Meta Business Agent privacy questions for billing and customer support, including PII retention, training, advertising and export terms.

Apply HIPAA's minimum necessary and de-identification standards to the agent: a de-identified screen for the model, real PHI only at approved destinations.

It can be, since regulators apply existing technology-neutral rules to agents. Check what the model sees, who approves actions and what an examiner gets.

The named person already accountable for releasing that data, such as the records custodian or account owner, not the AI team. Check each send goes there.

No, not on work accounts whose pages carry sensitive data. Meta's Muse pages describe a personal agent on its own cloud computer that checks before sensitive actions, and they describe no business associate agreement, no retention term for a screen and no field-level masking; ask for all three, and for what the model receives from a patient screen.

More than half of the people affected by large healthcare breaches in 2025 and 2026, 123.9 million of 220.0 million, were exposed through a vendor. About 1 in 3 of these breaches comes through a business associate, year after year. An AI tool that handles patient data is a business associate too.