ChatGPT’s memory and browser features raise legitimate privacy concerns for healthcare workers who discuss patient-adjacent topics in their prompts. The short guidance: do not enter any patient-identifiable information into ChatGPT or any AI tool without explicit organizational policy and technical safeguards in place. For general marketing and SEO tasks, ChatGPT is safe to use — with awareness of what gets stored.
What ChatGPT Stores and How Long
By default, ChatGPT stores conversation history and can use it to train future models unless you opt out. The Memory feature retains facts across sessions. The browser/web search feature sends your queries to the web on your behalf. Three settings control your exposure — and none are turned off by default.
Configure These 3 Settings Before Using ChatGPT for Healthcare Work
None of these are off by default. Click each setting to see exactly where to find it and what it controls.
The HIPAA Issue
OpenAI’s standard consumer terms do not constitute a HIPAA Business Associate Agreement (BAA). Entering any Protected Health Information into standard ChatGPT — patient descriptions, case details, symptoms, or any information that could identify a patient — is a HIPAA violation.
OpenAI offers a healthcare-oriented API path with BAA capability for enterprise customers — but this requires a formal agreement and technical implementation, not the standard ChatGPT interface your team uses.
- ✓Service page and ad copy drafts
- ✓Keyword and patient language research
- ✓Meta descriptions and title tags
- ✓Generic HIPAA-compliant review templates
- ✓Marketing strategy and competitive research
- •Patient names, DOB, conditions, appointments
- •Real patient case descriptions (even “anonymized”)
- •Clinical documentation or patient instructions
- •Memory enabled on shared or work devices
Practical Policy Recommendation for Healthcare Practices
Establish a simple written policy: ChatGPT and AI tools may be used for marketing, administrative, and general business tasks. No patient information — identifiable or potentially identifiable — may be entered into any AI tool without explicit IT and compliance approval. Review this policy with staff annually and include it in HIPAA training.
For more on HIPAA-compliant digital marketing, see Direction’s healthcare SEO practice and HIPAA-compliant review response templates.