The promise of artificial intelligence in medicine has collided with the reality of healthcare cybersecurity, as hospitals discover that physicians are increasingly turning to free AI chatbots for clinical guidance—often without institutional approval and sometimes with hundreds of patient records in tow.

Monument Health, a health system serving South Dakota and Wyoming, recently confronted this dilemma when Chief Information Officer Patrick Woodard discovered that a physician had stored more than 100 patient records inside OpenEvidence, a free AI-powered clinical decision support tool. The discovery prompted Monument Health to block access to the platform entirely, despite pushback from clinicians who had come to rely on it.

The Rise of "HIPAA-Compliant" Clinical AI

The incident at Monument Health reflects a broader trend sweeping through American healthcare. Over the past year, hundreds of thousands of doctors have begun using free AI chatbots specifically designed for medical professionals, including OpenEvidence, Doximity Ask, and ChatGPT for Clinicians. These platforms have surged in popularity as physicians seek rapid access to medical literature, diagnostic suggestions, and treatment recommendations.

What distinguishes these tools from consumer chatbots is their claim to HIPAA compliance. After users sign agreements, these platforms permit the direct sharing of protected health information (PHI), positioning themselves as legitimate clinical tools rather than unauthorized workarounds. For time-pressed clinicians seeking evidence-based guidance at the point of care, the appeal is considerable.

The Institutional Governance Dilemma

For health system administrators and IT security teams, however, these tools represent a potential minefield of compliance, liability, and data security risks. The fundamental tension centers on control: while the chatbots may claim HIPAA compliance, they typically lack the business associate agreements, security controls, and institutional oversight that health systems require for any technology handling patient data.

Monument Health's decision to block OpenEvidence illustrates the difficult calculus facing healthcare organizations. Blocking access risks clinician dissatisfaction and may simply drive the practice underground, creating shadow IT proliferation that's even harder to monitor. Yet allowing unfettered use of external AI platforms means ceding control over sensitive patient information to third-party vendors whose security practices and data handling remain outside institutional governance.

Balancing Innovation and Security

The situation forces health systems into a choice: invest in enterprise AI solutions with proper institutional safeguards, or continue playing whack-a-mole with unauthorized tools as they emerge. Neither option is straightforward. Enterprise solutions require significant capital investment and lengthy procurement processes, while clinician demand for AI-powered decision support continues to accelerate.

As AI capabilities advance and more physicians integrate these tools into their daily workflows, the gap between clinical innovation and institutional security requirements shows no signs of narrowing. Health systems that fail to address this tension may find themselves simultaneously blocking the tools their clinicians want while struggling to implement alternatives that meet both clinical needs and compliance standards.

Sources

  1. As more doctors consult chatbots, health systems can block them — or buy in — STAT News