Where generative AI can—and cannot—help a physician

Begin with the work, not the model

Map the actual task before discussing prompts. Name the input, the person accountable for review, the authoritative source, the approved destination, and the consequence of an error. This turns a vague AI idea into a workflow that a clinical, privacy, and security team can evaluate.

Low-risk candidates often involve structure rather than judgment: reorganizing de-identified notes, drafting a neutral agenda, creating a first-pass patient handout from approved source material, or converting a policy into a checklist.

• Input and data classification
• Named reviewer and source of truth
• Approved destination and retention rule

Use a simple consequence ladder

Classify tasks by the harm an error could cause. Administrative wording may sit in a lower lane. Patient-specific interpretation, diagnosis, medication, or triage sits in a high-consequence lane and should not be delegated to an unverified output.

The same tool may be acceptable for one lane and inappropriate for another. Governance should follow the workflow, not the brand name.

• Low: formatting and internal brainstorming
• Medium: patient-facing drafts with qualified review
• High: clinical decisions, orders, or autonomous action

Compliance is a workflow, not a label

A product name, model name, or marketing page cannot make a healthcare workflow compliant by itself. The organization using the tool still has to determine whether HIPAA applies, understand what information enters the system, document permitted uses, configure access, train its workforce, and manage risk.

For a cloud service that creates, receives, maintains, or transmits electronic protected health information on behalf of a covered entity or business associate, HHS guidance centers the business associate agreement and the regulated organization’s own risk analysis. Those are operational responsibilities, not badges that can be inferred from a homepage.

• Identify the data before selecting the tool
• Confirm the contract and covered services
• Document access, retention, review, and incident handling

Keep the human decision visible

Generative output can be fluent and still be incomplete, outdated, or wrong. A useful implementation names who reviews the output, what they compare it against, which changes they must make, and where the approved final record lives.

Human review should be proportionate to the consequence of error. A draft staff announcement and a patient-specific clinical recommendation do not belong in the same review lane. High-consequence decisions require qualified professional judgment and authoritative sources.