The Clinical AI Problem
Doctors and medical students use ChatGPT and Claude every day. They check drug doses. They look up diagnoses. They review care plans. The tools are useful.
But pasting real patient data into these tools is a HIPAA risk. The text goes to the AI provider's servers. Without a signed Business Associate Agreement (BAA) for that service, the act violates HIPAA. Standard ChatGPT and Claude accounts do not include BAAs for clinical use.
The options are not good. Use the AI with real data and risk a violation. Or strip every note by hand before pasting — a slow step that busy clinicians often skip. Skipping it creates the very breach the process was meant to stop.
Why Manual Review Fails
HIPAA Safe Harbor requires removing 18 types of identifiers. A physician will catch a patient name and a date. But some identifiers are easy to miss.
Geographic sub-identifiers are one example. Age combined with an admission date is another — together they can form a covered identifier pair under HIPAA. These patterns are not obvious under time pressure.
Menlo Security's 2025 research found that real-time browser PHI interception cuts leakage by 94%. That gap shows what clinicians miss versus what tools catch. Cyberhaven data confirms the scale: 77% of employees share sensitive work data with AI tools at least weekly.
How a Browser Extension Helps
A Chrome extension checks text at the moment of submission. It runs before the prompt reaches the AI. The clinician sees a brief preview. It shows what PHI was found and what will be masked.
This is not a hard block. The doctor can proceed, edit, or stop. It adds one short check to an otherwise fast action.
Take an internal medicine teacher using Claude for case-based learning. They paste a case note they already reviewed. The extension runs a second pass. If the note was clean, no alerts appear and the session moves on. If a detail slipped through — a date pair or a small town name — the tool catches it first.
This model fits clinical work well. It keeps the doctor in control. It adds a safety net for the patterns that humans tend to miss.
See our PHI detection accuracy comparison for tool benchmarks. Our HIPAA cloud zero-knowledge guide covers BAA rules and safeguards. The browser DLP guide has setup details.