Can Alberta dental offices use ChatGPT with patient information?
What the Health Information Act means for referral letters, handouts and insurance appeals written with AI, and a one-day plan to do it safely.
The short answer
Yes, an Alberta dental office can use ChatGPT, Copilot, Claude or Gemini for writing work, as long as patient health information doesn't go into the chat. Under the Health Information Act (HIA), a dentist or dental hygienist is a custodian, and every staff member is an affiliate. Pasting a patient's name, birth date, health card number or chart notes into a consumer AI chat sends that information to an outside company, usually in the United States. Most offices have no written rule about it, so each person decides on their own.
The practical fix is simple: decide what AI may be used for, strip identifying details before anything is pasted, train staff once, and keep a record.
Who the HIA covers in a dental office
The Health Information (Ministerial) Regulation names regulated members of specific colleges as custodians. That list includes dental surgeons (dentists) and dental hygienists, along with physiotherapists, chiropractors, optometrists, opticians, denturists, dietitians, pharmacists and others (regulation). Alberta.ca explains custodians, affiliates and the duty to report breaches (Alberta.ca HIA page). Your receptionist, treatment coordinator and office manager are affiliates. The custodian stays responsible for what they do with patient information.
The College of Dental Surgeons of Alberta also has a standard of practice on privacy and patient health information (CDSA standard, PDF). Read it alongside the HIA.
Why a ChatGPT prompt counts
- It's a disclosure. The OIPC's guidance for small custodians on AI says custodians remain responsible for health information they put into AI tools, and points them to privacy impact assessments and safeguards before use (OIPC guidance).
- New systems may need a PIA. Under section 64 of the HIA, a custodian prepares a privacy impact assessment and submits it to the Commissioner before implementing a new system or practice involving health information (OIPC PIA requirements). Ask your privacy officer whether a planned AI use triggers this.
- Breaches must be reported. If health information is disclosed without authority and there is a risk of harm, the HIA requires notice to the affected people, the Commissioner and the Minister of Health (OIPC breach notification).
- Regulators have looked at ChatGPT. Canada's privacy commissioners, including Alberta's, jointly investigated OpenAI (joint report).
What dental offices actually use AI for
| Task | Needs patient details? | Safer way |
|---|---|---|
| Referral letter to an endodontist or oral surgeon | Usually the clinical facts only | Replace name, DOB, health and insurance numbers with tags; restore them after |
| Plain-language post-op or treatment-plan handout | No | Write it generically; no patient data needed |
| Insurance predetermination appeal | Policy and member numbers | Mask numbers and names; keep the clinical reasoning |
| Reply to a Google review | Never confirm someone is a patient | Write without names or treatment details |
| Summarizing a chart for a colleague | Full chart | Don't use a consumer AI chat; use your practice software |
What de-identifying looks like
Before (a made-up patient):
What the AI sees after Hushtag:
The AI writes the referral with the tags in it, and Hushtag puts the real details back on your computer. The clinical facts still go to the AI, so judge whether they could identify someone (a rare condition in a small town, for example). No tool catches everything: look over what was masked before you send. You can test it yourself.
A one-day plan
- Policy (20 min). Adopt a one-page staff AI-use policy. Ours is free as Word or PDF.
- Tool (10 min per computer). Install a de-identification step in the browser and lock the settings so it stays on.
- Training (15 min). Show one real example and have everyone sign the policy.
- Record (ongoing). Keep a record that the safeguard is used. Hushtag's AI-use record logs the date, AI site and how many details were hidden, never the text.
- Breach plan (10 min). Name who decides if an incident is reportable and bookmark the OIPC page.
- Ask about a PIA. Check with your privacy officer or the CDSA.
The full checklist is on our dental offices page.
Sources
- Alberta Open Government: Health Information (Ministerial) Regulation (designated custodians)
- Alberta.ca: Health Information Act
- OIPC Alberta: AI guidance for small custodians on the use of artificial intelligence
- OIPC Alberta: Privacy impact assessment requirements
- OIPC Alberta: Breach notification
- OIPC Alberta: Joint investigation report on OpenAI (ChatGPT)
- College of Dental Surgeons of Alberta: Standard of Practice, Privacy and Management of Patient Health Information (PDF)
Links checked October 18, 2026. Laws and guidance change; rely on the official versions.