AI for Medical and Dental Practices in North Carolina: HIPAA Basics

North Carolina’s large health systems were early adopters. UNC Health and Duke Health were among the first to use AI tools that listen to a visit and draft the note, NC Health News reported. Independent practices in Asheville and across the state can now get similar tools through their EHR, practice management software or an add-on. AI for medical and dental practices can cut documentation time and phone work, but HIPAA rules apply the same way to a three-provider office as to a health system.

This guide to AI for medical practices and dental offices covers the HIPAA basics, which tools offer a business associate agreement, how to use AI scribes, and what’s specific to North Carolina. It’s general information, not legal advice. Check decisions with your compliance lead or attorney.

HIPAA basics for AI in medical and dental practices

For medical and dental practices, most of HIPAA’s impact on AI comes down to a few rules:

• No BAA, no patient data. If a vendor creates, receives, stores or transmits protected health information for you, it’s a business associate. HHS says you need a business associate agreement (BAA) before sharing that information. Free and personal AI accounts don’t come with one.
• Removing the name isn’t enough. HIPAA’s de-identification standard covers a long list of identifiers, including dates more specific than the year, phone numbers and record numbers. In a small mountain town, a few details can identify a patient.
• Share the minimum necessary. Even with a BAA, give the tool only what the task needs.
• Add AI to your risk analysis. Your HIPAA risk analysis should list every AI tool that touches patient data. HHS’s Office for Civil Rights started a Risk Analysis Initiative in October 2024, and its first eight settlements totaled nearly $900,000.

Which AI tools offer a BAA to healthcare practices

The major AI providers now have HIPAA options, but usually only on specific plans:

Tool	HIPAA option
ChatGPT	OpenAI offers a BAA for eligible API customers and for ChatGPT for Healthcare, which launched in January 2026 and is sold through OpenAI’s sales team. Personal ChatGPT plans aren’t covered.
Claude	Anthropic’s HIPAA-ready offering is for Enterprise plans, with a BAA the account owner accepts in settings. Team, Pro and free plans can’t enable it, and not every feature is covered.
Microsoft Copilot	Microsoft’s HIPAA documentation lists Microsoft Copilot and Copilot Chat among in-scope services. The BAA comes by default through Microsoft’s Data Protection Addendum for organizations covered by HIPAA.
Google Gemini	Google’s list of covered services includes the Gemini app and Gemini in Google Workspace, under a Workspace account with the BAA accepted. NotebookLM isn’t on the list.

HIPAA-compliant AI depends on the plan and a signed BAA, not the brand name. Coverage lists change, and some features inside a covered plan are excluded. Before any patient information goes in, confirm the current terms with the vendor and sign the BAA. Our guide on whether ChatGPT is safe for business data explains the difference between plans in more detail.

AI scribes for medical practices

Ambient AI scribes record the visit and draft a note for the provider to review. They can give clinicians back real time, but the note is still the provider’s.

The North Carolina Medical Board’s position statement on medical records, last amended in January 2026, says licensees must make sure notes are accurate when AI helps produce them. It also says that a licensee who uses AI accepts responsibility for how they respond to its recommendations. If you follow or reject an AI suggestion, document why.

North Carolina is a one-party consent state for recording conversations, so a provider in the room can legally record. Telling patients is still good practice. A few setup tips:

• Tell patients and offer an opt-out. A sign in the room and a sentence at the start of the visit is enough for most practices.
• Ask the vendor about audio. Find out how long recordings are kept, where they’re stored and whether they’re used to train models.
• Read every note before signing. Check medications, doses, left and right, and anything the patient said only in passing.
• Start with one provider. Compare time spent on notes before and after, then decide.

AI for dental practices

Dental offices use AI in two main places:

• Imaging. Tools like Pearl’s Second Opinion have FDA clearance to flag suspected findings on X-rays, such as caries. Treat the flags as a second opinion. The diagnosis and treatment plan stay with the dentist.
• The front office. Insurance verification, recall reminders, treatment plan explanations and replies to patient messages.

The same rule applies to imaging software, AI phone systems and practice management add-ons. If it touches patient information, you need a BAA.

Front desk, billing and coding

Many medical and dental practices see the fastest AI return at the front desk and in billing:

• Phones and scheduling. AI can answer calls, book appointments and send reminders. Urgent symptoms should always go to a person.
• Prior authorizations and appeals. AI can draft the letter from the chart, as long as the tool is covered by a BAA and someone checks it.
• Coding suggestions. AI can suggest codes, but a coder or provider should confirm them against the documentation.

North Carolina lawmakers are looking at AI in billing. House Bill 565 would bar providers from using AI systems designed to upcode, and require Medicaid providers to attest to that every year. It would also bar insurers from denying prior authorization and other utilization review requests based solely on an AI algorithm. As of June 2026, the bill was in a Senate committee and had not become law.

A 30-day start for a small practice

1. Week 1: Take inventory. List every AI tool staff already use, including personal accounts, and stop any patient data going into tools without a BAA. Choose a covered tool, sign the BAA and update your risk analysis.
2. Week 2: Pick one low-risk task, like patient education handouts, appeal letters or staff schedules.
3. Week 3: Train your team and adopt a short AI policy. Our AI use policy template can be adapted for a practice.
4. Week 4: Measure and decide, then consider a scribe pilot with one provider.

Our 30-day plan to start using AI has more detail on each step.

Getting help in Asheville and Western North Carolina

Good People Technologies helps with AI implementation for small businesses, including medical and dental practices in Asheville, Western North Carolina and across the state. For medical practices, AI work usually means choosing tools that come with a BAA, setting up admin controls and connecting systems like QuickBooks Online. Our guide on how to choose an AI consultant covers what to ask any outside help. To talk it through, start with a free 15-minute operations and technology audit.

Frequently asked questions

Is ChatGPT HIPAA compliant?

Personal ChatGPT plans don’t come with a BAA, so patient information shouldn’t go into them. OpenAI offers a BAA for eligible API customers and for ChatGPT for Healthcare.

Can we use AI if we remove the patient’s name?

Usually not on its own. HIPAA’s de-identification standard covers many identifiers beyond the name, including dates, phone numbers and record numbers. Use a tool covered by a BAA instead.

Do patients have to consent to an AI scribe?

North Carolina law allows one party to a conversation to record it. Telling patients and letting them opt out is still the best practice, and some payers or employers may have their own rules. Ask your attorney if you’re unsure.

Does HIPAA apply to dental practices using AI?

Yes, for any dental office that’s a covered entity, which includes practices that bill insurance electronically. The same BAA rules apply to dental AI tools as to medical ones.

Sources, checked November 2026: HHS on business associates, Wilson Elser on OCR’s Risk Analysis Initiative, OpenAI, Anthropic, Microsoft, Google, the NC Medical Board, NC Health News, the Reporters Committee on NC recording law, Pearl via Business Wire and the NC General Assembly.