Aligned Intelligence Insights

The HIPAA Problem With Using ChatGPT in Your Practice

2026-07-01T00:00:00Z

Here is a scene that plays out in small practices every week. The front desk needs to send a slightly awkward letter to a patient. Someone opens ChatGPT, types in the patient's name, the situation, a few details, and asks for a polished draft. Thirty seconds later they have a good letter. It feels like a win.

It is a HIPAA violation.

Not because the letter was wrong, and not because ChatGPT is insecure. It is a violation because your practice has no agreement with OpenAI that allows patient information to go there.

The missing piece: no business associate agreement

HIPAA requires a covered entity to have a business associate agreement with any outside company that handles protected health information on its behalf. The agreement makes that company legally accountable for the data.

As of 2026, OpenAI offers a business associate agreement only for its API platform and for ChatGPT Enterprise and Edu, both sales-managed and reviewed case by case. There is no BAA for ChatGPT Free, Plus, Team, or Business.OpenAI Help Center

So the moment a name and a health fact go into the consumer version of ChatGPT, your practice has disclosed protected health information to a vendor with no agreement in place. The individual staff member was trying to be efficient. The practice is the one exposed.

This is not unique to OpenAI. It applies to any general AI tool your team might reach for: the free tier of a writing assistant, a browser extension, a note-taker that joins calls. If it touches PHI and has not signed a BAA with you, it is off limits.

The surface matters, not just the brand

It gets more specific. Even inside tools that do offer healthcare agreements, coverage can depend on which part of the product you use.

Google's Workspace HIPAA business associate agreement covers the Gemini app as a core service. But it excludes Gemini in the Chrome browser, and it excludes Google Contacts. Same account, same login, one surface covered and another not.

The takeaway is not "avoid these tools." It is that "we have a BAA with Google" is not a complete answer. You need to know which surface your team is actually using.

What your staff can still do with AI

The line is patient data, not AI. Work that contains no PHI is fine in ordinary tools:

Policy and procedure drafts
Staff training material
Marketing copy and social posts about the practice
General administrative writing with no patient attached
Learning and research, as long as you are not pasting in real cases

Plenty of useful work fits there. The problem is only when a specific person's health information enters a tool that has no agreement covering it.

The safe way to start

Front-office AI that helps a practice usually does not need PHI at all. Filling cancellations, working the recall list, confirming appointments, and requesting reviews all run on scheduling data and contact details. Those are not clinical facts, so they open up a much wider set of tools.

Where a workflow genuinely needs patient health information, it should run inside a platform you already have a business associate agreement with, such as your practice management system or your patient communication tool. The AI adds the automation. The PHI never leaves the system that is cleared to hold it.

Two steps to put this on solid ground:

Write a one-page AI policy. Which tools are approved, for what, and the bright line: no patient information in any tool without a signed BAA. Most practices have nothing written down, which is how the letter-drafting habit starts.
List the tools that touch patient data. Your practice management system, your comms platform, your billing tool, and confirm each has a current agreement. This is also the inventory a proposed HIPAA Security Rule update would require, so it is worth having either way.

The bottom line

Your team is not wrong to want AI's help with the front-desk grind. They just need a version of it that does not route patient information through a tool your practice never signed an agreement with.

For a walk through where AI safely fits in a small practice, see the front-office playbook, or get a breakdown for your practice specifically. No call needed.

This is general information, not legal advice. Confirm how HIPAA applies to your practice with your own compliance counsel.

Most Small Businesses Use AI for the Wrong Things

2026-07-08T00:00:00Z

You are probably already using AI. Half of the people at small and mid-sized companies are. The question is whether it is doing anything that shows up in your numbers.

For most businesses, the honest answer is not yet. And the reason is simple. The way AI gets used at work is stuck at the chat window.

The number that matters

The US Chamber of Commerce Foundation surveyed more than a thousand workers at companies with 2 to 499 people in 2026. Here is what they found:

50% of workers use AI at work. 64% use it for personal productivity. 26% use it on recurring tasks. Only 6% use it to automate a workflow with minimal human involvement.US Chamber of Commerce Foundation, Main Street AI Monitor, 2026, n=1,070

Read that last line again. Six percent.

Almost everyone is asking AI to write an email, clean up a paragraph, or summarize a call. Very few have handed it a job that runs start to finish. That is the gap between using AI and getting value from it.

Why the chat window is a trap

Chat is easy to start and hard to grow. You open a tab, type a question, get an answer, and move on. Nothing changes about how the work actually flows through your business.

The next day the same task comes back. You open the tab again. You are still the one moving the work from step to step, copying text between tools, and remembering what happens next. The AI helped with one piece. You did everything else.

A workflow is different. You map the steps once. Then the process runs on its own every time the trigger happens. A new client fills out a form, and the system collects their documents, checks what is missing, sends the follow-up, and tells you when it is ready for your review. You are still in charge. You are just not doing the parts a machine does better.

What "unclear business application" really means

The same survey asked people who have not adopted AI why not. The top answer was not cost. It was "unclear business application." They cannot see how it fits their actual work.

That makes sense. Nobody sells you the workflow. The tools get marketed as chat. The demos show chat. So the mental model everyone builds is chat, and the leap to "this could run my intake process" never happens on its own.

Seeing that leap is the whole job. Once you can point at a specific process and say "this one, these steps, this result," AI stops being a novelty and starts being infrastructure.

Where to look first

You do not need a strategy deck to find your first real AI project. You need one task that matches all four of these:

It repeats. You do it every week, or every client, or every deal.
It follows rules. Someone could write down how to do it.
It moves between tools. Email to spreadsheet to CRM to calendar.
It costs time that you would rather spend elsewhere.

Client intake. Document collection. Data entry and enrichment. Weekly status reports. New-hire onboarding steps. These show up on almost every list because they fit the pattern exactly.

Pick one. Write down every step, including the small ones. That map is the thing you automate. Get it running and measured before you touch the next one.

The point

AI is not underperforming at your business because the technology is weak. It is underperforming because it is being used for the smallest possible tasks.

The 6% who moved past the chat window are the ones seeing recovered hours, faster turnarounds, and processes that do not fall apart when someone is out. That group is small today. It does not have to stay that way for your team.

If you want a structured way to find your first workflow, the AI Readiness Scorecard walks you through where your business stands across data, tools, team habits, and process. It takes a few minutes, and no call is needed to see the result.

What the IRS Circular 230 AI Guidance Means for How Your Firm Bills

2026-07-22T00:00:00Z

In June 2026 the IRS Office of Professional Responsibility published "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." It is the first time the OPR has said anything specific about AI, and if your firm uses these tools on tax work, it is worth ten minutes of your attention.

Here is the plain version, including the part that touches billing.

What it is, and what it is not

The guidance applies Circular 230, the existing rulebook for practice before the IRS, to how you use AI. It does not create new rules. It walks through six duties you already have and explains how AI intersects with each one: competence, client data, supervision, accuracy, and so on.

Two things it is not:

It is not new law. It is introductory guidance interpreting binding rules that were already there.
It is not a client-disclosure mandate. Neither the OPR nor the AICPA has imposed a standalone "tell clients you used AI" duty on accountants. Rules from the legal profession that do require that circulate in vendor content as if they apply to CPAs. They do not.

It also applies to federal tax practice only. Bookkeeping and client accounting services sit outside it.

The part about money

One of the six duties is section 10.27, which governs fees. The guidance says practitioners should disclose the AI activities performed and "fairly credit to the client's account any cost reductions." It warns that billing for manual time you did not actually spend, or double billing for a task AI assisted with, may run into the fee rules where there is a pattern or a material discrepancy.

Read carefully, this is not radical. It is the existing rule against unconscionable fees, pointed at a new situation.

Three months before the guidance landed, 28% of tax practitioners using AI said they planned to keep their hourly rates and simply keep the time they saved.Blue J / CPA.com, March 2026, n=1,000

That plan is the thing the guidance speaks to most directly. If AI cuts a task in half and you bill the client as though it took the old amount of time, and that becomes a pattern, you have a 10.27 problem.

Why this makes fixed-fee pricing look better

Here is the quiet implication. Section 10.27 exposure attaches most cleanly to hourly billing, because that is where "time not worked" is a measurable thing.

A firm on fixed fees or value pricing is billing for an outcome, not for hours. When AI makes the work faster, the firm keeps the margin, the client gets the same deliverable, and there is no gap between hours billed and hours worked to explain.

This lines up with what clients say they want anyway. Business owners rate an accountant as more valuable when saved time goes into strategy conversations, not when the invoice shrinks. The guidance and the market are pointing the same direction.

The related risk worth knowing

The same survey found that 90% of tax practitioners using AI use general-purpose consumer models. The OPR guidance explicitly warns against putting client data into "unsecured or public systems," and IRC section 7216 carries criminal penalties for improper disclosure of taxpayer information.

So the exposure is really two things stacked: how you bill for AI-assisted work, and what tool the work runs through in the first place.

What to put in place

None of this requires a compliance project. It requires three artifacts and a habit:

A short AI policy. Which tools are approved, for what kind of work, and what is off limits. One page.
A tool register. A list of every AI tool that touches client data and what data terms it operates under. This is where you catch the consumer-chatbot problem.
A verification log. A lightweight record that a human reviewed AI output before it went to a client or the IRS. Circular 230 puts supervision on the responsible practitioner, and this is how you show it happened.
A billing habit. Decide how your engagement letters describe AI-assisted work and how cost savings show up. If you are hourly, this is the moment to look hard at fixed fees for the work AI now accelerates.

Most small firms have none of the first three. Building them is a half-day, and it is the first thing we set up before any workflow, because everything else assumes it exists.

If you want help turning this into a working setup for your practice, see what we build for accounting firms or get a breakdown for your firm specifically. No call needed.

This is general information, not legal or compliance advice. Confirm how Circular 230 applies to your practice with your own counsel or your state board.

Fill Last-Minute Cancellations Without Your Front Desk on the Phone All Day

2026-08-05T00:00:00Z

A patient cancels a crown prep at 8:10am for an 11am appointment. Now there is a two-hour hole in the schedule and a chair sitting empty during your most productive hours.

Someone at the front desk starts calling down a list. Most calls go to voicemail. By the time anyone calls back, it is 2pm and the slot is gone. The practice ate the cost, and a staff member spent the morning on the phone instead of with the patients in the building.

This is one of the clearest cases for a workflow, and one of the easiest to build, because it never touches a patient's health information.

How the workflow runs

Patients opt onto a waitlist. When someone books further out than they would like, or asks to be told about earlier openings, they go on a list with the appointment type they need and their preferred days and times.

A cancellation triggers the fill. The moment a slot opens, the workflow finds the waitlisted patients who match that appointment type and time, ranked by how well they fit and how long they have waited.

It offers the specific slot. Matched patients get a text: here is an opening tomorrow at 11am, reply YES to take it. Not "call us about openings." The exact time, one tap to claim.

It stops when the slot is filled. The first patient to accept is booked. Everyone else gets nothing further for that slot, or a quick note that it filled and they are still on the list.

The front desk sees a confirmed appointment. Not a hole, not a call list. The schedule closed its own gap.

Why it works when phone calls do not

Speed and reach. A workflow contacts every good match at once, within a minute of the cancellation, through the channel people actually check. A person can only call one patient at a time and mostly reaches voicemail.

It also runs every time, not just when someone has a spare hour. Consistency is most of the value.

What it does not do

It does not decide who is clinically appropriate for a slot. It matches on appointment type, which the front desk already tracks. If a case needs judgment about whether a patient should be moved up, that stays with your team, and the workflow just surfaces the candidates.

It does not give patients medical guidance. It confirms times. Anything beyond scheduling routes to a person.

What you need to start

A place for patients to join the waitlist, which most practice management and patient communication systems already support
A texting channel patients have agreed to
Your appointment types and roughly how you prioritize the list today

Most practices are surprised how much of this their current tools can already do once the outreach is automated. The build is connecting those pieces so the fill happens on its own.

For the full picture of where AI fits in a small practice, see the front-office playbook. To scope this one for your schedule, get a breakdown. No call needed.

What to Automate Before You Hire Your First Ops Person

2026-08-08T00:00:00Z

At some point a growing SaaS team decides it needs an operations person. The sales ops, the CRM hygiene, the onboarding handoffs, the reporting, the tool sprawl: someone should own all of it.

That instinct is right. But if you hire before you automate, the new person spends their first six months as a human integration layer, moving data between tools and chasing handoffs. You will have paid a salary to keep the busywork from falling over, and the strategic work you actually hired for never starts.

Automate the repetitive layer first. Then the role is worth what you are paying for it.

The work to move to workflows

Inbound lead routing

Every lead needs enrichment, a fit check, routing, and fast follow-up. This is the single most common thing a new ops hire inherits, and it is almost entirely rules. A workflow enriches the record, scores it against your criteria, routes it, and drafts the first message. Speed-to-lead becomes consistent instead of dependent on who is watching the inbox.

Deal and CRM hygiene

Stages that do not update, fields left blank, notes that live in Slack. A workflow can keep records current from the systems of truth, flag deals that have gone quiet, and fill the fields your reporting depends on. The ops person stops being the CRM police.

Onboarding handoffs

When a deal closes, a checklist should run: provision the account, send the welcome sequence, schedule the kickoff, notify CS, start the onboarding tracker. Done by hand, steps get skipped and the customer feels it. As a workflow, it runs the same way every time and flags the accounts that stall.

Renewal and QBR prep

Pulling usage data, support history, and account notes into a renewal packet or a QBR deck is assembly work. A workflow builds the draft. The person spends the time on the customer conversation, not the slides.

Recurring reporting

The weekly pipeline update, the board metrics, the CS health rollup. If someone rebuilds these by hand every week from three dashboards, that is a workflow waiting to happen.

What is left for the person

After that, the ops role is the job you meant to hire:

Choosing and negotiating tools
Designing processes, not just running them
Leading cross-team projects
Planning capacity and headcount
Owning the numbers and what they mean

That is a strategic seat. The version where they spend the quarter catching up on lead routing is not.

Half of workers at small and mid-sized companies use AI, but only 6% use it to run a workflow with minimal human involvement. The rest is single-task help.US Chamber of Commerce Foundation, Main Street AI Monitor, 2026, n=1,070

Most teams are in that 94%. The connective work is still manual, so it still needs a person, so the next hire gets aimed at it.

How to sequence it

Pick the workflow tied to the loudest pain. If leads are slipping, start with routing. If customers feel the onboarding cracks, start there. Get one running and measured, then move down the list.

If you want a read on which one is costing you most, the AI Readiness Scorecard is a quick way to find it. Or see the full guide for SaaS teams for how these fit together.

Patient Intake That's Done Before They Sit Down

2026-08-12T00:00:00Z

New patient intake in the waiting room is a bad deal for everyone. The patient fills out a clipboard while their appointment time slips. The front desk retypes the answers into the practice management system later, usually after hours. Insurance details are wrong or missing and someone chases them down mid-visit.

Moving intake ahead of the appointment fixes most of that. AI makes the ahead-of-time version actually work, because the reason it usually fails is follow-through, and follow-through is a workflow problem.

What the workflow does

Sends the forms when the appointment is booked. The patient gets a link to complete intake on their phone, days before the visit, not a PDF to print.

Reminds the ones who haven't finished. Most people start and do not complete. A reminder a day or two later, then again the morning before, lifts completion a lot. The workflow tracks who is done and only nudges who is not.

Checks what came back. Before the visit, it flags missing insurance information, an unsigned consent, or a blank field that will slow check-in. The front desk gets a short "ready" or "needs X" list for tomorrow's patients instead of finding out at the desk.

Organizes it for review. The answers land in your system in a structured form your team can scan, not a stack of scanned pages.

Where the HIPAA line sits

The medical history, the medications, the insurance details: that is protected health information. It has to live in a system your practice has a business associate agreement with. For most practices that is the practice management system or the patient communication platform, both of which are built for this.

So the AI is not storing health answers somewhere new. It is handling the parts around them: sending the link, chasing the stragglers, checking for gaps, and telling your team what is ready. The clinical data stays where it is cleared to be.

This is the same principle behind every safe front-office automation. Decide what the workflow needs to see, and keep PHI inside the systems that are allowed to hold it.

What changes for the practice

The front desk stops retyping forms. Check-in gets faster because the paperwork is done and verified. Insurance surprises drop because gaps got caught the day before, not at the window. And the after-hours data entry that nobody is paid for goes away.

None of this replaces a person. The front desk still greets the patient, still handles the hard insurance question, still helps the patient who did not do the form. They just start the day with a ready list instead of a clipboard pile.

Starting point

If your team is doing intake data entry after hours, that is the signal. The build connects your intake forms, your reminder channel, and your practice management system so the whole loop runs without someone driving it.

See the front-office playbook for how this fits with cancellations and recall, or get a breakdown for your practice. No call needed.

The AI Adoption Gap Between a 10-Person and a 100-Person Company

2026-08-22T00:00:00Z

There is a clean pattern in the small business AI data, and it is not the one people expect.

AI investment runs 24% at companies of 1 to 9 employees, 45% at 10 to 49, and 75% at 50 and up.Business.com / Dialog, 2026 Small Business AI Outlook, n=1,009

The easy read is that bigger companies have more money. That is not really it. AI workflow tools are cheap, and the smallest companies spend on software all the time. Something else separates the 15-person company from the 60-person one.

The real difference: someone owns the build

At a 60-person company, there is usually a person whose job includes operations, systems, or internal tooling. When a repetitive process shows up, that person can be asked to look at it: map the steps, evaluate a tool, build the automation, document it. It is part of their role.

At a 15-person company, that same work lands on a founder or an early employee who already has a full-time job. "We should automate onboarding" is a real thought that gets said in a meeting and then loses every week to the actual work. Nobody is assigned to it, so it does not happen.

The tools are equally available to both companies. The difference is that one of them has someone whose job is to turn a manual process into a workflow, and the other does not.

This shows up in the "why not" answers too

When non-adopters are asked why they have not started with AI, the top answer is not cost.

41% of non-adopters cite "unclear business application" as their blocker, ahead of privacy concerns and skills gaps.US Chamber of Commerce Foundation, Main Street AI Monitor, 2026, n=1,070

"Unclear business application" is what it sounds like when nobody has had the time to look at your processes and say "this one, these steps, automate it." A larger company has someone who does that looking. A smaller one usually does not, so the application stays unclear.

Closing the gap without adding headcount

You do not need to hire an operations person to get past this. You need to treat the first workflow the way a bigger company would: as a scoped project with an owner and an end date.

That looks like one of two things:

Give an internal person the time. Pick someone, pick one process, clear a few weeks of their calendar, and make the build their actual job until it ships.
Bring in a partner for the build. Someone maps the process with your team, builds the workflow, hands it back with documentation, and leaves. You get the outcome a larger company would get from an internal hire, without the salary.

Either way, the thing that changes is that identifying, mapping, and building the workflow becomes somebody's real job for a defined stretch, instead of a line item on a wish list.

Where to start

Pick the process that costs you the most time and follows the clearest rules. Onboarding, intake, lead handling, and recurring reports are the usual suspects. Map it, build that one, measure it, and use the result to decide what is next.

The AI Readiness Scorecard is a structured way to find your first candidate. The guide on getting started walks through the full method. No call needed for either.

Turn Support Tickets Into Product Signal Automatically

2026-08-26T00:00:00Z

Every B2B SaaS team says it is customer-driven. Then the roadmap gets set from the three loudest accounts, a competitor's release, and whatever the founder heard last week.

Meanwhile the most honest feedback you have is piling up in the support queue, unread in aggregate. Individual tickets get answered. The pattern across a thousand of them never gets seen, because reading a thousand tickets is nobody's job.

A workflow can do that reading.

What the workflow produces

It classifies every ticket as it comes in. Not just "bug" or "question," but the actual theme: which feature, which part of the flow, which kind of confusion. It reads the full text, so it catches what a rushed manual tag misses.

It aggregates. Over a week, it counts how often each theme shows up, whether it is trending up, and which customer segments it comes from.

It hands product a ranked summary. The top feature requests by volume. The bugs generating the most contacts. The friction points growing fastest. With example tickets attached so the team can read the real words.

It flags the outliers. A single ticket describing a security concern or a churn risk gets surfaced on its own, not averaged away.

Why this beats the current setup

Helpdesk tags depend on agents applying them consistently while clearing a queue. They rarely do, and the tag list was designed for routing, not for product planning. An AI classification step applies the same themes every time, and you can point it at your entire ticket history, not just what got tagged going forward.

It also closes the gap between support and product. Support has always known what customers complain about. Now that knowledge arrives in product's planning meeting as a ranked list instead of an anecdote.

What it does not do

It does not set the roadmap. Volume is one input. A request that shows up 200 times might be low value, and a request that shows up twice might be strategic. The summary tells you where to look. People still decide.

It does not replace customer conversations. It makes them sharper. You walk into an interview knowing the themes, so you spend the call on why instead of what.

Getting started

If your team has ever said "we should really do something with all this support data," this is the build. It connects your helpdesk to a classification step and a weekly report, and it can backfill from your existing ticket history so you get a trend line on day one.

See the guide for SaaS teams for how this fits with triage and churn signals, or get a breakdown for your stack. No call needed.