Safe and Approved Use of AI Tools at UCI Health

As the use of artificial intelligence (AI) tools continues to expand across healthcare, the Office of the Chief Information Security Officer (CISO) and the Compliance & Privacy Office want to reinforce clear expectations for how AI tools may and may not be used at UCI Health.

At this time, only the AI tools listed below are approved for use with Protected Health Information (PHI) or any other restricted UCI Health data. Entering patient data or restricted information into unapproved or personal AI tools, even for drafting, summarization or rephrasing, may result in an unauthorized disclosure and must be avoided.

What this means for UCI Health co-workers and care providers

• PHI and restricted data must not be entered into any external or consumer AI tools.
• Claims that an AI tool is “HIPAA compliant” do not mean it is approved for use at UCI Health.
• Copying information from Epic or other clinical systems into AI tools is not permitted.
• Use of AI tools with PHI may be treated as a privacy incident and subject to review.

Permitted AI use (non-PHI only)

UCI Health provides access to certain AI-enabled tools that may be used only for non-PHI, non-restricted work, such as administrative tasks, general writing, or de-identified content:

• ZotGPT for non-PHI use (chat.zotgpt.uci.edu)
• Teams AI and Zoom AI, when signed in with your hs.uci.edu account and using the correct licensed features

These tools are not approved for entering PHI or restricted information unless explicitly stated as part of an approved clinical workflow.

Permitted AI use for PHI

The following tools are permitted for use with PHI when signed in with your hs.uci.edu account and using the correct licensed features:

• Abridge, within approved clinical documentation workflows

• Epic-embedded AI features, where enabled, including DynaMedex and Dyna AI (more.ebsco.com/Dyna-AI.html) for clinical decision support. AI-generated documentation must be reviewed, edited, and validated in the same manner as copied or templated material. Providers remain fully responsible for verifying the accuracy, relevance and clinical appropriateness of all AI-assisted content prior to signing the note.

Prohibited uses

The following tools are not approved for any clinical uses and should not be used with any UCI Health data:

• UCI Health does not currently have any approved Doximity tools. Doximity Dialer for phone or video visits should not be used for any communications. Appropriate replacements are Epic VoIP and Epic Secure Chat and Epic native video or audio visits.
• Do not use, enter or share PHI or other clinical queries to any Large Language Models (LLMs) or AI programs, including DoxGPT, ChatGPT or OpenEvidence. Uses of such tools is an Information Security & Privacy violation. We currently do not have any HIPPA-compliant LLM tools available at UCI Health but are actively working towards enabling such tools in the future.

What’s coming next?

To reinforce awareness and accountability, UCI Health will soon introduce a warning and acknowledgment page when accessing certain external AI tools from UCI-managed systems. When UCI Health co-workers or care providers navigate to a site categorized as an AI tool, they will be briefly redirected to a reminder page that: 

• Outlines expectations for the safe use of AI at UCI Health
• Reminds users that PHI and restricted data must not be entered into AI tools
• Directs users to approved alternatives, including ZotGPT, for non-PHI generative AI use
• Logs user acknowledgment for audit purposes, including username, the destination URL and the site category 

After reviewing the reminder, users may click Continue to proceed to the site or return to the previous page. This page is intended to educate and promote safe use — not to block legitimate non-PHI activities.

What UCI Health co-workers and care providers need to do now

• Do not enter PHI or restricted data into AI tools
• Use approved alternatives only for non-PHI purposes
• Report suspected or accidental disclosures through established incident reporting channels

Related policies

• BFB-IS-3: Electronic Information Security
• Viewing Acceptable Internet Usage
• Safeguards for Protection of Patient Information

Protecting patient information is a shared responsibility.