Use AI Tools Safely: The De-Identification Workflow for PT Documentation

What This Does

This guide teaches you a practical workflow for using consumer AI tools (ChatGPT, Claude) to draft clinical documentation without entering protected health information (PHI) — so you get the time savings of AI drafting while staying on the right side of HIPAA.

Before You Start

• You have a free ChatGPT or Claude account at chatgpt.com or claude.ai
• You understand that consumer AI tools are NOT covered by a HIPAA Business Associate Agreement (BAA) — meaning you cannot enter patient names, dates of birth, addresses, phone numbers, or other direct identifiers
• You have a patient session ready to document (fresh from treatment, while details are in mind)

Steps

1. Identify the PHI you need to remove

Before typing anything into an AI tool, check your notes for these direct identifiers:

• Patient name → replace with "Patient" or "45-year-old female"
• Date of birth → replace with age only ("58-year-old")
• Specific dates → replace with relative timing ("6 weeks post-op," "3rd visit")
• Treating physician name → replace with "referring orthopedic surgeon"
• Clinic-specific identifying details → omit entirely

2. Write your de-identified prompt

Translate your real patient info into a de-identified description. Instead of: "Write a SOAP note for John Smith, DOB 3/15/1968, seen today 3/20/2026, referred by Dr. Jones at Orthopedic Associates..."

Write: "Write a SOAP progress note for a 58-year-old male, 4 weeks post right total knee replacement. Objective: quad strength 3+/5, knee flex AROM 98°, tolerated 15-min stationary bike, SLR 3x15..."

3. Get your AI-drafted note

Paste the de-identified prompt into ChatGPT or Claude. The AI generates a complete note without any PHI in the output.

4. Add PHI back in your EMR

Copy the AI-drafted note language into your EMR (WebPT, Clinicient, etc.). Now add the PHI that belongs there: patient name, visit date, provider credentials, and any identifying details required for your documentation.

What you should see: A complete, properly formatted note in your EMR with accurate clinical language (from AI) and accurate patient-specific identifiers (that you added directly into the EMR).

Real Example

What NOT to type into ChatGPT: "Write a note for Mary Johnson, 72 Oak Street, DOB 1/4/1975, seen 3/20/2026 at Valley PT clinic..."

What TO type into ChatGPT: "Write a PT SOAP progress note for a 50-year-old female with lumbar stenosis, 8th visit. Subjective: reports 3/10 pain today, able to walk 2 blocks before symptoms. Objective: standing lumbar extension AROM 15°, neural tension negative, walked 10 min on treadmill at 2mph, core stabilization exercises 3x10. Plan: progress to walking 15 min next visit, add unloaded bike."

What you get: Complete note draft — no PHI included, safe to generate via consumer AI.

Tips

• Develop a personal shorthand for de-identification — "F58 TKR 4wk" is faster to type than the full description and still gives the AI enough context.
• If your clinic uses Microsoft 365 for email and documentation, ask your IT person about enabling Microsoft Copilot with a BAA — this gives you AI assistance inside Word and Outlook with HIPAA compliance built in.
• WebPT's native AI features (when available in your subscription) are the gold standard for HIPAA-compliant in-EMR AI assistance — no de-identification needed.
• Build the de-identification habit before starting the note, not as an afterthought — it takes 30 seconds extra at the start but prevents compliance errors.

This workflow reflects best practices as of early 2026. Consult your compliance officer or legal counsel for definitive HIPAA guidance. AI tool BAA availability changes — check each provider's current enterprise offerings.