Anyone whose work carries obligations about what can leave the room.
You handle information that has rules attached, and you don't know if AI just broke them.
There are rules about what you're allowed to share.
The tools everyone else is using weren't built with your obligations in mind. You know that, which is why you haven't used them for the work that matters. That's the right instinct — and it's also why you're behind on the part that would help.
You get an agent that runs on your own infrastructure and holds your working knowledge — the way you draft, what you've decided before, the research you've already done — and does not hold the material you're obligated to protect. Not “shouldn't.” Cannot. The exclusion is built into the path data takes to get in, before the agent ever sees it.
Separately, each is common. Together, they are what a regulator, a card network, or opposing counsel would ask about first — and 500–5,000 records under those rules is the scope behind the question.
Section 09 of your report. Which rules apply is your counsel's call; we build to them and document that we did.
Is ChatGPT HIPAA compliant?
The tool isn't the question — the arrangement is. What matters is what you put in, under which terms, with which agreement in place. Your survey shows what your people actually put in.
Can I use AI with client data?
Sometimes, with boundaries written down and the right terms. Which rules apply to your business is your counsel's call; we build to them and document that we did.
What happens if information already went into a tool?
You find out what and when, then decide: notify, restrict, or accept it on the record. The report starts that.
What does it cost?
Survey and report free. Training will be $75 per person with the policy included, when it opens; anything built is quoted after an assessment.
The record: what the agent was allowed to see, written before it saw anything, and a log of what it did with it. When someone asks how you met your obligations, that is the answer, in your AI workspace.
Why the record matters