You have a denial letter sitting in front of you and you want ChatGPT or Claude to help you write an appeal or explain the denial code. But you pause. That letter has a patient name, a date of birth, an account number, maybe a member ID. Can you even paste that into an AI tool without breaking HIPAA (the federal law that protects patient health information)?
Here is the short answer. HIPAA rules follow the data, not the tool. If the information you paste is properly de-identified, meaning it no longer contains anything that could identify a specific patient, it is no longer considered PHI (protected health information). Once it is not PHI, you do not need a BAA (business associate agreement, a signed contract that lets a vendor legally handle PHI on your behalf) to use a general AI tool on it.
That is genuinely good news for busy billing teams. It means you do not have to wait on legal review or a vendor contract to get help drafting an appeal letter or understanding a confusing remark code. You just have to scrub the note first.
HIPAA Follows the Data, Not the Tool
A lot of practice managers assume that any AI tool touching billing information automatically requires a BAA. That is not quite right. The requirement is tied to whether the data itself qualifies as PHI, meaning information that can identify an individual and relates to their health or payment for care.
Names, dates of birth, exact service dates, account numbers, phone numbers, and addresses are all identifiers. Strip those out correctly and what is left, things like CPT codes (the codes describing procedures performed), denial reason codes, payer names, and dollar amounts, is generally not identifying on its own. That text can be pasted into a general AI assistant without triggering a BAA requirement, as long as the de-identification was done properly and consistently.
This is one of the reasons AI is becoming such a practical tool for everyday billing work. We covered the bigger picture in How AI Is Transforming Medical Billing in 2026, but de-identification is the piece that makes casual, day-to-day use of tools like ChatGPT or Claude actually safe.
The Scrub Then Restore Workflow
The workflow is simple once you understand it. You scrub the identifiers out before you paste anything into an AI tool. You get your answer, your draft appeal, your explanation of a denial code. Then you restore the real identifiers back into the final document on your own computer, never inside the AI chat itself.
Here is what that looks like in practice:
- Scrub: Replace patient name, date of birth, account number, and any other identifier with a placeholder like PATIENT-1 or ACCT-001.
- Ask: Paste the cleaned note into ChatGPT or Claude and ask your question, draft your appeal, or ask it to explain the denial.
- Restore: Swap the placeholders back to the real patient details in your own document, outside the AI tool, before it goes anywhere near a claim or a payer.
This same logic applies whether you are trying to speed up a single appeal or building a repeatable process. If you are also looking at how AI fits into denial work more broadly, our post on How AI Reduces Medical Claim Denials by 60% walks through where automation helps most.
Why Dates Should Become Day Intervals
Here is a detail that trips people up. If you just delete dates entirely, you lose the ability to reason about timely filing (the payer's deadline for submitting a claim after the date of service) or how many days are left before a deadline hits.
The fix is to convert dates into intervals instead of removing them. For example, instead of listing the actual date of service and the actual denial date, you would note that the claim was denied 42 days after the date of service, and that there are 18 days remaining before the timely filing deadline. Those numbers still let ChatGPT or Claude do useful math and reasoning about deadlines, but they no longer reveal an actual identifiable date tied to a real patient.
This one change is what makes de-identified notes still useful for real billing work, instead of just generic, stripped-down text. It preserves the clock without preserving the calendar.
A Free Tool That Never Uploads Anything
I built a free browser-based scrubber at scrub.getautomatedrcm.com because I kept doing this process by hand and wanted something faster. It runs entirely inside your own browser on your own computer. Nothing gets uploaded to a server, including mine. You paste your note in, it finds and replaces identifiers with placeholders, and you copy the cleaned version out to use wherever you need it.
It is a genuinely free tool, not a trial or a lead magnet in disguise. I built it because this is the exact bottleneck that keeps billing teams from using AI tools with confidence, and it seemed worth solving simply.
Always Review Before You Paste, and When a BAA Is Still Right
Even with a scrubber, make it a habit to read through the cleaned text before you paste it anywhere. Automated tools are good but not perfect, and a quick human glance catches anything that slipped through, like a phone number buried in a free-text note or a nickname used instead of a full legal name.
There are also situations where de-identification is not the right tool for the job, and a signed BAA with an AI vendor is the correct path instead. If your work is genuinely identifier-heavy, meaning you need the AI tool to actually see real names, real dates, and real account numbers together to do its job, like bulk eligibility checks or full claim scrubbing across your whole patient list, that is a BAA situation, not a scrub-and-restore situation. Trying to force that kind of work through de-identification usually creates more manual work than it saves.
If you are weighing AI tools generally against your current manual process, our comparison in AI vs Manual Medical Billing: The True Cost Comparison is a good next read, as is What is RCM Automation? A Plain-English Guide if you are trying to figure out where automation fits in your workflow at all.
If you want a second opinion on where your billing process has the most room for improvement, whether that is denial patterns, clean claim rate, or AI readiness, our free Billing Health Check is a no-pressure way to see where you stand.
Frequently Asked Questions
Can I legally paste billing notes into ChatGPT without a BAA?
Yes, if the notes have been properly de-identified first, meaning names, dates of birth, account numbers, and other identifiers are removed or replaced. Once information is not PHI, HIPAA's BAA requirement does not apply, because the rule is tied to the data itself, not the AI tool being used.
What is the safest way to de-identify PHI before using AI medical billing tools?
Use a scrub-then-restore workflow. Replace identifiers like patient name, date of birth, and account number with placeholders before pasting into the AI tool, get your answer or draft, then restore the real details afterward on your own computer, never inside the AI chat itself.
Why should dates be converted to day intervals instead of just deleted?
Deleting dates entirely removes your ability to calculate timely filing deadlines or days remaining to appeal. Converting dates into intervals, such as days between service and denial or days left to file, preserves that timing math while still removing the actual identifiable date.
When do I actually need a BAA instead of de-identifying data?
You need a BAA when your work genuinely requires the AI tool to see real identifiers together, such as bulk eligibility checks or full claim scrubbing across a whole patient list. In identifier-heavy situations like these, de-identification adds too much manual overhead and a signed BAA with the AI vendor is the more practical, compliant path.