What a medical practice can hand to AI without patient data

Four of the seven practice problems in my October 2026 map of 44 healthcare problems can go to AI tools that never read a patient record. They are checking what each payer pays you, keeping credentialing files and insurer directory listings current, keeping your online listings accurate, and drafting replies to online reviews. Prior authorization and claim denials need patient records from the first step, and for hiring I advise no AI tool at all.

That split matters because of HIPAA. A tool that never reads patient information needs no business associate agreement, the written contract HIPAA requires before an outside firm handles patient information on your behalf, so a practice can start with these four without one.

Which practice work can AI take on without patient records?

Four kinds of work, because each runs on contracts, staff records, public web pages or summary reports instead of charts and claims.

The first is checking what each payer pays. Medicare physician payment fell 33% from 2001 to 2025 after adjusting for inflation, the AMA calculates. A tool can compare your fee schedule with what each payer paid for each billing code, using summary payment reports, so you can see which plan pays least before its contract comes up for renewal. Medicare sets its own rates, so the comparison helps most with the plans whose contracts you negotiate.

The second is credentialing paperwork and the directories insurers publish. In a study published in May 2023, the Senate Finance Committee's majority staff called 120 mental health providers listed in the directories of 12 Medicare Advantage plans, trying to book an appointment for a relative. More than 80% of the listed providers they tried to reach were unreachable, not taking new patients or not in network. Each plan keeps its own directory, so a practice's part is keeping what it reports current, starting with each clinician's CAQH profile, the credentialing record clinicians share with health plans. CAQH asks clinicians to re-attest that profile every 120 days, or every 180 days in Illinois. A tool can check each clinician's file for missing documents and expiring licenses and keep watching those dates, and it reads staff records, never patient records.

The third is how new patients find you. About a quarter of dentists in private practice said they were not busy enough in the second quarter of 2026, the ADA's Health Policy Institute reports. A weekly check can confirm that your website and your Google listing show the same hours, insurance plans and clinicians, and it can draft posts for someone on your staff to approve. It reads only public pages.

The fourth is replying to online reviews, which has led to HIPAA settlements. HHS's Office for Civil Rights settled with a California dental practice for $23,000 in 2022 and with a New Jersey psychiatric practice for $30,000 in 2023, both over replies to online reviews that disclosed patient information. A tool can draft a reply that thanks the reviewer and invites them to call, without confirming they were ever a patient. Nothing posts until a person approves it.

Why do prior authorization and claim denials need patient data?

Because the first useful step in each reads a patient's chart or claim. In the AMA's survey of 1,000 physicians, released in May 2026, physicians reported completing an average of 40 prior authorizations a week, which take 13 hours of physician and staff time.

HIPAA lets a practice share patient information with an outside firm working on its behalf only under a written agreement, the business associate agreement. So before you buy an AI tool for either job, get that agreement in writing and test the tool on your own cases with patient details removed. How to score an AI vendor before the demo lists the questions to ask first.

One date matters for prior authorization tools. Under CMS's 2024 rule, Medicare Advantage plans, state Medicaid and CHIP programs and their managed care plans, and plans sold on the federal marketplace must run a prior authorization API, a connection that software can query, that lists the services each plan covers and the paperwork each request needs. The deadline generally falls on January 1, 2027, and the exact date varies by type of plan. Ask any prior authorization vendor whether its tool will use those connections.

Why leave AI out of hiring?

Because AI that screens or ranks job applicants now comes with legal requirements in some places, and a practice's job boards and hiring software already do most of the rest. The need is real: in a May 19, 2026 MGMA Stat poll with 297 responses, 56% of medical practices said hiring medical assistants had gotten more difficult in the past year. But New York City bars employers from using an automated tool to screen applicants unless the tool has had a bias audit within the past year. California's Civil Rights Council rules on automated decision systems in employment took effect on October 1, 2025. Job boards and applicant tracking software already post jobs and schedule interviews, so an AI screening tool would add those legal requirements and little else.

What do practices use AI for today?

A recent poll of dentists gives a detailed answer. In the ADA Health Policy Institute's poll for the second quarter of 2026, 43.3% of dentists in private practice said they currently use AI for at least one task in their practice, and another 26.4% said they plan to.

Dentists were more likely to use or plan to use AI for imaging and diagnostics than for any other task the ADA asked about, followed by three office tasks: insurance verification, charting and note taking, and billing and claims submission. All four read patient information, such as X-rays, chart notes, insurance details or claims, so a practice needs a business associate agreement with any vendor whose tool handles that information for it.

Where should a practice start?

Start with the problem on your own list that costs the most and reads no patient records. A tool for it needs no business associate agreement, and your staff can check its work against contracts, licenses and web pages they already know. Before anyone tries a tool on their own, write down which kinds of data staff must keep out of it.

If your partners and managers want to agree on that list together, the AI Leadership Workshop is a half day for $3,500, for a leadership team of up to ten. They leave with three to five AI uses ranked by cost and value and a one-page AI use policy draft, and a written 90-day plan follows within a week. The workshop needs no patient data and no business associate agreement.

How were the problems chosen and sorted?

For each of six kinds of healthcare organizations, I picked seven or eight problems that cost a lot of money or carry serious risk, using my own judgment, and checked one number for each at its source in October 2026. Practices here means physician groups, dental offices, behavioral health and therapy practices and other small clinical businesses. A problem counts as needing no patient data when every tool I'd advise for it reads only contracts, policies, staff records, public data, websites or summary reports, with nothing that identifies a patient.

Seven problems are a short list chosen by judgment, not a survey of practices, so your own list may differ. Needing no patient data also does not take HIPAA off the table, as the two review settlements show. The research page lists all 44 problems with their sources, and the post on the full map compares practices with the other five kinds of organizations.