How a small Arizona medical practice can set AI rules staff will actually follow

A practice manager in Tucson or Sierra Vista notices something quiet happening at the front desk. Staff are pasting appointment notes into ChatGPT on their phones to tidy up wording, or asking it to summarize a list of call-backs. Nobody is doing anything malicious. There are simply no rules in place, so nobody knows what is fine and what is not. That gap, not the tool itself, is the actual risk.

A short acceptable-use list closes the gap. It is a one-page document that says three things: which tasks are fine to use AI for, which patient information never goes into an AI tool, and what a staff member does after a mistake. This article walks through how to write one and put it in front of your team.

What an acceptable-use list actually does

An acceptable-use list is exactly what it sounds like: a written list of the uses a practice accepts, and the ones it does not. It is not a compliance manual. It is shorter than that, and it has to be, because a rule staff cannot remember is a rule staff will break without noticing. One page, written in plain words, beats a binder that sits in a drawer.

The list does three jobs at once. It gives staff permission, so the honest ones stop guessing. It gives the practice a documented standard, which matters if anyone ever asks what your rules were. And it gives you a clean answer to the question every manager dreads: someone used AI with patient information by accident, and now what.

Where AI genuinely helps in a small practice

The useful ground is administrative work with no patient identifiers in it. That includes drafting the wording for a general reminder card, summarizing a policy into plain English for staff training, rewording an office sign, or writing a social media post about flu season. It also includes the many small writing and organizing tasks that eat a front desk day: turning rough notes into a clean agenda, drafting a job description, or cleaning up an internal checklist.

The line that matters is simple to state: if the text could identify a patient, it does not go in. Names, dates of birth, chart numbers, appointment details tied to a specific person, photos, and insurance details all stay out. Staff can still use AI on the tasks above, because those tasks work fine with the identifying details stripped or left out entirely. The framework here is the practice's to fill in. No regulator source supplies an approved task list for clinical staff, so the practice should settle the final list with its own counsel and its own compliance obligations in view.

Who this works for, and who it does not

This approach fits a small owner-led practice where the manager knows every employee by name and a one-page list can actually be read aloud at a staff meeting. It works for clinics, medical and wellness practices, and similar local businesses across Arizona, whether that is Phoenix, Tucson, Sierra Vista or a smaller town.

It does not replace legal review. If your practice already has a compliance officer or sits under a large system, the acceptable-use list should be written with them, not around them. And if your practice has a vendor agreement that already covers AI use, read that first, because this list sits underneath whatever that agreement requires.

Draft the list in one sitting

You can draft the thing in one working session. The steps below produce a first version you can hand to counsel for a read-through.

The mistake protocol, in plain words

The mistake step deserves its own paragraph, because it is the part most lists skip. The instruction is short: if you paste something you should not have, tell your manager the same day. Say what you pasted and into which tool. The practice then handles it as an incident, which may mean reviewing the account settings or the vendor's data handling, and it decides next steps with counsel.

The reason to write it this way is human. If reporting a mistake gets someone in trouble, the next mistake gets hidden, and a hidden mistake is worse than a reported one. A one-sentence rule that reporting is expected and not punished does more for safety than three pages of prohibitions.

When a practice wants help doing this with the team

Some practice managers would rather have someone walk the team through this hands-on than hand out a page and hope it lands. AZ AI Lab runs AI Training for Business: hands-on sessions built on the work the team actually does, on Zoom, for one owner, a small group or a whole team. Sessions run 90 minutes and up, and people leave with take-home routines and safe-use ground rules, plus a follow-up check-in. For a practice, a session like this is a natural place to introduce the acceptable-use list and practice it on real tasks. The first step is a free 25-minute fit call that looks at two tasks that repeat in the week and picks a first result worth having, and replies come within one business day.