Skip to content

[DRAFT] [COMP-001]: AI Usage & Data Privacy Policy

Effective Date: September 2026 | Version: 1.0 | Approved by:

Field Value
Department Compliance / Operations
Who is it for? All office and field staff using AI tools
Systems Used Approved AI tools; Friction Log (shared private doc)
Primary Metrics Friction Log review completion; policy exception rate
References FirstLight confidentiality / PHI expectations
Video Walkthrough N/A

1. Purpose

Ensure responsible use of AI tools while protecting client confidentiality, reducing compliance risk, and preventing PHI/PII exposure that could harm clients or the agency.

2. Compliance

No Protected Health Information (PHI) or Personally Identifiable Information (PII) may be entered into public AI tools. Follow HIPAA-aligned confidentiality expectations, FirstLight Home Care requirements in the Operations Manual - V2.pdf, and the Franchise agreement. Violations are handled under our compliance policy and may result in disciplinary action.

3. Prerequisites

  • Understanding of what counts as PHI/PII for home-care operations
  • Access only to AI tools that leadership has allowed for business use
  • Access to the Friction Log for uncertain cases
  • Role-appropriate authorization to handle client or caregiver data (outside AI tools)

4. Steps

Prohibited data

  1. Never enter names, addresses, phone numbers, medical records, or any data that could identify an individual into public AI tools (including but not limited to ChatGPT, Gemini, Claude, etc.).

Allowed use

  1. Use AI for general business queries, workflow assistance, and code generation that do not involve client-specific data.
  2. Limit AI inputs to summaries or anonymized data that cannot be traced back to a patient or client.

Friction Log habit

  1. Log uncertainty in the Friction Log whenever you are unsure whether information is permissible.
  2. Wait for compliance review before proceeding if the Friction Log entry is unresolved.

5. Escalation

If you suspect PHI/PII was entered into an AI tool, or a request conflicts with this policy:

  1. Stop further use of that prompt/session for the sensitive content.
  2. Notify the compliance officer (or your manager if the compliance officer is unavailable).
  3. Document what happened in the Friction Log / incident path directed by compliance.
  4. Resolve only with authorized direction.
  5. Record corrective action as required by compliance.

6. Communication Scripts

Phone

"I can’t put client or caregiver identifying details into an AI tool. I’ll either anonymize the question or escalate it through the Friction Log / compliance."

SMS

"Don’t paste client names, phones, addresses, or clinical details into ChatGPT/Gemini/Claude. Use the Friction Log if unsure."

Email

"Subject: AI use — PHI/PII reminder

Do not enter PHI or PII into public AI tools. For borderline cases, add an entry to the Friction Log for weekly compliance review."

7. Records

Action System of Record Evidence Produced Owner
Log uncertain AI use question Friction Log Friction Log entry Staff
Weekly Friction Log review Friction Log / compliance notes Guidance or permission Compliance officer
Policy violation handling Compliance process Case / disciplinary record Compliance

8. Metrics

Measure Target / Control Frequency Owner
Friction Log review All open entries reviewed Weekly Compliance officer
SOP compliance sample Sample AI-related workflows Monthly Compliance
Exceptions / violations Trend/review Monthly Compliance

Last reviewed: September 2026

9. Resources