American Academy of The Traffic Light: Know Your Zone
Before building or deploying any AI agent, locate your use case:
| Use Case | Dental Example | What It Takes | |
|---|---|---|---|
| 🟢 | No patient information involved | Website FAQ assistant (services, hours, insurance accepted) | Business/enterprise tier; confirm vendor data-use terms |
| 🟢 | Internal content from public information | Drafting social posts, patient education handouts | Same as above |
| 🟢 | Anonymized scheduling availability | Showing open slots without revealing patient identities | Same as above |
| 🟢 | Clinical reference without patient data | Asking about drug interactions, material properties, technique guidance | No PHI entered; verify no conversation logging for training |
| 🟡 | Accesses patient names/contact info | Appointment reminders, recall campaigns | Signed BAA; purpose-limited access; audit logging; no consumer AI accounts |
| 🟡 | Transcribes patient encounters | AI scribe during exams or hygiene visits | Signed BAA; patient recording consent; verified storage/retention; all-party-consent state laws addressed |
| 🟡 | Collects clinical information | Digital intake gathering medical/dental history | Full compliance stack: BAA, encryption, access controls, retention policy, security risk analysis |
| 🟡 | Reviews images or radiographs | Agent pre-screening X-rays for findings | BAA with imaging AI vendor; confirm where images are processed/stored; human dentist makes final diagnosis |
| 🟡 | Insurance verification | Agent checking eligibility and benefits | BAA; minimum-necessary data sharing; audit trail of each query |
| 🟡 | Treatment plan communication | Agent drafting treatment explanations for patients | BAA; human review before sending; no autonomous patient communication |
| 🔴 | Any PHI in a consumer AI account | Pasting patient notes into free ChatGPT, Claude, or Gemini | Do not do this — consumer tiers are never BAA-covered |
| 🔴 | Unsupervised clinical documentation | Auto-charting that writes directly to the patient record | Do not do this — require human review and confirmation |
| 🔴 | Autonomous patient messaging | Agent sending treatment recommendations or follow-ups without oversight | Do not do this — restrict to drafts requiring human approval |
| 🔴 | Assumed BAA coverage | "The vendor says HIPAA compliant" | Do not assume — verify the exact product, features, and configuration |
| 🔴 | Broad system access for narrow tasks | Reminder agent with full EHR read access | Do not do this — limit to minimum necessary |
| 🔴 | PHI transmitted to non-BAA subcontractors | Agent using a transcription API, analytics tool, or cloud function without BAA coverage | Do not do this — every handler of PHI needs contractual coverage |
The rule: Green means proceed with standard precautions. Yellow means stop — get privacy, IT, and legal review before deploying. Red means stop, period.