Can dentists use ChatGPT? Radiographs, insurance narratives, and HIPAA in a dental office

The Morse teamPublished November 12, 202610 min read

Dentists can use ChatGPT for anything that leaves the patient out, such as a narrative template, a post-op handout, or a staff policy draft, but as of November 12, 2026 nothing that identifies a patient belongs in a consumer ChatGPT account, and dentists aren't on the list for OpenAI's free clinician version that comes with its own business associate agreement (BAA). OpenAI's page for ChatGPT for Clinicians names physicians, nurse practitioners, physician assistants, and pharmacists, and no dental license.

This isn't legal or medical advice. It covers who can read what your office types, and leaves diagnosis and treatment alone. On November 12, 2026 we read the US Department of Health and Human Services (HHS) guidance on business associates and de-identification, three HHS enforcement actions against dental practices, the American Dental Association's 2026 Code of Ethics, its AI standards page, its claim form instructions, and its February 2026 letter to HHS, the Idaho Board of Dentistry's AI policy, the DICOM imaging standard's privacy profile, and the BAA pages of OpenAI, Anthropic, and Google. ADA's own HIPAA resource page wouldn't load for us that day, so we don't quote it. OpenAI earns credit for plain wording. Its BAA page says outright which ChatGPT plans don't come with one.

Is it a HIPAA violation for a dental office to use ChatGPT?

It can be. HHS treats a vendor that handles patient information for your practice as a business associate, so identifiable information shouldn't go into an AI tool your practice has no BAA with. HIPAA covers a health care provider that "conducts certain standard administrative and financial transactions in electronic form" (HHS), and a practice that sends claims to dental plans electronically fits. HHS lists "claims processing or administration, data analysis, billing, and practice management" among the jobs that make a vendor a business associate, and its examples include a "chatbot on a provider's patient portal" that handles scheduling and reminders (HHS, last reviewed October 21, 2026).

The same HHS page says a provider that "submits a claim to a health plan" isn't the plan's business associate, so sending the narrative to the insurer needs no BAA. The chatbot that drafted it worked on your behalf with the patient's information, which is the kind of service that does need one.

Small practices get no pass. On October 8, 2026, HHS announced that Shen Smiles, a Pennsylvania dental practice, agreed to pay $140,000 after an investigation found it "failed to implement policies and procedures" required by the Privacy and Breach Notification Rules (HHS). That case was about a patient's request for records, not AI, but the duty to have written policies is the same one an AI rule for your staff belongs in.

Can dentists sign up for ChatGPT for Clinicians?

No, not as of November 12, 2026. OpenAI's page, updated the day before, says "Eligible clinicians currently include physicians (MD/DO), nurse practitioners (NP), physician assistants (PA), and pharmacists," and sign-up needs "A valid NPI" and a license its third-party verification provider can check (OpenAI). It's the one ChatGPT product an individual can sign a BAA for, which our page on whether pharmacists can use ChatGPT covers in more depth.

Abyde, the HIPAA vendor the California Dental Association endorses, wrote on CDA's site in August 2025 that ChatGPT offers "Business Associate Agreements on a case-by-case basis for paying customers using the ChatGPT API" (CDA). DentalBase's guide, updated September 29, 2026, puts ChatGPT Team in its table as usable "Only with a signed BAA," with "BAA varies" (DentalBase). OpenAI's own pages are stricter. "ChatGPT Team was renamed to ChatGPT Business on August 29, 2025" (OpenAI), and OpenAI's BAA page says "We do not offer a BAA for ChatGPT Business" (OpenAI). So a dental office paying for ChatGPT Business seats has no BAA to sign, whatever a guide's table says.

That leaves the organizational plans. OpenAI signs BAAs for Enterprise and Edu through sales and for its API through a self-serve flow that "requires an established history of API usage" (OpenAI), and Anthropic and Google cover business plans only after an administrator switches HIPAA coverage on. Our table of which AI companies sign a BAA lays out each one's covered plans and features.

Can you upload dental X-rays to ChatGPT?

Not into an account your practice has no BAA for, because an exported radiograph carries more than the image. The privacy profile of DICOM, the standard imaging software uses, lists the attributes a de-identifier has to remove or replace, among them "Patient's Name," "Patient ID," "Patient's Birth Date," "Institution Name," and "Device Serial Number." It also tells the de-identifier to make sure "no identifying information that is burned in to the image pixel data" remains (DICOM PS3.15 2026d).

Cone beam CT goes further. For "high-resolution cross-sectional imaging of the entire head and neck," the same standard notes that "a 3D volume or surface rendering of the pixel data may be sufficient to allow identification" (DICOM PS3.15 2026d). HIPAA's Safe Harbor list already counts "Full-face photographs and any comparable images" as an identifier (HHS), which covers a full-face extraoral photo.

The ADA's own standards ask for consent before images go into AI work. Its standard for AI validation datasets, ADA Standard No. 1110-1, includes "requirements for obtaining and maintaining patient permission for including images in the Dataset" (ADA), and its Code of Ethics lists "dental X-rays or copies of them" among the dental records a dentist must furnish to the patient or the patient's new dentist (ADA Code of Ethics).

What can a dental office paste into an AI?

The task, with the patient taken out. Safe Harbor lists 18 identifiers, and several of them hide in dental paperwork: "Health plan beneficiary numbers," "Device identifiers and serial numbers," "All elements of dates (except year)," and the identifiers of the patient's "relatives, employers, or household members" (HHS). The ADA's claim form puts several of them in one place. We read it and the records below against those rules on November 12, 2026.

Safe Harbor also requires that the practice not have "actual knowledge" that what's left could identify the patient (HHS). In a small town, a rare procedure and an age can be enough.

Can AI write dental insurance narratives?

It can draft the structure, and the dentist stays responsible for every word that goes to the payer. The ADA's Code of Ethics says a dentist who "incorrectly describes on a third party claim form a dental procedure in order to receive a greater payment" is making "an unethical, false or misleading representation" (ADA Code of Ethics, section 5.B.5). The claim goes out under the dentist's name, whoever wrote the first draft. Ask the chatbot for a template, then fill in the tooth, the dates, and the findings inside the system your practice has a BAA with.

Can front desk staff use ChatGPT to answer patient reviews?

Yes, if the patient's details stay out of both the prompt and the reply. HHS has settled with at least two dental practices over review responses. New Vision Dental in California paid $23,000 in 2022 over "the impermissible disclosure of patient protected health information (PHI) in response to online reviews" (HHS), and Elite Dental Associates in Dallas paid $10,000 in 2019 to settle "Social Media Disclosures of Patients' Protected Health Information" (HHS). Pasting the angry review and the patient's chart into a chatbot to get a reply puts PHI in two places: the AI company's servers and, if the draft repeats it, the public page.

Your front desk also works under the practice's agreements. HHS defines a business associate as someone "other than a member of the covered entity's workforce" (HHS), so a receptionist's personal ChatGPT account has no BAA behind it, whatever the plan.

What do the ADA and state dental boards say about AI?

They put the privacy duty on you and the tool's vendor both. The ADA's Code says "Dentists are obliged to safeguard the confidentiality of patient records," and when a dentist consults another practitioner and "the circumstances do not permit the patient to remain anonymous," the dentist "should seek the permission of the patient prior to the release of data" (ADA Code of Ethics, sections 1.B and 1.B.2). The Code doesn't mention AI. In its February 20, 2026 response to HHS, the ADA said "dentists and dental teams should be able to rely on technology vendors to deliver secure, compliant systems by default," and that adoption "remains uneven, particularly among small and mid-sized practices" (ADA News).

The most specific state rule we found is Idaho's. Its Board of Dentistry adopted a policy on AI in clinical practice on October 9, 2026, which says the board "does not preapprove individual technologies or clinical tools" (Idaho Board of Dentistry). It asks licensees: "Is the AI system capable of maintaining the confidentiality of protected health information?" and "Is a business associate agreement (BAA) needed to maintain HIPAA compliance, or is information appropriately de-identified before being entered?" One of its three conditions is that AI use "complies with all applicable federal and state data privacy and confidentiality laws." Check your own board's newsletter and rules too, since we didn't find a similar policy from another state board on November 12, 2026.

For how the same rules play out on a hospital unit, see can nurses use ChatGPT. An animal clinic runs on state law instead of HIPAA, which we cover in private AI for veterinarians.

How Morse keeps a dental office's drafting off AI company servers

A BAA exists because an AI company keeps and processes what your office sends it. Without one, every narrative template, review reply, and CE question your team types can sit on that company's servers under someone's personal login. Morse is built so your chat history stays in your browser instead.

Radiographs, claims, charts, and anything else that names a patient stay in your practice management and imaging software, or a tool your practice has a BAA with. Morse doesn't claim HIPAA compliance or any certification. It's for the rest of the AI work a dental office does.

• Private, for narrative templates, recall texts, and post-op handouts. New chats start in Private, on open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for a de-identified case write-up or an office policy no company should read. Your browser checks the enclave's hardware attestation, then encrypts the message on your device so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE has no web search, so start a separate chat for anything that needs a payer's current policy.
• Anonymous, to ask GPT, Claude, or Gemini a general question without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy, so the Safe Harbor table above applies in full.

In every mode, your chat history is stored in your browser, encrypted, and it locks when you sign out, so after that the next person at a shared front desk computer can't open it. Unlocking it takes a key that never leaves your device and one our server gives you at sign-in. Morse doesn't train AI on your chats, sell your data, or show ads. Because we don't store chats, we usually have very little to give authorities. Clearing the browser or deleting your account deletes the chats for good, so copy any template you want to keep into your own files.

Try a chat from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.