Can HR use ChatGPT? The rules that follow employee records into an AI chat
The Morse teamPublished 10 min read
HR can use ChatGPT for drafting that names no employee, but a personal ChatGPT, Claude, or Gemini account is the wrong place for the records HR holds. As of November 2026, an accommodation request has to be kept in "separate medical files," a family medical history in FMLA paperwork is genetic information whose permitted disclosures are a closed list, and information on a Form I-9 "may be used only for enforcement" of immigration law and a few criminal statutes. Each of those rules travels with the record into a chat window.
This isn't legal advice. It covers privacy while you use AI for HR work, not how to run an HR process. On November 9, 2026, we read the ADA, GINA, FMLA, and HIPAA regulations, the Form I-9 rule, and the FTC's disposal rule in the eCFR, FCRA section 604 on Cornell's Legal Information Institute, the California Privacy Protection Agency's FAQ, the GDPR on EUR-Lex, Illinois Public Act 103-0804, New York City's Local Law 144 page, the EEOC's January 2026 release, and the data pages of OpenAI, Anthropic, and Google. The AI companies earn some credit. All three publish what they keep and for how long, and Google's privacy hub tells you outright what not to type.
Is it safe to put employee data into ChatGPT?
Not into a personal account. OpenAI's help center says that on Free, Plus, and Pro, "we may use your content to train our models," unless you turn off Improve the model for everyone under Settings > Data controls. Even after you opt out, rating a reply with a thumbs up or down means "the entire conversation associated with that feedback may be used to train our models" (OpenAI, read November 9, 2026). A saved chat stays on your account until you delete it, and then OpenAI schedules it for deletion "within 30 days." If you saved an uploaded file to Library, "Deleting a chat does not delete a separately saved file" (OpenAI).
Claude and Gemini have their own versions. On Claude's consumer plans, a chat you rate with a thumbs up or down is stored "for up to 5 years" (Anthropic), and a chat flagged under the usage policy is kept "for up to 2 years" (Anthropic). Google says human reviewers, including "trained reviewers from our service providers," read some Gemini chats, keeps reviewed chats "for up to three years," and asks: "Please don't enter confidential information that you wouldn't want a reviewer to see" (Google).
Work accounts are a different contract. OpenAI doesn't train on ChatGPT Business or Enterprise by default and will sign a Data Processing Addendum for both (OpenAI). Anthropic says it won't train on "Claude for Work" by default (Anthropic), and Google says Workspace prompts aren't "human reviewed or otherwise used for Generative AI model training outside your domain without permission" (Google Workspace). Those plans keep chats away from the AI company's training, and your employer can still export them, as we cover in is ChatGPT Business private.
Can HR put medical or accommodation information into AI?
Not when it identifies the employee. The ADA rule says information about an employee's "medical condition or history" shall be "collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record." It allows three exceptions: supervisors may learn of "necessary restrictions" and "necessary accommodations," first aid and safety staff may be told when a condition "might require emergency treatment," and government officials investigating compliance get relevant information (29 CFR 1630.14). An AI company isn't on the list.
FMLA paperwork carries a second layer. Certifications and "medical histories of employees or employees' family members" are confidential medical records kept "in separate files/records from the usual personnel files" (29 CFR 825.500(g)). A family member's diagnosis on that form is "family medical history" under GINA (29 CFR 1635.3), and GINA says an employer "may not disclose it except" to the employee, a health researcher, a court order, compliance investigators, and a short list of others, in files kept separate "including where the information exists in electronic forms and files" (29 CFR 1635.9).
The guides ranking for this question on November 9, 2026, such as Ziplines, list "Medical information and accommodation details" among what to remove before prompting. None of the guides we read names GINA. A caregiver's leave request can be genetic information even when the employee's own health never comes up.
Can you upload I-9s to ChatGPT?
No. The I-9 rule limits what the form is for. "Any information contained in or appended to the Form I-9, including copies or electronic images of documents" used to verify identity or work eligibility "may be used only for enforcement" of the Immigration and Nationality Act and four sections of the federal criminal code (8 CFR 274a.2(b)(4)). Checking a stack of forms with a chatbot is not one of them.
The same section says an employer that keeps I-9s electronically needs "an effective records security program" that "ensures that only authorized personnel have access to electronic records" and logs who accessed each record (8 CFR 274a.2(g)). Forms are kept for three years after hire or one year after employment ends, "whichever is later." A copy in a chatbot's history is a copy outside that program, on a schedule the employer doesn't set.
Can AI summarize a background check?
Not in a personal account. A background check from a screening company is a consumer report under the Fair Credit Reporting Act, which already requires a stand-alone written disclosure before an employer gets one (15 U.S.C. 1681b). The FTC's disposal rule then says anyone who holds consumer information "for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access" (16 CFR 682.3). You can shred a printout. A chat you pasted it into sits on the AI company's servers until its own retention rules remove it.
In the EU, a criminal record check falls under GDPR Article 10, which allows processing "only under the control of official authority" or where EU or member state law authorises it with "appropriate safeguards" (GDPR).
What about investigation notes and harassment complaints?
Keep them out of a personal account, and expect less federal guidance than older articles cite. On January 22, 2026, the EEOC voted 2-1 to rescind its 2024 Enforcement Guidance on Harassment in the Workplace, and its release says the underlying laws "remain firmly in place" (EEOC). The confidentiality you promised the complainant and the witnesses comes from your company's own complaint policy, set with its lawyers.
When counsel directs an investigation, the notes may be privileged, and sharing them with an outside company can put that at risk. How courts have treated AI chats in litigation is in can AI chats be subpoenaed.
Does CCPA or GDPR cover employee data in AI tools?
Yes. The California Privacy Protection Agency says the CCPA's rights reach "California residents that are employees or job applicants," and that the exemptions for employment-related personal information "expired on December 31, 2022." It adds that the law "imposes separate obligations on service providers and contractors" who process personal information for a business (CPPA). A vendor your company contracted with has those obligations. A personal chatbot account you signed up for yourself doesn't make the AI company your employer's service provider.
The GDPR asks for the same contract in more detail. Article 28 says a controller "shall use only processors providing sufficient guarantees," and that processing by a processor "shall be governed by a contract" setting out the data, the purpose, and the controller's instructions. Article 9 bars processing data on health, trade union membership, and other special categories unless an exception applies, and Article 88 lets member states set "more specific rules" for employees' data (GDPR).
Do you have to tell employees when HR uses AI?
In Illinois, yes, since January 1, 2026, for decisions about their jobs. Public Act 103-0804 makes it a civil rights violation for an employer "to fail to provide notice to an employee that the employer is using artificial intelligence" with respect to recruitment, hiring, promotion, discipline, discharge, or "the terms, privileges, or conditions of employment." The Act's definition of artificial intelligence "includes generative artificial intelligence," which covers a chatbot drafting text from your prompt. It leaves the timing and form of notice to the Illinois Department of Human Rights' rules (Illinois General Assembly).
So a performance review or a discipline memo drafted in ChatGPT can bring a notice duty in Illinois, on top of every privacy rule above.
What HR can paste into AI, by document
We applied each rule's text, read on November 9, 2026, to the documents HR handles most. "Personal AI" means a ChatGPT, Claude, or Gemini account your employer hasn't approved.
| What it is | The rule that follows it | A safe way to use a personal AI with it |
|---|---|---|
| Accommodation request, doctor's note, or fitness-for-duty result | ADA: separate medical files, disclosed only to supervisors, safety staff, and investigators (29 CFR 1630.14) | Ask about the process ("What does an interactive process meeting usually cover?") with no condition, name, or job title |
| FMLA certification or leave for a family member | FMLA confidential records; GINA's closed list for family medical history (29 CFR 1635.9) | A general question about leave timelines, with no certification in it |
| Form I-9 and copies of passports or green cards | Use limited to immigration and listed criminal enforcement; authorized-personnel security program (8 CFR 274a.2) | Nothing from the form. Ask about the rule itself, with no name, number, or document image |
| Investigation notes and complaints | Company complaint policy; privilege if counsel directs the investigation | An interview outline for a kind of complaint, with no names, dates, or team |
| Background check report | FCRA and the FTC disposal rule (16 CFR 682.3); GDPR Article 10 in the EU | A question about how the adverse action steps usually run, with no report in it |
| Salaries, bonuses, and pay bands | CCPA for California staff, GDPR in the EU, and your company's confidentiality policy | Ranges and levels with no names, and no level that holds one person |
| Performance reviews and improvement plans | CCPA and GDPR; Illinois notice when AI is used for discipline or promotion | A structure with [EMPLOYEE] placeholders, filled in inside your HR system |
| Handbook, policies, and job descriptions with no one named | Your company's AI policy | All of it, in any tool your company allows |
How Morse keeps your own HR drafting off a chatbot's servers
Every rule above is about a readable copy of an employee's record, held by a company your employer never contracted with, under that company's consumer terms and retention clock. Morse is built so your chats don't sit on our servers. Your chat history is stored only in your browser, encrypted, our servers don't keep your messages or log what you write, and Morse doesn't train AI on your content, sell your data, or show ads.
That doesn't make Morse a vendor your employer approved. Records with an employee's name, health, immigration status, or history in them stay in your HR system and the AI tools your company signed for, and whether any of it may go into Morse is your employer's call. Morse is for the work that's yours: a policy draft, a template with placeholders, a hard conversation rehearsed with no names, or a question about your own job.
- E2EE, for a de-identified draft no one else should read. Your browser checks the secure enclave's hardware attestation, then encrypts the message so only that enclave can read it, and our servers relay ciphertext they can't read. The reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek, without web search or image generation.
- Private, for handbook sections, job descriptions, and training materials. New chats start in Private, on open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing (what zero data retention means).
- Anonymous, to ask GPT, Claude, or Gemini about a rule without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the text and may keep it for a limited time to check for abuse, under its own policy, so keep to the last column of the table.
A Temporary chat is kept in memory only, which suits a draft you'll paste into your HR system and close, and attached files are sent with the message and never stored by Morse. Your history locks when you sign out, and unlocking it takes two keys, one of which never leaves your device. Because we don't store chats, we usually have very little to give authorities (privacy policy). Clearing your browser deletes your chats for good, and Morse can't recover them, so keep the finished document in your own files. Use your own device and a personal email to sign in, since a work laptop has its own monitoring, as our work laptop guide explains.
Try a chat from the Morse home page without an account, or start free with no card. End-to-end encrypted chats come with Pro, at $19 a month.
Common questions
Does HIPAA cover the employee medical records HR keeps?
Usually not. HIPAA's definition of protected health information excludes health information "in employment records held by a covered entity in its role as employer," so the ADA, FMLA, and GINA rules above are the ones that follow an accommodation file.
Is ChatGPT's Temporary Chat safe for employee information?
It keeps the chat out of your history and out of training, but OpenAI says it "may keep a copy for up to 30 days for safety purposes." The text still sits with OpenAI under your personal account's terms, with no contract with your employer.
Can HR use AI to screen resumes in New York City?
Only with extra steps. Under Local Law 144, an automated employment decision tool needs a bias audit within one year of use, a public summary of the results, and notice to candidates, which New York City began enforcing on July 5, 2023.
Can an employee find out whether HR put their information into an AI tool?
In California, employees and job applicants have CCPA rights since the employment exemptions expired on December 31, 2022. In the EU, GDPR's right of access includes "the recipients or categories of recipient" the data was disclosed to.