Can nurses use ChatGPT? What the ANA, your board, and HIPAA say about patient details

The Morse teamPublished November 4, 20268 min read

Nurses can use ChatGPT for studying, general drug and condition questions, and drafting templates, but as of November 2026 the American Nurses Association (ANA), the National Council of State Boards of Nursing (NCSBN), and HIPAA all lead to the same rule for patients. Nothing that could identify one goes into the consumer app. OpenAI's page on Business Associate Agreements (BAAs) lists none for Free, Plus, or Pro accounts, and its free clinician version isn't open to registered nurses.

This isn't medical or legal advice. It's about who can read what you type. We read the ANA's position statement on AI and its 2025 Code of Ethics, NCSBN's guide for nurses on social media, the HIPAA regulation on the government's eCFR site, OpenAI's help pages for ChatGPT for Clinicians, ChatGPT for Healthcare, and BAAs, Wisconsin's board of nursing newsletter, Washington's nurse title law, and the AI policies of two nursing schools, all on November 4, 2026. HHS's own HIPAA guidance pages returned an error that day, so we quote the regulation itself. OpenAI earns some credit here: its help pages say plainly which products come with a BAA and which features fall outside one.

Is it a HIPAA violation for a nurse to use ChatGPT?

It is if identifiable patient information goes into a consumer account. Your hospital or clinic is a covered entity, and HIPAA lets it hand patient information to a vendor only after it "obtains satisfactory assurance that the business associate will appropriately safeguard the information" (eCFR, 45 CFR 164.502). That assurance is a BAA, signed by someone with authority to sign for the organization. We explain the rest of HIPAA's reach from the patient's side in private AI for health questions.

HIPAA's minimum necessary rule has an exception nurses rely on every shift. The rule doesn't apply to "disclosures to or requests by a health care provider for treatment" (eCFR, 45 CFR 164.502(b)), which is why a full bedside handoff to the oncoming nurse is fine. The same report pasted into a chatbot isn't a disclosure to a provider, so the exception that covers handoff doesn't follow it there.

OpenAI's own products leave a staff nurse little room, and we cover how BAAs work in can therapists use ChatGPT for notes. As of November 4, 2026, ChatGPT for Clinicians, the free version an individual can sign a BAA for, is open only to "physicians (MD/DO), nurse practitioners (NP), physician assistants (PA), and pharmacists" (OpenAI), so registered nurses and LPNs can't use it. If your employer runs ChatGPT for Healthcare instead, check the feature before you type, since OpenAI says improved memory "is not covered under your BAA. PHI should not be entered when using this feature" (OpenAI).

What do the ANA and NCSBN say about nurses using AI?

The ANA says you're accountable for what an AI tool produces. Its position statement, effective 2022, quotes the Code of Ethics: tools "are adjunct to, not replacements for, the nurse's knowledge and skill. Therefore, nurses are accountable for their practice even in instances of system or technology failure" (ANA, via OJIN). The statement doesn't mention chatbots or generative AI.

The 2025 Code is closer to the point. It says the duty of confidentiality applies "in the work setting and off duty in all venues, including social media or any other means of communication." Information used for education or quality improvement "may be disclosed once anonymized" (ANA Code of Ethics, 3.1). Provision 7.5 warns that "it is not always clear when ML, augmented intelligence, and AI are being used to collect or use data" (ANA Code of Ethics, 7.5).

NCSBN, the national council of state boards of nursing, had no AI guide for individual nurses that we could find on November 4, 2026. Its guide to social media, dated November 2024, is the closest rule, and most of it applies to a chatbot as written (NCSBN). It calls it a "mistaken belief that it is acceptable to discuss or refer to patients if they are not identified by name, but referred to by a nickname, room number, diagnosis or condition." It says "Anything that exists on a server is there forever and could be retrieved later, even after deletion." And it lists the grounds on which a board may discipline a nurse for a disclosure, from "unprofessional conduct" to "breach of confidentiality," with outcomes up to "temporary or permanent loss of licensure."

Wisconsin's piece is an informational article posted by the state's licensing department, which says it isn't an endorsement by the state. It also says "Nurses should understand what data is being collected, how it is stored, and who has access."

What can you paste into ChatGPT for nursing notes?

The task, not the patient. HIPAA's Safe Harbor method lists 18 identifiers to remove, from names and "all elements of dates (except year)" to "any other unique identifying number, characteristic, or code" (eCFR, 45 CFR 164.514). The list never says "room number" or "bed number." NCSBN's guide says those still identify a patient, and so can a rare diagnosis on a small unit. Here is how that plays out in the documents nurses write.

Ask for the template, the explanation, or the plain-language version, then fill in the patient in the system your employer approved. A question about a drug interaction asked without the patient gets the same answer.

Can nursing students use ChatGPT for care plans?

Usually for the reasoning, never for the patient. Rutgers School of Nursing's policy, effective May 18, 2026, treats AI care plans as "drafts" only, bans entering "patient names, or clinical site details" into any AI model, and allows no AI at all in clinical logs (Rutgers), while UNC's School of Nursing tells students to follow the AI rules of their assigned clinical site (UNC). For what your school can see of your own AI use, read AI privacy for students.

Is it safe to ask ChatGPT questions during a shift?

General questions, yes, with two checks. First, the device: NCSBN tells nurses to follow employer policies on "employer-owned computers" and personal devices at work, and an employer can see more on its own machines than most people expect, as we cover in AI on a work laptop. Second, the account: a personal ChatGPT chat is kept on OpenAI's servers and, unless you turn it off, used for training, as we explain in does ChatGPT train on your data. Ask "What are the common side effects of amiodarone?" rather than describing the patient in bed 12, and check the answer against your facility's references, since the ANA holds you accountable for it either way.

How Morse keeps a nurse's drafting off someone else's servers

NCSBN put the root problem in one line: "Anything that exists on a server is there forever." A consumer chatbot keeps every question you ask on its servers, tied to your account. Morse is built so your chats don't sit there.

Patient information still belongs in your employer's approved systems. Morse doesn't claim HIPAA compliance or any certification, and no tool fixes a chat that names a patient. What Morse changes is where everything else goes: your study questions, your de-identified drafts, and the questions you'd rather not have on record.

• E2EE, for a de-identified case study or a care plan draft no one else should read. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can read it. Our servers relay text they can't read, and the reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed.
• Private, for NCLEX prep, pharmacology, and pathophysiology. Private is the default for a new chat, running open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing.
• Anonymous, to ask GPT, Claude, or Gemini a general question without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy.

In every mode, your chat history is stored in your browser, encrypted, not on Morse's servers, and unlocking it takes a key from your device and one from our server at sign-in. Morse doesn't train AI on your chats, sell your data, or show ads. A Temporary chat is kept in memory only, which suits a template you'll copy and close. Because we don't store chats, we usually have very little to give authorities. Clearing your browser deletes your chats for good, so keep anything you need in your own notes.

Try a chat from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.