The Owner-Doctor’s 30-Minute AI and Data Checkup

You wouldn’t let a patient go two years without an exam.

Most practices go much longer than that without examining how they handle their own data, and the last year added a whole new category of things to check.

AI tools arrived. Vendors added features. Insurance questionnaires got longer. The rules stayed the same while the tools sprinted ahead.

This is a 30-minute checkup you can run yourself, in three parts. It won’t replace a real assessment. It will tell you whether you need one.

Ten minutes on AI

Grab a notepad and answer honestly.

Which AI tools are staff using today? Not the ones you approved. The ones in use. If the answer is “I don’t know,” that’s the finding.

Is there a written policy, even one page, that says which tools are allowed and what can never be pasted into them? Has anyone been trained on it?

For any AI tool that touches patient information, including scribes and the assistant inside your practice-management system, is there a Business Associate Agreement (BAA) that covers it? Is your data excluded from training the vendor’s model?

A passing score: an approved-tool list exists, a one-page policy exists and has been acknowledged, and every tool that handles patient data has an agreement you can locate.

Ten minutes on data

Now the data itself.

Can you produce a list of every place patient information lives? Practice-management system, imaging, email, cloud folders, phones, tablets, vendor portals, retired hardware, AI transcripts. If the list lives in someone’s head instead of a document, it doesn’t count.

Is there a named person responsible for deciding who gets access and for removing it when someone leaves? Is there a named person responsible for the technical protection of each location?

Is there a retention schedule, or is the policy “keep everything”? When was the last time anything was securely retired?

A passing score: a written inventory of where data lives, three named roles (owner, custodian, access approver), and a retention schedule someone actually runs.

Ten minutes on encryption

Last, the control that turns a stolen laptop into a paperwork problem.

Is every device that holds or reaches patient information encrypted? Laptops, front-desk computers, tablets, phones, including personal devices with practice email.

Can you or your IT provider produce a report, today, showing each device and its encryption status? Do you know where the recovery keys are stored?

Does email containing patient information get encrypted automatically, or does it depend on someone remembering to click a button? Is multifactor authentication on for every mailbox?

A passing score: a dated encryption report covering every device, keys escrowed somewhere the practice controls, and email encryption enforced by policy.

What the score actually tells you

Most practices, run honestly, don’t pass all three sections. That isn’t a failure. It’s the reason for the checkup.

What matters is which sections came up short and how far. A practice with a good inventory and no AI policy has an afternoon of work. A practice with no inventory, no encryption report, and a dozen unknown AI tools has a project, and it’s a project worth starting before the next renewal or the next lost device forces the issue.

The score is also a conversation starter with your IT provider. If they can’t help you produce the encryption report or the data inventory, that’s information about the relationship, not just about the practice.

Then book the real one

A self-checkup finds the obvious gaps. It doesn’t find the device nobody mentioned, the vendor feature that quietly turned on, or the shared folder with five years of scanned charts and no access controls.

That takes someone looking from the outside, with the tools to verify instead of ask.

We help owner-doctors turn this checkup into a full picture: an inventory of where data lives and which AI tools touch it, managed encryption with reports to prove it, and the policies and agreements that hold up when someone asks. It starts with a 10-minute discovery call, and it’s the most useful half hour a practice can spend before year-end.

Call us at 405-253-5101 or schedule a discovery call to get on the calendar.