Is health data in ChatGPT protected by HIPAA? Usually not. By Open Door Salon · October 17, 2026 Usually not. When a patient puts their own medical records or symptoms into ChatGPT, Claude or another consumer AI app, that information generally leaves HIPAA, which covers health plans, most healthcare providers and the companies that handle patient data on their behalf. Paul Uhrig, a healthcare lawyer and former Chief Legal and Digital Health Officer at Bassett Healthcare Network, said on Open Door Salon that outside HIPAA the governing rules are the Federal Trade Commission's and some state laws, so protection depends largely on what the app's maker says it does with the data. The FTC explains its side in its guidance on consumer health information outside HIPAA. Lori Ellis asked whether people outside healthcare understand that once information goes into a chatbot it is no longer theirs in the same way, and who should be explaining it to them. Uhrig and Eddie Qureshi, founder and CEO of Rainfall Health, answered from the legal side and the patient side. When does health data leave HIPAA? When the patient moves it to an app that HIPAA does not cover. Uhrig framed it as a long-running question about where the line sits: When is data in the HIPAA world, right, as you suggested, and then when is it outside of the HIPAA world, which is what happens when I put my data into an app. He said most patients know the law exists but not where it stops: I think a lot of patients at least have some familiarity with HIPAA, but this information goes outside of HIPAA. Who decides what happens to the data? The patient, to start with. Qureshi said the fundamentals are those of a consumer, and the people around the patient are advisors rather than owners: You are a steward and a guide regardless of whatever you do, whether you're the administrator, whether you're the clinician. Ultimately it's the patient's choice. He added that patients increasingly act like consumers because they see the contrast with other parts of their lives: products delivered in hours, their own health data taking months. What protects health data outside HIPAA? Mostly the vendor's own representations, with the FTC and state laws behind them. Uhrig said the problem to solve sits under the non-HIPAA scheme, governed by the FTC and some state laws, and comes down to one thing: It really gets down to what is the vendor saying. He was careful not to paint the industry as a whole as the risk: Many vendors are obviously honorable. They have limited uses of the data. They're upfront about it and they comply with it. The concern is the minority who are not, which connects to the bad actors the conversation opened with. Health data can also matter well beyond the individual, as its earlier post on why anonymized clinical data is a national security risk explains. Why don't consent screens protect patients? Because almost nobody reads them, including the experts. Uhrig described a scene he has watched repeatedly: Open Door Salon all click through the consents in these apps. I accept it, right? He said he has heard privacy experts admit at conferences that they do not read the terms either and simply hit accept, and that the room laughs because everyone recognizes it. His conclusion was that the laughter points at something that needs fixing: People are ill-informed as to what someone may be saying they're doing with that data, right? Do patients know their data leaves HIPAA? Often not, which was the premise of Lori Ellis's question. Talking with people outside life sciences and healthcare, she said, she wonders whether the industry assumes a level of understanding the public does not have: that once information goes into Claude or ChatGPT, even something as ordinary as a slide deck, it is no longer entirely yours. Uhrig agreed it was not an easy question, and said the gap has two levels. The first is regulatory: the information is now under a different scheme from the one patients have heard of. The second is practical: the disclosures meant to explain that are long and go unread. What would better consent look like? Shorter, plainer and enforced. Uhrig said the explanation should not run to 30 pages, and put the rest as three questions: How do Open Door Salon simplify it? How do Open Door Salon put it in plain English or other relevant languages here in the United States? And then who's going to enforce it, right? A clear disclosure only protects a patient if someone checks that the data is used for the stated purposes and no others. Who should educate patients about this? The conversation did not settle on a single owner, and Uhrig called it a hard question. The pieces he described point to shared work: vendors that state their data use plainly, regulators that enforce it, and health systems that talk with patients about the tools they already use. For what hospitals are accountable for after surgery, see its earlier post on what the CMS TEAM model asks of hospitals. Companies that want to reach the leaders who follow this conversation can learn about sponsoring Open Door Salon. This post is drawn from the recorded, on-the-record conversation between Lori Ellis, Paul Uhrig and Eddie Qureshi on Open Door Salon.

7 recent hospital, health system CFO exits. By: Madeline Scheetz Sept. 11-2 1. Sergio Melgar, CFO of Worcester, Mass.-based UMass Memorial Health will retire in January 2027 after 12 years in the role. Jeff Biesczat, who joined the system in early September, will succeed Mr. Melgar. 2. Alec King, executive vice president and CFO, will succeed David Callender, MD, president and CEO of Houston-based Memorial Hermann Health System, when he retires at the end of the year after seven years leading the system. 3. Kim Cummings, CFO of Meadowbrook, Pa.-based Redeemer Health, will resign at the end of September. The system's former CFO Michael Keen has returned to the role. 4. Shasta Manuel exited her role as CFO of the Oklahoma and Mid-Missouri region of St. Louis-based SSM Health to move into a senior leadership position at SSM Health. Mike Milligan succeeded her. 5. Craig Faerber exited his role as CFO of Cooperstown, N.Y.-based Bassett Healthcare Network. Michael Gomez succeeded him as senior vice president and CFO. 6. Jeremy Alexander was appointed permanent president and CEO of West Burlington, Iowa-based Great River Health. He succeeds Michael McCoy, MD, who resigned July 23 for personal reasons. Mr. Alexander had been serving in the role on an interim basis while continuing his responsibilities as CFO. 7. Mike Ostrander is exiting his role as CFO of Gloversville, N.Y.-based Nathan Littauer Hospital & Nursing Home. Aug. 14-Sept. 1 1. Matt Kinsella, regional CFO within St. Louis-based SSM Health, is stepping into a new role at Livonia, Mich.-based Trinity Health. 2. Taylor Boyle has exited her role as market CFO for Sentara Health in Norfolk, Va. 3. Jared Chaffin, CEO and CFO of Friend, Neb.-based Warren Memorial Hospital resigned amid allegations made by the state's auditor of public accounts that he charged more than $38,000 in improper expenses to hospital credit cards. 4. Bob Flannery has shared plans to retire as CFO of Madison, Wis.-based UW Health on Jan. 8, 2027. July 29-Aug. 6 1. Rhonda Deskins has retired as CFO of Tennova Healthcare-North Knoxville Medical Center in Powell, Tenn. 2. Andrew DeVoe, executive vice president and CFO of Burlington, Mass.-based Tufts Medicine, shared plans to leave the health system, effective Sept. 30. He will join Albany (N.Y.) Med Health System as its new executive vice president and CFO. 3. Andy Zukowski has exited his role as CFO of Greenville, N.C.-based ECU Health after four years with the system. Brian Dunn will succeed Mr. Zukowski as CFO. 1. Ric Magnuson exited his role as interim executive vice president and CFO of Vancouver, Wash.-based PeaceHealth. Matt Swafford will succeed him. 2. Dan DeBarba, CFO of New Hyde Park, N.Y.-based Northwell Health's Connecticut and Hudson Valley region, was appointed president of Northwell's Norwalk (Conn.) Hospital. 3. Maia Healy exited her role as CFO of The George Washington University Hospital in Washington, D.C., which is operated by King of Prussia, Pa.-based Universal Health Services. 4. Tyler Williams was named interim CEO of DeFuniak Springs, Fla.-based North Walton Doctors Hospital. June 15-July 1 1. Doug Gaston, senior vice president and CFO of Kansas City-based The University of Kansas Health System, shared plans to step down from his role. Monica Lubeck will succeed him as system CFO. Mr. Gaston will continue to support critical projects to ensure a smooth transition. 2. Cheryl Wathen will retire as senior vice president and CFO of Evansville, Ind.-based Deaconess Health System after more than 36 years with the system and 16 years as CFO. Alice Rigdon will succeed Ms. Wathen, effective in fall 2026. 3. Tommye Rena Wells will retire as CFO of Cookeville (Tenn.) Regional Medical Center. 4. Aaron Lewis, CFO of Brentwood, Tenn.-based Lifepoint Health, was appointed system president and COO. 5. Doug Shirley, CFO of Louisville, Ky.-based ScionHealth, was named system CEO. April 23-June 12 1. Joe Tallon, CFO of Salina (Kan.) Regional Health Center, retired in July. He will be succeeded by Dianna White, who will begin her new role in August. 2. Kolin Huth, CFO of Maquoketa, Iowa-based Jackson County Regional Health Center, was promoted to CEO. 3. Mellissa McAvoy, CFO and COO of Millinocket (Maine) Regional Hospital, was promoted to the hospital's CEO. 4. Linda Hoff will retire as executive vice president and CFO of Palo Alto, Calif.-based Stanford Health Care at the end of fiscal 2026 after nine years with the system. Ms. Hoff will be succeeded by Adam Horst, effective June 8. 5. Jeff Sandene, executive vice president and CFO of Charleston, W.Va.-based Vandalia Health, started his new role June 1 as president and CEO of the system. Pat Keel succeeded him. 6. Derek Miller exited his role May 6 as senior vice president and CFO of Dothan, Ala.-based Southeast Health. Kathy Hill will succeed Mr. Miller as CFO under the succession plan. March 12-April 14 1. Henry Capote, CFO of HCA Florida Highlands Hospital in Sebring, Fla., was promoted to CEO. 2. William Klutkowski retired as senior vice president and CFO of Paramus, N.J.-based Valley Health System after nearly 31 years with the system. Christopher Tascione succeeded him. 3. Aaron Bloomquist retired July 3 as CFO of Waconia, Minn.-based Ridgeview. 4. Lynn DeJaco retired as CFO of Chattanooga, Tenn.-based Erlanger. Stephanie Gary has succeeded Ms. DeJaco. 5. Lugene Inzana retired Feb. 1 as CFO of Portland-based Maine Medical Center and associate CFO of Portland-based MaineHealth. Jan. 12-March 9 1. Greg Hoffman retired in June as executive vice president and CFO of Renton, Wash.-based Providence. 2. Aldwin Lindsay, executive vice president and CFO of Washington, D.C.-based Children's National Hospital, retired in April. 3. Dean Ohmart retired as vice president of financial services and CFO of Warrensburg-based Western Missouri Medical Center. Lacey Bredenhoeft-Fiene succeeded Mr. Ohmart. 4. Shelby Arveson exited her role as CFO of Providence South Division in Southern California. Tuesday, October 6 12:00 PM - 1:00 PM CDT Presenters: Amanda Whitener, nimble solutions|Chris Ballentine, nimble solutions Next up in executive moves. * 61 recent hospital, health system executive moves Hospitals and health systems began 2026 with a flurry of executive moves. Since Jan. 1, Becker's has tracked more than... Kelly Gooch and Kristin Kuchno * Community Health Network names Oracle Health exec digital chief Ed Simcox has been named executive vice president and chief digital technology officer of Indianapolis-based Community Health Network. Mr. Simcox... By: Naomi Diaz * 5 recent hospital, health system CFO moves Here are the hospital and health system CFO moves that Becker's has reported on in 2026: Sept. 28-Oct. 2 1. George Sprinkel... By: Madeline Scheetz