Data safety

Is AI Safe for My Customer Data? Questions to Ask Before You Buy

A plain-English checklist of what to ask any AI vendor about ownership, storage, protection and contracts, with notes for medical, legal and financial offices.

By JBthaGREAT4 min read
A gold combination padlock resting on a computer keyboard next to a bank card
Photo: Towfiqu barbhuiya on Unsplash

You'd like AI to take work off your desk. But your files hold your customers' names, phone numbers and payment details. Maybe health records, case files or account numbers too. One careless tool, and you could be the one explaining to a customer where their information went.

Here's the short answer. Whether AI is safe for your customer data depends on the specific tool, and on how it stores, shares and protects what you give it. You find that out by asking specific questions and getting the answers in writing before you sign. Below is a checklist you can use with any vendor.

This is a checklist, not legal advice. If your business handles health, legal or financial records, take it to your lawyer or compliance person too.

Step 1: Know what data you'd be handing over

Before you talk to any vendor, write down what the AI would touch. All personal information needs protection. How sensitive it is depends on what it reveals and how your business uses it.

  • Names, contact details and appointments: these need protection too. In a covered medical or dental practice, a patient’s name and appointment linked to their care can be protected health information (PHI), even without a diagnosis.
  • Other sensitive records: payment details, Social Security numbers, health records, legal case files, bank or investment account details.

HHS explains that identifying details linked to health care can be PHI; a name or phone number on its own is not always PHI. For example, a patient’s name beside an appointment for care at your clinic can need HIPAA safeguards. Review that information and any required business associate agreement before an outside AI tool handles it. Do not wait until detailed health records are involved.

Step 2: Ask these questions, and get the answers in writing

The same 14 questions as the list below, in four groups.

Who owns it

  • Who owns the information I put in, and the results the AI creates from it?
  • Can I download all of my data at any time?
  • If I cancel, what happens to my data, how fast, and will you confirm it in writing?
  • Are the accounts in my business's name? The AI builder SuperDupr puts it plainly: the phone number, the AI provider account "and the data should be yours."

Where it goes

  • Where is my data stored?
  • Which other companies does it pass through to do the work?
  • Is my data used to train AI models? If it is, can I turn that off?
  • Which of your employees can see my data, and why?

How it's protected

  • Is my data protected with encryption, meaning scrambled so outsiders can't read it, both when it's stored and when it's sent?
  • Can I control which of my staff see which information?
  • Is there a record of who viewed or changed what, and when?
  • If there's a breach, how fast will you tell me, and how?

The builder Naurra.ai lists the same kinds of protection for regulated data: audit logs, encryption and access controls.

What the contract says

  • Is everything you just told me written into the contract?
  • If you handle health information for my practice, will you sign a business associate agreement? (More on that below.)

Red flags

  • The vendor won't answer in writing, or says "trust us."
  • They can't tell you where your data is stored.
  • The accounts would be in their name, or in someone's personal name, instead of your business's name.
  • They want you to paste sensitive customer information into a tool before any of these questions are answered.

If you run a medical or dental practice

Health information falls under HIPAA. The U.S. Department of Health and Human Services describes a "business associate" as a person or company that does work for a health care provider that involves "creating, receiving, maintaining, or transmitting" patient health information. HHS says the HIPAA rules "establish requirements" for business associate agreements, often called BAAs, between providers and those companies.

In plain terms: if an AI tool will touch your patients' health information, ask the company for a business associate agreement before any patient data goes in. If they won't sign one, don't use that tool for patient information.

If you run a law firm

You owe your clients confidentiality. Treat an AI tool like any outside company that would see client files. Ask every question on this checklist, and check what your state bar says about using AI with client information.

If you're a financial advisor

Client account details are sensitive information. Talk with your compliance officer before any client information goes into an AI tool, and keep the vendor's written answers with your records.

The bottom line

Used carefully, AI can take repeat work off your desk. Safety comes from asking the right questions first. Ask me every question on this list too. If you'd like help with an AI project that handles customer information, tell me what you want built, and I'll send you a custom quote. No sales calls.

This is a checklist, not legal advice.

Sources

Share this post

Keep reading