Sensitive benefits data does not belong in general AI tools
Jack D.
Read more
Holder's argument is that benefits and HR teams are routinely putting names, dates of birth, enrollment details, and member data into AI tools that were never built to hold them, usually without any bad intent — and that intent is not what HIPAA examines.
- The post sorts tools by plan rather than by quality: ChatGPT Free, Plus, Pro, and Team, and Claude Free, Pro, Max, and Team, are named as not compliant on standard plans, and Claude Cowork is described as excluded from any BAA.
- The rule given to readers is blunt: no personal data, no member data, no employee files.
- The reasoning also accounts for cost, not just policy — compliant enterprise versions require formal agreements, configuration, and commitments such as ChatGPT Enterprise's stated 150-seat minimum at roughly $108,000 a year, which the post calls unrealistic for most small businesses.
- The tension is deliberate: the tools are called genuinely amazing and readers are told to use them, while the same post says the compliant solutions built for this work are not these tools.
- The post closes by saying the writer is not a compliance attorney and readers should involve their legal team.
The post's picture of the problem is an Excel file of names, dates of birth, and benefits data, or enrollment information pasted into a chat window for a quick answer, happening every day.