Consumer chatbots and QME files: what not to paste
Short version: nothing from a QME file goes into ChatGPT Free, Plus, Pro or Business, Claude Free, Pro, Max or Ultra, or Gemini on a personal account. None of those plans has a BAA, and stripping the names does not make a QME file safe, because the dates, the EAMS case number and the claim number identify the worker too.
Limits: We read each product's own pages and the DWC sources on 2026-11-12 and did not upload records to any product. Prices, plans and rules change, and nothing here is legal advice; ask your own counsel about Labor Code 4628.
What is unsafe to paste from a QME file
Everything that came with the case or that you created about the worker. In a QME practice that means:
- Any page of the records, including the records log the claims administrator attaches under 8 CCR 35(c).
- The parties' cover letters and advocacy letters. They carry the worker's name, date of injury, employer, claim number and the EAMS case number (the "ADJ" number).
- Deposition transcripts, sub rosa reports and job descriptions.
- Mental health records. 8 CCR 35(c) keeps some of them from being served on the worker directly; they still reach you, and they are among the most sensitive pages in any file.
- Your exam notes, dictation audio and draft report, including the discussion you want "tightened up".
- The DWC forms you complete for the case, such as the QME Form 111 findings summary in an unrepresented case.
What is safe on any plan: questions with no worker in them. "Summarize the literature on cumulative trauma and carpal tunnel." "Explain the difference between ML-201 and ML-202." "Rewrite this paragraph I wrote about a hypothetical lumbar fusion." Turn model training off anyway.
Why removing names does not de-identify a QME file
HIPAA's Safe Harbor method lists 18 identifier types. 3 of them sink most QME redaction attempts:
| Safe Harbor identifier | Where it hides in a QME file | Why redaction fails |
|---|---|---|
| All elements of dates except the year | Date of injury, every visit, every MRI, the exam date the report must state | A QME opinion runs on dates: onset, treatment course, P&S date, period of temporary disability. Strip them and the file is useless. |
| Any other unique identifying number or code | The EAMS ADJ case number, printed on cover letters, WCAB papers and many records | WCAB decisions are published under ADJ numbers, so the number leads back to the case. |
| Account and health plan numbers; geography smaller than a state | Claim numbers, employer address, the city in every clinic letterhead | Letterheads repeat on hundreds of pages; manual redaction misses some. |
Source: HHS de-identification guidance, captured 2026-11-12. HHS also says the Privacy Rule does not apply to workers' comp insurers, agencies or employers unless they are covered entities for other reasons, so the carrier's own handling is not your test. Yours is whether you are a covered entity, which you are if your practice bills health plans electronically.
BAA availability by vendor and plan, as of 2026-11-12
| Vendor | Plans with no BAA | Plan that carries a BAA | Who can sign it | Source, captured |
|---|---|---|---|---|
| OpenAI | ChatGPT Free, Plus, Pro, Business | ChatGPT for Clinicians; ChatGPT for Healthcare; Enterprise with Regulated Workspace; API with Modified Retention | A verified US clinician (Clinicians, free); an organization (the others) | help.openai.com, 2026-11-12 |
| Anthropic | Claude Free, Pro, Max, Ultra; Team not listed | HIPAA-ready Claude Enterprise; Anthropic API | An organization's Primary Owner; Enterprise has a 20 seat minimum | privacy.claude.com, claude.com/pricing, 2026-11-12 |
| Gemini on a personal account | Gemini app and Gemini in Workspace on a Workspace account (not Gemini in Chrome) | Your Workspace admin, by accepting the BAA | support.google.com, workspace.google.com, 2026-11-12 | |
| Microsoft | Not stated on the page read | Microsoft 365 Copilot and Copilot Chat on a work account | Any covered entity customer: the BAA comes by default in Microsoft's Online Services Data Protection Addendum | learn.microsoft.com, 2026-11-12 |
| OpenEvidence | Not applicable | Standard BAA for covered entities | The covered entity using it | openevidence.com, 2026-11-12 |
Even on a BAA plan, coverage stops at the listed features. Anthropic excludes beta features such as Claude in Office. OpenAI says a feature being available does not by itself mean a connected third-party service is covered. Google says human reviewers read some personal-account Gemini chats and keeps reviewed chats for up to 3 years, and tells users not to enter confidential information.
Can I paste this? A checker for 12 QME documents
Pick the document and the plan. The answer follows the rules on this page. It runs in your browser and sends nothing.
Pick a document and a plan.
Questions about chatbots and QME records
Is ChatGPT Plus HIPAA compliant for a QME?
No. ChatGPT Plus is not on OpenAI's HIPAA eligible list, so OpenAI will not sign a BAA for it. ChatGPT for Clinicians, which is free for verified US clinicians, is the OpenAI plan a solo QME can use under an individual BAA.
Can I use Claude Pro for QME reports if I remove the worker's name?
No. Claude Pro has no BAA, and a QME file without names still carries dates, the EAMS case number and claim numbers, which are identifiers under HIPAA's Safe Harbor method. Anthropic offers a BAA only on its HIPAA-ready Enterprise plan and its API.
Does HIPAA apply to a QME at all?
HHS says the Privacy Rule does not cover workers' comp insurers, agencies or employers unless they are covered entities for other reasons. A QME whose practice bills health plans electronically is a covered entity, so treat the QME file as PHI and get a BAA from any AI vendor that will hold it.