Solo OT: AI appeal letters, 5 PHI questions

A denial notice has been sitting in your inbox since Tuesday. The appeal needs a clinical narrative, the right codes and a tone that does not read as furious, and it is 6:40pm with three notes still open. A general AI chatbot could draft it in two minutes. The catch comes with its first request, which is for the facts, and the facts are a patient's name, dates and diagnosis. Pasting them into a chat window is a disclosure of protected health information to a third party, and as a solo practitioner you have no compliance officer to ask.

Here are five questions in the order solo OTs tend to ask them, answered from the text of the HIPAA rules and the Medicare appeals rule.

A note on sources: the HIPAA and Medicare rule text below was read on the eCFR in October 2026. HHS guidance pages and vendor help pages could not be opened in this session, so nothing here describes a specific chatbot product's current terms.

Can I use an AI chatbot to write an insurance appeal letter for a patient?

Yes, for the drafting. The HIPAA question is what goes into the chat window. An appeal is a payment activity: the rule defines payment to include a provider's activities to obtain reimbursement, such as billing, claims management, collection and "review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges" (45 CFR 164.501, read on the eCFR in October 2026). A covered entity may use or disclose protected health information for its own payment, and may disclose it to another covered entity for that entity's payment activities (45 CFR 164.506(c), October 2026). Sending the appeal to the payer needs no patient authorization.

The chatbot is a separate recipient with no role in paying the claim. Whether it may receive patient details depends on the next two answers.

So what for you: the permission to appeal does not extend to every tool you use to write the appeal, so treat the chatbot as its own question.

Is an AI chatbot a business associate under HIPAA?

It can be. The definition in 45 CFR 160.103 (October 2026) turns on whether a person creates, receives, maintains or transmits protected health information on your behalf, other than as a member of your workforce. A company that takes in your patients' details to help with your payment work is on the wrong side of that line unless the paperwork says otherwise.

The paperwork is specific. A covered entity may disclose protected health information to a business associate if it obtains satisfactory assurance that the associate will safeguard it, and that assurance must be documented in a written contract or other written agreement (45 CFR 164.502(e), October 2026). The contract must establish the permitted uses and disclosures and require appropriate safeguards (45 CFR 164.504(e)(2), October 2026). Minimum necessary also applies. The rule requires reasonable efforts to limit protected health information to the minimum necessary, and its exceptions cover treatment disclosures, disclosures to the patient, authorizations and legal requirements, but not payment work (45 CFR 164.502(b), October 2026).

We could not open HHS or vendor help pages in this session, so we make no claim about any chatbot product's current terms. Ask the vendor for a signed business associate agreement and for the list of products and settings it covers, and read the answer before you paste anything.

So what for you: if you cannot show a signed agreement for the exact product you are typing into, assume you do not have one and use the method in answer 4.

What counts as de-identified when I paste in a patient's details?

Information that does not identify a person is outside the rule, and the Safe Harbor method says how to get there. It lists 18 identifiers that must be removed, for the patient and for relatives, employers and household members (45 CFR 164.514(b)(2)(i), October 2026). The ones that catch appeal letters are names, "all geographic subdivisions smaller than a State", "all elements of dates (except year)", telephone, fax and email, health plan beneficiary numbers, account numbers, and "any other unique identifying number, characteristic, or code". The condition on top is that you have no actual knowledge that what remains could identify the patient (45 CFR 164.514(b)(2)(ii), October 2026).

Dates are the trap. An appeal naturally says the evaluation was on 3 March and the last visit on 28 May. Under Safe Harbor both are identifiers, and so is the claim number, the member ID and the town. A distinctive story counts too: a rare diagnosis in a small community can identify a child even with every field blanked.

So what for you: a letter can be fully de-identified and still be useful, but only if you describe the timeline as visit 1, visit 12 and week 6 instead of calendar dates.

How long do I have to appeal a Medicare denial?

Treat the chatbot as a drafting assistant for the argument and keep the identifiers for yourself. Five steps work for a one-person practice.

First, write a skeleton with tokens in place of the identifying fields: [PATIENT], [DOB], [MEMBER-ID], [CLAIM-NO], [DOS-1], [DOS-LAST], [PAYER-REF]. Second, paste only the clinical reasoning with no identifiers: functional limits in plain terms, the goals, standardized measure results, why the skilled service was needed, and the payer's stated denial reason. Third, ask for a letter that keeps every token exactly as written. Fourth, do the find and replace on your own computer, then read every sentence against the chart, because you are signing it. Fifth, file the final letter and the denial notice in the patient record.

Check the draft for leftovers too. If the narrative still carries a town, a school, an employer or an unusual detail, take it out before you paste, since the no-actual-knowledge condition applies to you.

So what for you: build the skeleton once, and reuse it for every denial.

What should I check before I send an AI-drafted appeal?

Check the deadline first, because a chatbot does not know it. For a Medicare redetermination the request must be filed within 120 calendar days of receiving the initial determination notice, and receipt is presumed five days after the date on the notice unless there is evidence to the contrary (42 CFR 405.942, October 2026). That rule covers Medicare. Commercial plans set their own windows in the contract and the denial letter, so use the date and address printed on your notice.

Then check the facts. A fluent draft can state a test score, a guideline or a code you never supplied. Delete any sentence you cannot trace to the chart or the denial notice, and confirm the denial reason in your letter matches the one the payer gave.

So what for you: the deadline and the facts are yours, and the chatbot only supplies the sentences.

The call we would make

Frankly, use the chatbot for appeals, and use it through the placeholder method until you hold a signed business associate agreement for the exact product you use. The evidence points to a simple split. The argument can be written by software, the identifiers stay on your machine, and the signature, the deadline and the facts stay with you.

Put the skeleton letter in a folder this week, before the next denial arrives, so the 6:40pm decision is already made.

This is general information, not legal advice. HIPAA obligations depend on your status as a covered entity, state law and payer contracts, so confirm with counsel or your compliance adviser before acting.

Related: ChatGPT or an AI scribe: the BAA question  ·  Free AI scribe BAA check  ·  Prior authorization questions for OT and SLT