When your practice's AI hits its usage limit, shadow AI becomes a HIPAA risk

It's Monday afternoon and the front desk is buried in patient portal messages. The practice's AI assistant has been drafting replies all morning, until it stops: usage limit reached, try again later. Twenty messages are still waiting.

So a staff member opens a free AI chatbot on her phone, pastes in a patient's message with name, symptoms and medication list, and gets a draft in seconds. The patient gets a fast reply. The practice has just disclosed protected health information to a vendor with no business associate agreement.

As practices build AI into daily operations, this scenario is becoming more likely. The interruption slows the team down. The workaround can turn into a HIPAA incident.

Why AI tools run out

AI tools measure work in tokens, small pieces of text that are often part of a word. Everything counts toward the total: the question, any attached document, the running conversation history and the answer. Business plans include an allowance, whether the vendor calls it tokens, credits or messages.

Those allowances are shrinking relative to demand. Fast Company reported that AI companies are tightening token limits as computing capacity grows scarce and expensive. Vendors, including Microsoft, have moved some AI features to credit-based, usage-based billing with administrator spending limits.

At the same time, users are consuming more. Forbes reported in April that people are exhausting allowances faster than ever as they hand AI longer, multistep tasks and larger documents. In a medical practice, that means summarizing lengthy records, drafting referral letters and working through a full inbox of portal messages.

What happens at the limit

Depending on the tool and plan, one of three things usually happens.

• Work stops. New requests are blocked until the allowance resets or an administrator raises it. IT Brew reported one consultant waiting 13 hours for tokens to refresh.
• Costs climb. Overage billing keeps the tool running, then shows up on the next invoice.
• Staff improvise. Busy employees switch to free personal AI accounts to keep patients moving.

The third outcome is known as shadow AI: AI tools used for work without the practice's approval or oversight. It carries a specific problem in health care. Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on a practice's behalf generally must sign a business associate agreement. Free consumer AI tools typically do not offer one.

The financial stakes are significant. IBM's 2025 Cost of a Data Breach Report found that 63% of the breached organizations it studied had no AI governance policy, and that high levels of shadow AI added about $670,000 to the average cost of a breach. Health care remained the costliest industry for breaches in that report, at an average of $7.42 million.

Eight steps for practice leaders

Practice owners and administrators can reduce the risk without giving up the efficiency AI provides.

1. Inventory every AI tool in use. Ask clinical and front-office staff what they use, including browser extensions and phone apps. Confirm the answers with network traffic reports.
2. Approve only tools that fit HIPAA. Choose business-grade AI with administrator controls, and confirm a signed business associate agreement before any protected health information goes in.
3. Right-size the allowance. Review usage monthly. Set spending caps and alerts so the practice learns about a limit before staff hit it during clinic hours.
4. Write an AI acceptable use policy. Name approved tools, prohibit patient information in anything else and spell out what staff should do when a limit is reached. Many policies skip that last instruction.
5. Make escalation fast. A same-hour way to request more capacity keeps staff from going around the rules.
6. Restrict unapproved AI on practice devices. Web filtering and data loss prevention tools can block or flag patient information headed to unknown AI services.
7. Train for efficient use. Staff should start a new chat for each task, include only the relevant parts of a record and use lighter models for simple work.
8. Add AI to the contingency plan. The HIPAA Security Rule already requires a contingency plan. Document a manual workflow for every AI-assisted process.

Preparing for patient questions

Patients are paying attention to how practices use AI. Front-desk staff and clinicians should be ready with consistent answers.

If a patient asks whether health information goes into AI tools, the answer should be that only approved tools covered by a business associate agreement are used and that personal or free AI accounts are prohibited. If a patient asks whether AI makes decisions about care, the answer is that AI supports administrative tasks, while clinicians review and make every care decision. And if a patient asks what happens when the system is down, staff should be able to say that every AI-assisted task has a manual backup, so appointments and refills are not delayed.

The bottom line

Every practice that relies on AI will eventually hit a usage limit, often on its busiest day. Whether that moment becomes a privacy incident depends on planning done in advance: approved tools, adequate capacity, a clear written policy and a safe path for staff when the tool says no.

Scott Carr is the owner of Farmhouse Networking, a managed IT services provider in Grants Pass, Oregon, that supports more than 80 businesses, including independent medical practices. He has more than 30 years of experience in network and computer systems architecture, cybersecurity and IT compliance.