Knowing what not to put into public AI chatbots is an important first step before employees use them for everyday work. A prompt can include much more than a question: it might contain a customer message, a copied document, or details that identify a patient or employee. Treat anything entered into a public tool as information shared with an outside service, unless your organization has confirmed how that specific tool handles it.
This does not mean employees must avoid AI altogether. It means setting practical boundaries, choosing approved tools, and replacing real sensitive details with safe examples. A simple red, amber, and green checklist can help staff make that decision.
Red: Keep these details out of public chatbots
Do not paste information that could identify a person, provide access to an account, or reveal confidential business activity. This includes direct identifiers and combinations of details that could point to someone, even if a name is omitted.
- Customer information: names, contact details, account or order records, private correspondence, payment details, and information about a customer’s circumstances. A shop employee, for example, should not paste a real customer’s order history to ask for help drafting a reply.
- Patient and health information: patient notes, appointment details, test results, insurance information, or any other information that could identify a patient. A clinic should use an approved process rather than placing a real patient note into a public chatbot.
- Employee and payroll records: Social Security numbers, compensation, banking details, performance reviews, leave information, disciplinary records, or other private HR material.
- Credentials and security details: passwords, access keys, recovery codes, account numbers, network diagrams, security configurations, or details about an unpatched system. Never ask a chatbot to troubleshoot by sharing a live password or secret key.
- Confidential business material: unpublished plans, trade secrets, source code, internal financials, contracts, and nonpublic proposals. A document can be confidential even if it does not contain personal information.
- Information entrusted by someone else: donor files, legal-client documents, vendor records, or data covered by a confidentiality commitment or contract. A nonprofit’s donor list and a professional firm’s client document are examples to keep out of a public tool.
These examples are meant to help staff recognize risk, not to define every organization’s obligations. Information can be sensitive because of who it concerns, what it reveals, or the promise under which it was received.
Amber: Pause and check before using it
Some tasks involve information that may be confidential even when it appears ordinary. A draft contract, internal meeting notes, a vendor quote, or a spreadsheet without obvious identifiers could still expose business plans or private relationships.
Before entering this material, employees should check the organization’s approved AI tools and data rules. Approval of a tool does not automatically mean every kind of information is appropriate for it. The organization should specify which tool is allowed for each type of work and what data restrictions apply.
Health-related information needs particular care. HIPAA does not apply to every organization or every health-related detail; whether it applies depends on the organization and its role. Other privacy, security, contractual, or workplace requirements may still matter. When in doubt, do not paste the information. Ask the person responsible for privacy, security, or compliance.
For general background on safeguarding personal information in Florida, review Florida Statutes Section 501.171. This article is practical guidance, not a legal interpretation of how the statute applies to a particular business.
Green: Safer ways to use AI for routine work
Employees can often get useful help without sharing real customer, employee, or company records. The key is to describe the task while leaving out information that identifies people or exposes confidential operations.
- Use synthetic examples. Replace real people and records with made-up details that do not correspond to actual customers or staff.
- Generalize the scenario. Instead of pasting a customer’s exact complaint, describe the issue in broad terms and ask for a courteous response template.
- Remove identifying details. Redact names and contact information, but remember that removing a name alone may not make a record anonymous. Unusual details can still identify someone.
- Ask for structure, not disclosure. Request a checklist, outline, or blank template, then complete it inside approved business systems.
- Verify the output. AI-generated content can be wrong or unsuitable. Employees should review it before using it for business decisions or sending it to someone.
For example, a staff member could ask for a general outline for responding to a delayed shipment without including the customer’s name, order number, or private message. A manager could ask for a generic project-planning template without uploading an internal plan.
Make the rules easy for employees to follow
A useful employee AI acceptable use policy should be concise enough to apply during everyday work. It can identify approved tools, prohibited data, who can authorize exceptions, and how employees should report a mistake. Give staff examples that fit their roles, such as what a shop, clinic, nonprofit, or professional office should keep out of prompts.
It also helps to give employees a safe alternative for common tasks. If a team needs help summarizing records, decide whether an approved system and process can support that task. If it cannot, provide another workflow rather than leaving staff to improvise with public tools.
The NIST Generative AI Risk Management Framework profile offers organizations a resource for considering generative AI risks. For a broader look at protecting company information, see our guide to business data protection.
If someone has already pasted sensitive information
Respond promptly and follow your organization’s incident procedures. A calm, consistent response is more useful than trying to handle the situation quietly or guessing what happened.
- Stop further sharing. Do not add more details to the conversation or repeat the sensitive information elsewhere.
- Preserve relevant details. Note what type of information was entered, which tool was used, and when it happened. Follow internal instructions on retaining any relevant records.
- Notify the designated privacy or security contact promptly. Employees should report the incident through the organization’s established process, even if they are unsure whether the information was retained or used.
- Follow the incident response process. The responsible team can assess the circumstances and determine appropriate next steps, including whether the provider’s settings or terms need review.
Do not assume that deleting a prompt from the visible chat removes every copy or resolves the exposure. How information is handled depends on the specific service, its terms, and its settings. Review those details before using a tool, and ask your organization’s designated contact when anything is unclear.
Frequently asked questions
Can a public chatbot use or retain information employees enter?
It depends on the provider, the product, its settings, and its terms. Do not assume a prompt is private or immediately deleted. Check the organization’s approved tool guidance and the service’s data-handling information before use.
Is it safe to paste employee records or payroll information into an AI chatbot?
Do not enter identifiable employee or payroll information into a public chatbot. Use an approved process and ask the appropriate internal contact if a work task appears to require those records.
Can employees enter patient information into a public AI tool?
They should not enter identifiable patient information into a public chatbot. Whether HIPAA applies depends on the organization and its role, and other requirements may also be relevant. Follow approved privacy and security procedures.
How can employees use AI without exposing company information?
Use approved tools, synthetic examples, generalized scenarios, and blank templates. Remove identifying details where policy permits, and check with a designated contact before using confidential material.
Set clear boundaries before AI use becomes routine
The safest starting rule is straightforward: keep personal, regulated, credential, and confidential business information out of public AI prompts. Give employees approved alternatives and a clear person to ask when a task is uncertain. Daytona IT Support offers managed AI services for businesses in Daytona Beach, Ormond Beach, and the surrounding Volusia County area. If your organization is defining its AI use rules, get in touch to discuss the support available.