Healthcare Growth JournalThe latest growth strategies in marketing and AI enablement for clinics, dentists, doctors and hospitals
Last updated Nov 13, 2026Written and edited by Ali PeivandizadehNo ads. No sponsors.
AI at Work · Action

Check if staff built AI apps that hold patient data

By Ali Peivandizadeh, business growth and AI implementation specialist.

Published Nov 13, 2026 · Last checked Nov 13, 2026 · Last changed Nov 13, 2026
The short answer

Find out this week which AI app builders your staff have used for work. Open every app they built in a private browser window, signed out. If an app with patient information opens, take it down the same day.

Verdict
ACT
For
All practices and hospitals. All sizes. Owner, manager, compliance, IT.
Cost and time
No cost. About half a day for a practice. Longer for a hospital.

Why

Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time, such as a schedule tracker or a recall list. A practice with no list of them cannot know what is open.

What to do

  1. Ask every team which AI app builders they have used for work.
  2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
  3. List every app, the data in it, and who owns it.
  4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
  5. Change each open app to invited users only, or unpublish it.
  6. If an open app held patient information, tell your privacy officer the same day.
  7. Write down what was in it and how long it was open.
  8. Ask your privacy officer or lawyer whether patients and the federal health department must be told.
  9. Add one line to your AI rule. No patient information goes into a tool until its maker has signed the required agreement.

What data may go in

Until the maker has signed that agreement: public information only. No patient names, schedules, photos or notes.

Who checks the output

The manager or the privacy officer keeps the list of apps. In a hospital, IT and compliance own the list and report the count to the AI committee.

The rule to check

Patient information may go only into a tool whose maker has signed a business associate agreement (the contract a vendor must sign before it handles patient information). An app that anyone can open may be a breach under federal privacy law, with notice duties and deadlines. Your state may add its own rules.

What can go wrong

The same problem has been reported at other app builders, so check all of them and not only one. A new app can be open next month. Put a monthly check on one person's calendar.

Sources

Plain text version