Shadow AI
The unsanctioned use of consumer AI tools (such as ChatGPT or Claude) for work purposes by employees, without agency approval or HIPAA safeguards. Shadow AI is a significant and growing compliance risk in home care.
Also known as: shadow AI · shadow IT · unauthorized AI · rogue AI · ungoverned AI · consumer AI misuse
Shadow AI refers to caregivers, coordinators, or other staff using publicly available AI tools for work-related tasks without authorization — for example, pasting client notes into a consumer chatbot to generate documentation, or using AI to draft scheduling messages that include client names.
The primary risk is HIPAA exposure: consumer AI tools are not HIPAA-covered entities, and sending Protected Health Information to them without a Business Associate Agreement constitutes a potential breach.
The most effective mitigation is providing a sanctioned, HIPAA-compliant AI tool that meets the legitimate workflow needs driving shadow AI adoption in the first place.
In home care, this means…
An emerging compliance risk in home care. Agencies should audit AI tool usage among staff and establish clear acceptable use policies before deploying any AI initiative.
Related terms
HIPAA →
The Health Insurance Portability and Accountability Act — federal law establishing privacy and security standards for protected health information (PHI). Home care agencies that handle client health data must comply with HIPAA's Privacy and Security Rules.
LLM (Large Language Model) →
A machine learning model trained on large amounts of text that can understand and generate human language. LLMs are the underlying technology in AI assistants like ChatGPT and Claude, and are used to power AI tools in home care software.
AI Agent →
An autonomous software system that can perceive context, reason, make decisions, and take multi-step actions to complete goals — going beyond a single chatbot response to execute workflows, call tools, and coordinate with other systems.
Compliance →
Adherence to applicable laws, regulations, payer requirements, and agency policies. In home care, compliance spans licensing, caregiver certification, EVV, billing accuracy, documentation standards, and mandatory reporting obligations.