Appendix CCheck yourself
Where can this go?
Whether data can go into an AI tool depends on how sensitive it is and on the arrangement, not on the model.
Questions worth asking
- Is this my personal account or my organization's?
- Who signed the agreement, and does it cover this kind of information?
- How sensitive is this, and what would a leak cost someone?
- Is this particular feature covered, or open but outside the agreement?
- Will a tool or connector send this to another company?
Notes (11)
- 1NIST, “potential impact (glossary),” NIST CSRC (from CNSSI 4009-2022, adapted from FIPS 199), https://csrc.nist.gov/glossary/term/potential_impact (accessed October 26, 2026).
- 2Anthropic, “Updates to our consumer terms,” August 28, 2025, https://www.anthropic.com/news/updates-to-our-consumer-terms (accessed October 26, 2026).
- 3Anthropic, “Is my data used for model training? (commercial),” Anthropic Privacy Center, August 18, 2026, https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-training (accessed October 26, 2026).
- 4LM Studio, “About LM Studio,” https://lmstudio.ai/docs/app (accessed October 26, 2026).
- 5U.S. Department of Health & Human Services, “Guidance Regarding Methods for De-identification of Protected Health Information,” HHS.gov, last reviewed February 3, 2025, https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification (accessed October 26, 2026).
- 6U.S. Department of Health & Human Services, “Guidance on HIPAA & Cloud Computing,” HHS.gov, last reviewed December 23, 2022, https://www.hhs.gov/hipaa/for-professionals/special-topics/cloud-computing (accessed October 26, 2026).
- 7Anthropic, “HIPAA-ready Enterprise plans,” Claude Help Center, https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans (accessed October 26, 2026).
- 8Anthropic, “Business Associate Agreements (BAA) for Commercial Customers,” Anthropic Privacy Center, https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers (accessed October 26, 2026).
- 9U.S. Department of Health & Human Services, “Minimum Necessary Requirement,” HHS.gov, last reviewed July 26, 2013, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement (accessed October 26, 2026).
- 10U.S. Department of Health & Human Services, “Summary of the HIPAA Security Rule,” HHS.gov, last reviewed August 7, 2026, https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations (accessed October 26, 2026).
- 11U.S. Department of Education, “Who is a 'school official' under FERPA?” studentprivacy.ed.gov, n.d., https://studentprivacy.ed.gov/faq/who-school-official-under-ferpa (accessed October 26, 2026).
Appendix C · page 3 of 3
Turn pages with the ← and → keys.