6.5 Generative AI and external tools

Organizational, contractual, and client policies determine whether an external tool may be used. The availability of a tool does not establish permission.

Do not place confidential or restricted information into a generative AI system, proofreading service, translation service, code assistant, visualization platform, or other third-party service unless that specific use has been approved. Removing obvious names may not be enough, and a prompt can disclose sensitive context even when no file is attached.

Before using an external service, determine:

  1. what information would leave the approved environment;
  2. whether the intended use is permitted;
  3. where the information is processed and stored;
  4. who may access or reuse it;
  5. whether the service retains prompts, files, or outputs;
  6. whether the result could expose confidential information; and
  7. whether an approved alternative can accomplish the task.

Synthetic data are often useful for testing code, requesting generic technical help, or demonstrating a method without exposing real records. Synthetic data should not be presented as evidence about the client or population.