Maui Nui Medical Society × The Blue Dot AI · October 29, 2026
Claude for Physicians.
Four useful workflows. One clear boundary.
Ask for finished work, not just an answer. Start with public sources and non-patient files. Review outputs before using or sharing them.
Checked October 22, 2026 · Recheck official guidance as features change.
Your first experiment
One topic. One run. Check the sources.
Choose a clinical topic, with no patient information.
Run the PubMed prompt once.
Check the cited papers and abstract/full-text labels.
Schedule only after the result is useful.
The prompt library
Try one safe example.
Copy a prompt and replace the bracketed text. If copying is unavailable, select the text in any prompt box and copy it manually.
01
Start with the evidence
Weekly PubMed brief
Scheduled tasks · Paid plans
Connect PubMed in Settings → Connectors. The connector is available to all Claude users; scheduling requires a paid plan. Try the prompt once before making it recurring.
Then schedule: after checking the sources, ask “Run this every Monday at 6 a.m. Hawaiʻi time.” Review and confirm the schedule. New cloud tasks can run with your laptop closed; access to local files/apps requires an open, connected desktop. This is not a comprehensive literature search.
A BAA is possible. A subscription alone is not enough.
Personal plans + Team
Not the PHI route
Free, Pro, Max, and Team do not offer the Claude app’s HIPAA-ready Enterprise configuration. Do not put PHI into these experiments.
HIPAA-ready Enterprise
Agreement + activation
The organization’s Primary Owner must accept the Business Associate Agreement and activate HIPAA. Buying Enterprise alone does not enable it. Have your practice’s privacy lead approve the exact feature, model, and workflow.
Local Cowork
Additional configuration
Local Cowork needs additional HIPAA configuration, currently through an Anthropic account team. The Primary Owner applies it; owners re-enable approved desktop products. Members must see the HIPAA-configured label before PHI. Local storage and endpoint security remain the organization’s responsibility.
Not covered routes for PHI: cloud Cowork, Dispatch, cloud routines, screen control, and new Docs/Slides. Correctly configured local scheduled tasks can be covered. Third-party connector transmissions need separate contract and data-flow review. A contracted, enabled API deployment is another route, not a personal-account workaround.
Before using patient information, have your practice’s privacy lead confirm:
Is this exact organization and workflow approved, with the BAA in effect?
Are the specific feature, model, and destination covered and correctly configured?
What can connected apps receive, and who can access the output?
How are local files, retention, access, and human review controlled?
A BAA is one part of compliance, not certification that the whole workflow is safe. Your organization still needs its own risk assessment and safeguards. HHS, Guidance on HIPAA & Cloud Computing. ↗
Five habits that prevent expensive mistakes
Keep human judgment in the loop.
Use public or fictional examples first. Removing a name alone does not establish HIPAA de-identification. Do not paste a chart into an unapproved tool to ask it to remove PHI.
Give the source, not just the topic. Specify the guideline, publication date, payer, and jurisdiction. Ask what is missing or uncertain.
Demand traceability. Request original links, page references, assumptions, and calculations. Open the sources yourself.
Keep actions separate from drafts. Require your approval before sending, submitting, deleting, purchasing, or changing records. Give access only to the files and apps needed.
Keep clinical responsibility with clinicians. Verify drugs, doses, numbers, citations, and patient-facing language. Do not use these experiments for autonomous diagnosis, treatment, triage, or EHR actions.
Features, plans, and BAA scope change. Checked October 22, 2026; recheck before adopting a workflow. These links are the starting point, not approval to use patient data.