Why You Cannot Paste a Patient Funnel into ChatGPT: The HIPAA Leak Problem

You cannot paste a patient funnel into ChatGPT because the export is protected health information long after you delete the name column. Page paths, campaign names, event names, timestamps, and city level geography describe together who came to a healthcare site and what they were seeking care for, and handing that to a vendor you have no BAA with is a disclosure no matter how good the intent was. Curve AI Analyst exists for exactly this reason: the question travels to the data instead of the data travelling to the model.

This article is about the export itself. Not the policy, not the theory, but the actual columns sitting in the file you were about to upload, and why the habit of scrubbing a few of them is not the control people think it is.

Everyone else got to paste

The move is genuinely useful. A growth lead at a software company pulls a funnel export, drops it into a chat window, and says "tell me where this is leaking." Ten minutes later they have three hypotheses and a chart. An ecommerce merchandiser does the same thing with a product feed and a returns file. It has become an ordinary Tuesday afternoon capability across most of the economy.

Healthcare marketers watched that happen and could not participate. Not because the work is different. The work is identical. A consult funnel leaks in the same places a checkout funnel leaks. The difference is that the file describing it is regulated, and the tool everyone else is using has no agreement with your organization about what happens to it.

So healthcare got the same thing it always got. A capability that exists, that competitors in other industries use daily, and a compliance reason it is off limits. That pattern is the through line of the last decade of healthcare marketing, and we wrote about the version of it that happens at the tracking layer in leak or go dark, and the third option for telehealth tracking.

What is actually inside a healthcare funnel export

Open the file before you argue about it. A typical marketing funnel export from any analytics tool has a row per session or per event, and the columns are more revealing than the summary view that produced them.

The page path is the diagnosis

This is the one people miss most often, because a URL does not look like a medical record. A path like /services/bariatric-surgery/consultation or /telehealth/suboxone-intake or /oncology/second-opinion-request is a statement that a specific person, at a specific time, from a specific city, was seeking treatment for a specific condition. Pair it with an IP address or a device fingerprint or a user identifier of any kind and you have exactly the combination that regulators have been describing in guidance and that plaintiffs have been describing in class action complaints since 2022.

Marketing teams rarely think of the URL as sensitive because they wrote it themselves, for SEO reasons. That is precisely why it is descriptive. A good landing page URL names the condition.

The campaign name is the diagnosis again

Campaign, ad set, and ad names in a healthcare account are written for humans scanning a dashboard, so they are specific on purpose. Something like GLP1_Weight_Loss_Retarget_Mobile or MAT_Intake_Brand_Exact or IVF_Consult_Lookalike_2pct tells you the treatment line without any additional context. When a funnel export carries campaign attribution per row, and it always does, the condition rides along with every single row.

The event names, the timestamps, the geography

Event names in a well configured account are business names, which is the right practice and also means they are descriptive. appointment_booked is neutral. consult_request_submitted on a page about a specific service is not. Then add the session timestamp to the second, the city and region, the device and operating system, the referrer, the query string that carried the search term the visitor typed, and the form step they reached before abandoning.

None of those columns is a name. All of them together, in a small enough population, are a person. In a single city practice or a niche specialty, the population is very small. A rural telehealth line treating a stigmatized condition might have four sessions from a given region in a week. That is not anonymous data. That is four people.

De-identification is a legal standard, not a spreadsheet habit

The most common defense is "I anonymized it first." It is worth being precise about what that phrase actually requires, because the gap between the colloquial meaning and the regulatory one is where most of the risk lives.

Under HIPAA there are two recognized routes to de-identified data. One is Safe Harbor, which requires removing a defined list of identifier categories, and that list is longer and stranger than people expect. It includes not just names and emails but geographic subdivisions smaller than a state under a population threshold, all elements of dates more specific than a year, device identifiers, IP addresses, URLs, and a catch all for any other unique identifying number or code. Read that list against your funnel export. URLs are on it. IP addresses are on it. Full dates are on it.

The other route is Expert Determination, which means a qualified person applies statistical methods and documents that the re-identification risk is very small. That is a real process with a deliverable. It is not something a marketer performs in a spreadsheet on the way to a chat window.

Deleting the email column is neither of those things. Hashing the email column is also neither, because a hash is still a unique identifying code that links rows together, which is the entire reason ad platforms accept hashed emails for matching in the first place. If the hash were meaningless, matching would not work.

The four workarounds, and why each one fails

Every healthcare marketer who has thought about this for more than a minute has invented one of these. They are reasonable instincts and they do not hold.

• Aggregate first, then paste. Better, and still not safe at the tail. Aggregates with small cell counts leak. A table showing one conversion from one city on one service line is a record with extra steps. Aggregation reduces risk on the fat part of the distribution and does very little on the part you are usually investigating, because the thing you are asking about is often the anomaly.
• Rename the campaigns before exporting. Now you have destroyed the analysis. If you relabel every campaign as A, B, and C, the model cannot reason about creative themes, service lines, or audience strategy, which is most of what you wanted. And the page paths in the same file usually give it away anyway.
• Just paste a few rows. Fewer rows is more identifying, not less. A sample of six sessions from a specialty clinic is closer to a patient list than the full export is.
• Screenshot the dashboard instead of exporting. Uploading an image of the data is the same act as uploading the data. The disclosure is the transfer, not the file format. This one is worth saying plainly because it is by far the most common version in practice, and it feels different to the person doing it. It is not different.

The BAA question, and why enterprise terms do not close it

Some AI vendors will sign a business associate agreement under specific enterprise arrangements, and if yours has, that changes the analysis for that configured account. It does not change it for the consumer app on someone's phone, the free tier, the personal login, or the browser extension a media buyer installed to summarize reports.

And even with an agreement in place, the disclosure decision has been moved to the wrong person. In the paste workflow, the choice about what leaves the compliant boundary is made at four in the afternoon by whoever has the export open, under deadline, with no logging, no scope enforcement, and no record afterward of what was sent. A privacy program cannot be built on a series of individual judgment calls made by people whose job is media buying.

That is the structural problem, and it is why the fix cannot be a policy memo telling people to be careful. Careful is not a control. Architecture is a control.

The shape of a version that works

Invert it. Instead of moving the data out to the model, put the model inside the boundary where the data already lives, and give it a narrow, read only way to look.

That is what Curve AI Analyst is. Curve is HIPAA compliant tracking, attribution, and analytics for healthcare, so your first party website analytics and your campaign reporting are already sitting inside infrastructure covered by a signed BAA. The assistant reads that. There is no export step, because there is nowhere to export to. The data has not moved.

The parts that make it hold up:

• Scope is bound before the model sees the question. Your organization comes from your authenticated session and is attached to the tools directly. The model cannot be talked into a different organization's data, because it never had the ability to name one.
• It reads, it does not write. Curve AI Analyst does not write SQL, does not run free form queries against a database, does not create goals or funnels, and does not change how your destinations are configured. A read only surface has a far smaller blast radius than one that can also alter your tracking mid conversation.
• Identifier shaped values are redacted on the way through, on top of the PHI safeguards Curve already applies when events are first collected.
• Every answer comes from a real query against your own records, not from a general model's impression of what healthcare benchmarks look like. If the data is not there, the answer says the data is not there.
• Conversations are organization scoped and logged, which means the question your media buyer asked on Tuesday is auditable, which is the opposite of the paste workflow.

If you have seen Curve talk about Sentinel on social, that is the same product under a different name, and there is no difference in what it does.

What this changes on an ordinary Tuesday

The practical effect is that the question stops being expensive. In the export world, "why did consult requests drop last week" is a forty five minute job with a compliance decision buried in the middle of it, so most people do not ask it until the monthly report forces them to. When asking is a sentence, you ask on Wednesday, and you find the broken form three weeks earlier than you otherwise would have.

It also ends a demoralizing conversation. The one where a marketer asks whether they can use the tool everyone else uses, legal says no, and neither party has an alternative to offer.

Frequently asked questions

Is it a HIPAA violation to paste marketing data into ChatGPT?

If the data is protected health information and the vendor is not covered by a business associate agreement with your organization, disclosing it is a violation, and marketing funnel exports from a healthcare site very often qualify. The safe assumption is that any export containing page paths, campaign names, timestamps, and location for individual sessions is PHI until someone qualified has determined otherwise in writing.

What if I remove all the personal information first?

The question is whether what remains meets a recognized de-identification standard, not whether it looks harmless. Safe Harbor requires stripping URLs, IP addresses, full dates, device identifiers, and small area geography, among others, which removes most of what makes the file worth analyzing. Expert Determination requires a documented statistical assessment. Deleting a column is neither.

Can I use ChatGPT for healthcare marketing at all?

Yes, for work that does not involve your data. Drafting ad copy, brainstorming landing page structures, explaining an attribution concept, writing a creative brief. The line is not the tool, it is whether patient adjacent records cross the boundary. Keep the strategy conversations there and keep the data conversations inside a system covered by your BAA.

Are screenshots of a dashboard safer than a CSV?

No. The disclosure is the transfer of the information, and modern models read images fluently. A screenshot of a page report showing paths, sessions, and cities is the same disclosure as the underlying export, with the added disadvantage that it feels casual.

How is Curve AI Analyst different from an AI feature inside another analytics tool?

The compliance posture of a chat layer is inherited from the data underneath it. If the analytics platform holding your data cannot sign a BAA, adding an assistant on top does not fix that, it just makes the exposure faster to reach. Curve collected and stored the data inside a HIPAA compliant boundary from the first event, so the assistant is a read over data that was already covered. That is why we cover the mechanism in detail in how compliant tracking makes AI answers possible.

Does my team still need to be careful about what they type?

Yes. Do not put patient details into a question. Ask about campaigns, pages, channels, and funnels, which is what the data supports anyway. Identifier shaped values are redacted before anything reaches the model layer, but the honest guidance is that the assistant is built for aggregate marketing questions and should not be used as a lookup for an individual.

What about Google Analytics as a middle ground?

It is not one, and the reason is the same reason as above. Google will not sign a BAA for Analytics, which ends the conversation for a covered entity regardless of how the property is configured. We walk through the specifics in is Google Analytics 4 HIPAA compliant.

The data should never make that trip

The instinct behind pasting the funnel is a good one. You want to interrogate your own numbers in plain language, quickly, the way people in every other industry have been doing for two years. The instinct is right and the route is wrong.

Curve is the first platform to let you talk to your analytics, your marketing, and your campaign reporting in a HIPAA compliant way, and the best place for it because the data is already here. It was collected inside the compliant boundary, it is stored inside the compliant boundary, and the answer is produced inside the compliant boundary. You ask. It answers. PHI does not leave. If you want the full picture of what it is and what it reads, start with what Curve AI Analyst is.

If your team has been quietly doing the paste, or loudly not doing it and going without the answers, there is now a third option. See how it fits your stack at curvecompliance.com.