Practical Guidance for Using AI
Quick rule: Use an approved AI tool only for the data types and purposes it is approved to support. If the data, tool, or use case is unclear, pause and ask before entering information.
Reminder: UAB data protection requirements still apply when using AI. Use AI only in ways that match the data type, approved tool, environment, and purpose.
Step 1: Identify the Data
Start by identifying the information you want to use with AI.
| Data Type | Examples | Practical Guidance |
|---|---|---|
| Public | Published research, public websites, open data, and public communications. | Generally appropriate for public or UAB approved AI tools. |
| Internal or unpublished | Drafts, internal plans, meeting notes, proposals, unpublished research, internal communications. | Use only a UAB approved tool for the data and purpose. Confirm first if the content is confidential or sensitive and select appropriate AI tools from approved list. |
| Sensitive and Other Restricted | Institutional, operational, student education record, financial identifiers, payment card data, and sponsored projects. | First, determine whether the data can be de-identified or avoided. Use only if necessary and only in a UAB-approved, secured environment approved for the data and purpose. |
| Restricted-PHI, CUI, or export-controlled data | Patient or clinical information; Controlled Unclassified Information (CUI); International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR)-controlled technical data. | First, determine whether the data can be de-identified or avoided. Use only in an approved, secured environment that meets UAB, sponsor, federal, and regulatory requirements. |
Step 2: Choose the Right AI Tool
Use a UAB-approved AI tool when working on UAB activities. Public AI tools should be treated as public environments unless UAB has approved a different use.
Remember: Public tools are public environments unless UAB has approved a different use. A public AI tool is an AI tool or platform that is generally available to the public and not specifically approved or secured by UAB for university or health system data.
- Public tools: Use public data only.
- Approved UAB tools: Use only for the data types and purposes they are approved to support.
- Sensitive, Restricted, PHI, CUI, or export-controlled data: Use only in explicitly approved, secured environments.
- If the tool is not clearly approved for your data: Do not enter the data.
Step 3: Decide What to Do
Proceed when using a UAB-approved AI tool for routine work with public, internal, or sensitive data that the tool is approved to support. You may also proceed when the tool, secured environment, and use case are approved for other restricted data.
Pause and confirm when the tool is not listed as UAB-approved, the approved environment is unclear, the use involves PHI, CUI, export-controlled, or regulated data, or the use case goes beyond routine individual work. Do not enter the data until confirmed. Route the use case for review.
Common Examples
Use these examples to apply the guidance to common UAB work.
| Scenario | Can I Use AI? | What to Do |
|---|---|---|
| Summarizing a public article, website, or published report. | Yes, generally okay. | Use the tool, then review the summary for accuracy and completeness. |
| Summarizing internal meeting notes, draft plans, proposals, or unpublished research. | Proceed | Use only an approved tool for the data and purpose. Email |
| Uploading files that contain PHI, CUI, export-controlled, restricted, or confidential information. |
Pause and confirm. Do not use public or unapproved tools. |
Use only if the tool, secured environment, and use case are explicitly approved for that data type and purpose. |