Most chiropractic offices believe they are compliant.
The licenses are current. Claims are getting paid. HIPAA forms are signed. Staff completed training at some point. Providers are credentialed, or at least everyone thinks they are.
The office is running smoothly, so everything must be fine.
Maybe.
The problem with healthcare compliance is that many problems remain invisible until someone starts looking.
And artificial intelligence just added an entirely new layer.
AI is quickly becoming part of how chiropractic practices document care, communicate with patients, select codes, market services, analyze information, and automate everyday workflows. At the same time, payers are using increasingly sophisticated data analysis, credentialing information exists across multiple systems, Medicare maintains specific enrollment and billing requirements, and state boards continue to regulate professional conduct.
The question is no longer simply: “Are we compliant?”
A better question may be: “If someone audited us tomorrow, could we prove it?”
And increasingly: “Do we know what AI is doing inside our practice?”
AI Just Changed the Compliance Game
Artificial intelligence may become one of the most useful tools chiropractic practices have ever had.
It can also create problems doctors may never have needed to consider before.
AI is already being used to help create SOAP notes, recommend codes, summarize patient encounters, communicate with patients, produce marketing materials, analyze claims, review test results, and automate office workflows.
But here’s the question: Who is checking the AI?
If AI adds something to a healthcare record that didn’t happen, who is responsible?
Hint: not the AI.
If it recommends a code that isn’t supported by the documentation, who is responsible?
Again, not the AI.
If an employee enters patient information into an AI platform that the practice hasn’t approved, where does that information go? Is the vendor permitted to receive PHI? Is a Business Associate Agreement required and in place?
HHS specifically identifies third-party AI tools that handle patient PHI as potential business associates, meaning HIPAA obligations don’t disappear simply because the technology is called AI.
If AI creates a marketing claim that crosses a regulatory line, does anyone catch it before it gets published? FTC guidance continues to require healthcare-related marketing claims to be truthful, not misleading, and appropriately supported.
These aren’t theoretical questions anymore. And simply having an “AI policy” isn’t the same thing as having an effective AI compliance process.
AI-related laws are also developing quickly at the state level. NCSL now tracks enacted and proposed state legislation involving AI in healthcare, private-sector use, responsible AI, discrimination, and other areas. The requirements are not uniform from state to state.
Do you know which rules apply to your practice?
Do you know which AI programs your employees are using?
Do you know what happens to information entered into those programs?
And who in your office is responsible for checking the output?
5 AI Mistakes Chiropractic Practices Should Avoid
Letting employees use whichever AI tool they prefer
Assuming a free or inexpensive technology or AI tool has healthcare-level privacy protections
Copying AI-generated content directly into the patient record without review
Assuming a HIPAA statement on a website means the tool is compliant
Using multiple disconnected tools without understanding how data moves between them
Before You Build or Implement an AI Workflow, Ask These Questions
Is it actually secure?
Saying a tool is “secure” is not the same as confirming it is appropriate for healthcare use.What plan level is required?
In many cases, the protections healthcare practices need are only available on very expensive enterprise-level plans, if at all.Will the vendor sign a BAA?
If patient information is involved, this is one of the first questions that should be answered.How is data handled?
Where is it stored? Does it cross state or international boundaries? Who can access it? Is it retained, and for how long? Is it ever used to train other models?Who is reviewing the output?
AI can assist, but it should not replace clinical judgment, documentation review, or compliance oversight.Does the patient need to be informed or consent?
Has the practice determined whether patient notification, authorization, or consent is required for this AI workflow, and is that process documented?
The risk is not just the AI itself. The risk is a piecemeal system no one has fully evaluated, governed, or monitored.
Responsible AI in Healthcare
AI itself isn’t the problem. Uncontrolled AI is.
There is a big difference between adding disconnected AI tools one at a time and using technology intentionally designed around healthcare workflows, privacy, security, and clinical oversight.
Responsible AI should reduce administrative burden while keeping the provider in control. NIST’s AI Risk Management Framework emphasizes the importance of privacy, security, reliability, accountability, transparency, and ongoing risk management rather than treating AI as a tool that can simply be switched on and forgotten.
The goal shouldn’t be to avoid AI. The goal should be to use AI responsibly.
ChiroUp’s AI-enabled documentation tools were designed specifically for chiropractic practices with consideration of compliance, cybersecurity, legal, clinical, and technical requirements.
See how responsible AI can help you create a complete SOAP note faster while keeping the provider in control. Try the ChiroUp EHR SOAP Sandbox.
Compliance Isn’t a Binder
One of the biggest misconceptions about compliance is that a practice can buy a manual, conduct annual training, put everything in a binder, and check the box.
Real compliance is operational.
It touches on credentialing, documentation, billing, HIPAA, Medicare, exclusion screening, staff training, cybersecurity, marketing, AI, payer requirements, and the actual services performed in the office.
Most importantly, these areas shouldn’t operate independently. They connect.
And understanding those connections is often where the real compliance issues are discovered.
For example, a documentation problem can become a billing problem. A credentialing problem can become a reimbursement problem. An employee using an unapproved AI tool can become a HIPAA and cybersecurity problem. An AI-generated marketing statement can become a regulatory problem.
The technology may be new. The responsibility isn’t.
Don’t Wait for Someone Else to Find the Problem
A payer audit, Medicare review, board complaint, credentialing problem, cybersecurity incident, or patient complaint is a terrible time to discover that something has been handled incorrectly for years.
The goal of compliance isn’t to scare practices. It’s to build confidence in your practice.
It’s identifying vulnerabilities while you still have an opportunity to address them proactively.
I work with chiropractic practices to look beyond the obvious and evaluate how credentialing, documentation, billing, provider responsibilities, Medicare, HIPAA, AI, marketing, cybersecurity, and day-to-day operations actually work together.
Because sometimes the biggest compliance risk isn’t what you know you’re doing wrong.
It’s what you don’t know anyone should be checking.
How Confident Are You in Your Practice?
If you’re reading this and thinking: “I need to check that.”
That’s probably a good place to start.
Before an insurance company, Medicare, a credentialing organization, a state board, or another outside party starts asking questions, find out what they might find.
Compliance isn’t about checking boxes. It’s about knowing which boxes everyone else is going to check.
Ready to Strengthen Your Chiropractic Compliance?
Schedule a Chiropractic Compliance Review with C3-Plus and Dr. Amy Wood, DC, today.
Schedule Your Review →We’ll take a closer look at your practice, identify areas that deserve attention, and help you understand where your greatest compliance risks may be without turning compliance into another full-time job.
This article is provided for general educational purposes and is not legal advice. Compliance requirements vary based on jurisdiction, payer participation, practice structure, technology use, and other factors.
