Not freely. When someone at a small accounting firm, law office or medical practice pastes client details into ChatGPT, the firm has handed that information to an outside service. Each of those professions already has a rule about handing client information to outsiders, and none of them makes an exception because the outsider is an AI tool. Being a small firm does not change the rule either. What changes is that there is usually no IT department watching, so the policy has to be simple and the record has to exist.
Accounting and tax firms: return information has its own federal rule
Section 7216 of the Internal Revenue Code makes it a crime for anyone in the business of preparing tax returns to disclose information a client furnished for a return, or to use it for anything other than preparing the return. A knowing or reckless violation carries a fine of up to $1,000 and up to a year in prison.
The Treasury regulations let a preparer share return information with another preparer in the United States to help prepare the return, as long as that help is not advice that affects the tax owed. Sharing it for work that applies tax law falls outside that permission and needs the client’s signed consent, and so does sending the information to anyone outside the United States. No IRS guidance yet says where an AI tool sits in those rules, so the careful reading is to treat client return data typed into a public AI tool as a disclosure.
Law firms: informed consent, not a line in the engagement letter
In July 2024 the American Bar Association issued Formal Opinion 512 on generative AI. Under the duty of confidentiality in Model Rule 1.6, a lawyer needs the client’s informed consent before putting information about the representation into an AI tool that can learn from what it is given. The opinion says a general clause in the engagement letter is not enough: the client has to understand the risk before agreeing. State bars apply their own versions of Rule 1.6, so check yours as well.
Medical and dental offices: no business associate agreement, no patient data
Under HIPAA, a practice can share protected health information with a vendor only under a business associate agreement. OpenAI does not offer one for consumer ChatGPT accounts, free or paid, so patient details typed into one are a disclosure the practice has no agreement for. We cover the detail in Is ChatGPT HIPAA compliant? and Is pasting patient data into an AI tool a HIPAA breach?.
What a small firm needs in place
- A short written AI policy. Which AI tools staff may use for client work, and which client information never goes into any of them.
- Consent where your rule asks for it. A specific, explained consent for law clients and for tax clients whose information an AI tool will touch, kept on file.
- A record of what was actually sent. If a client, a regulator or the bar asks what went into an AI tool, the answer should come from a record, not from memory.
Sources
- 26 U.S.C. 7216, Disclosure or use of information by preparers of returns (Cornell LII)
- 26 CFR 301.7216-2, Permissible disclosures or uses without consent of the taxpayer (Cornell LII)
- ABA Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024), summarized by the National Law Review
Where Verillian fits
Verillian keeps the record of every captured AI interaction from your staff devices on your firm’s own infrastructure: who used which AI tool, what was sent and what your policy decided. Verillian never receives your prompts, responses or records.
