Before You Accept an AI Add-On: A Contract Checklist for Florida Practices

Many Florida healthcare practices, law firms, and other small businesses are not shopping for a separate AI product. The AI shows up inside software they already use: a practice-management system, email, a document tool, or a phone system. A renewal arrives with new terms, or a checkbox appears for something like smart assist. That is a compliance decision, not just a product update. If the feature can see patient information, client files, or other sensitive records, you need to know where that information goes and who else can use it before your team relies on it.

Know what the feature can reach

Start with the workflow, not the marketing page. Ask which screens, files, emails, call recordings, or uploads the AI can read. A helper that only sees text someone pastes into a box is different from a feature that searches a whole mailbox or chart. Write down what could be included: names, dates of birth, medical details, case facts, Social Security numbers, financial records, or staff notes. If you cannot describe what the tool can see, you are not ready to use it for client or patient work.

Questions to settle before you sign

• Will the vendor use your information to train its models, or is your data kept out of training?
• Who else can see it, including the vendor's support staff and any other company the vendor uses to run the AI?
• Where is the information stored, and how long is it kept after a chat, a ticket, or the account is closed?
• Can you delete prompts, uploads, and outputs, and will the vendor confirm deletion in writing?
• If the tool may handle protected health information, will the vendor sign a business associate agreement that covers the AI feature, not only the original software?
• For a law firm, does the agreement limit use of client information to the service you requested, and bar the vendor from using it for its own purposes?
• What happens to stored prompts and files if you cancel, switch vendors, or remove a user?
• Will you get notice if the vendor adds another company behind the feature or turns on a broader AI function later?
• Can an administrator disable the feature for some users, or for the whole practice, without losing the rest of the software?
• If information is exposed, how will the vendor notify you, and how quickly?

A verbal assurance is not the agreement

Sales conversations can be helpful, but they do not replace the contract. If a representative says the vendor does not train on customer data, ask them to point to the clause that says so. Check whether that clause covers the new AI feature or only the older product. Watch for broad rights to use customer content to improve services. That phrase can mean ordinary troubleshooting, or it can mean using your records to build the vendor's AI. If the meaning is unclear, ask for a written clarification before you accept. Your attorney should review agreements that touch patient or client information. This checklist is a practical starting point, not legal advice.

Match the tool to the sensitivity of the work

You do not have to ban every AI feature to be careful. Many practices can use AI for internal tasks that do not include client or patient information, such as rewriting a staff schedule note, summarizing a public webpage, or drafting a generic job posting. The line that matters is whether the prompt, the upload, or the connected system contains information you have a duty to protect. If it does, the tool should be on an approved list, under an agreement you understand, with access limited to people who need it. If you cannot get clear answers, leave the feature off for that workflow and keep your existing process.

If the feature is already on

Some owners discover the AI feature only after a staff member has used it. Do not ignore that. Ask what was entered or connected, note what you can still see, and turn the feature off for client or patient work until the contract questions are answered. Keep whatever logs the software already provides. If patient information, client confidences, or other personal information may have gone to a vendor you do not have the right agreement with, contact your attorney and your IT provider promptly. Do not try to clean it up by deleting local copies before you understand what the vendor still holds.

Write the decision down

• Name the software and the specific AI feature you approved or declined.
• State which kinds of information may be used with it, and which may not.
• Note who may turn the feature on, and who to ask before a new user gets access.
• Keep the contract language, any business associate agreement, and written vendor answers with your other vendor records.
• Revisit the decision when terms change, a new company is added behind the feature, or your workflows change.

A short written rule prevents the most common failure: one well-meaning employee accepts a prompt or connects a mailbox because the button was there. Compliance depends on a shared boundary, not on everyone making a separate judgment in the moment.

If an AI add-on is sitting in a renewal or is already turned on, you do not have to sort out the data questions alone. Contact IT Network Solutions Group (ITNS) for a free consultation. We will help you look at the feature, the agreement, and the way your team actually works, then recommend a practical path that protects client and patient information.