The Confession Booth Has No Walls

Dan Noyes · 5 min read

A few weeks ago a neighbor told me something I have not stopped thinking about.

"I tell my ChatGPT friend everything," he said. "My labs, my meds, the health problems I haven't even told my doctor yet."

He said it the way a person admits a small, harmless secret — half embarrassed, half relieved. When I urged him to bring those questions to his physician, and gently warned him about where that data might travel, he looked lighter. As if confessing how he actually uses AI had lifted something off him. He slept fine that night. I did not.

What He Did Not Know

When you pour your health into a consumer AI tool, you are not whispering to a doctor. There is no HIPAA in that room.

HIPAA binds hospitals, clinics, insurers, and the vendors they hire. It does not bind the chatbot your patient trusts at eleven at night. The conversation is not theirs. It can be stored, used to train the next model through a setting buried in a policy no one reads, swept up in a breach, or summoned in a lawsuit.

He thought he was in a confession booth. He was standing in a room he could not see — speaking out loud.

That is not his failure. No one told him the rules had changed.

The Gap Is Real, and Regulators Know It

We keep debating whether AI can help the patient. It can. That was never the hard question. The hard question is the one we keep skipping: who owns the conversation.

Convenience answered first. Governance never showed up. We built a tool intimate enough to hold a person's deepest fears, and never decided who holds the record afterward.

This is not hypothetical. The regulators are already sprinting to catch up:

• 2023: The FTC penalized GoodRx and BetterHelp for funneling sensitive health data to advertisers. BetterHelp had told its users it was HIPAA compliant when it was not, and was ordered to pay $7.8 million and return money to the people whose disclosures it had shared.
• 2023: Washington passed the My Health My Data Act — the first law in the country written specifically to protect health information that falls outside HIPAA.

The pattern is unmistakable. The most intimate health conversations have migrated to tools the old rules never anticipated, and the law is reacting one settlement at a time.

Four Things We Do Now

1. Stop Treating It as User Error

Patients are not reckless for seeking clarity. They are filling a vacuum the system created when it priced a follow-up question as an imposition. Shaming them back into silence solves nothing.

2. Build the Literacy

A short, audited handout. A nurse who says, before discharge: "If you are going to ask an AI about this, here is what is safe to share and what to keep out of it."

We teach patients to read a nutrition label. We can teach them to read a privacy one.

3. Put the Patient in the Room Where the Rules Get Written

Not as a courtesy. As a design requirement. A committee deciding how AI will touch patients, with no patient at the table, is not governance — it is theater.

This is the spine of the Patients' AI Bill of Rights I have been building, and it begins with one claim: sovereignty over your own body has to include sovereignty over the story told about it.

4. Become the Interpreter

The reason your patient turns to the machine is not that the machine is smarter. It is that the machine has time, and patience, and never makes them feel stupid for asking.

Close that gap inside the exam room, and the unprotected room loses its pull.

My neighbor will keep talking to his ChatGPT friend. So will yours. The question is not how to stop them. It is whether we will build a system worthy of the trust they are already handing — knowingly or not — to a stranger.

Before we send one more patient home to "go ask the AI," we owe them one honest sentence: you may be the only one in that conversation who thinks it is private.

Related: Creating a Patients' AI Bill of Rights · Talking to Your Doctor About AI · Bring Your Own Algorithm

Sources:

• FTC, final order banning BetterHelp from sharing health data for advertising, $7.8M (2023): https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising
• Washington My Health My Data Act (IAPP overview): https://iapp.org/resources/article/washington-my-health-my-data-act-overview