AI Use Boundaries

Know instantly whether an AI use case is appropriate.

Decision Tree

Does this involve client data or PII?
→ YES → RED — Do not use AI.
→ NO ↓
Will this go outside the organization?
→ YES → YELLOW — Get a second pair of eyes before sending.
→ NO ↓
Is this internal admin work?
→ YES → GREEN — Go ahead.

Traffic Light Card

Print this out and keep it at your desk.

GREEN — Go Ahead

Administrative tasks. No additional approval needed.

  • Meeting notes and summaries
  • Email drafts (internal)
  • Report formatting and organization
  • Data entry assistance
  • Calendar scheduling help
  • Research summaries (public sources)
  • Training material organization
  • Grant writing assistance
  • Website content updates

YELLOW — Second Pair of Eyes

Requires review before use. Get supervisor sign-off.

  • External communications (review before send)
  • Resource recommendations for clients
  • Program descriptions for public use
  • Aggregate data analysis
  • Template creation for client-facing use
Yellow Zone Process:
  1. Use AI to create a draft
  2. Mark clearly as "AI-assisted draft"
  3. Submit to appropriate supervisor
  4. Do not use until approved

RED — Do Not Use AI

These tasks are off-limits for AI. No exceptions.

  • Client names, case notes, or any PII
  • Direct client communication
  • Crisis assessment or risk evaluation
  • Clinical decision-making
  • Diagnosis or treatment planning
  • Suicide/self-harm risk evaluation
  • Confidential case discussions

What counts as PII?

Never enter any of these into AI tools:

  • × Client names (first, last, or both)
  • × Dates of birth
  • × Addresses or phone numbers
  • × Email addresses of clients
  • × Social security numbers
  • × Case numbers or client IDs
  • × Photos or images of clients
  • × Session notes or case notes
  • × Medical or mental health information
  • × Any combination that could identify someone
✗ Summarize case notes for John Smith, DOB 3/15/1995
✓ Summarize this progress note: [paste text with all identifying info removed]

If You Accidentally Enter Client PII

  1. Stop immediately — don't continue the conversation
  2. Document what was entered (screenshot if possible)
  3. Tell your supervisor within 24 hours
  4. Report to Victor
  5. Follow your organization's incident protocol

No punishment for honest reporting. We want to learn from incidents, not hide them.