Can NHS staff use ChatGPT at work?

When I run AI sessions with colleagues, this is usually the first thing someone asks. Can I put this into it?

Some Trusts have banned it. Mersey Care's notice is clear: ChatGPT must not be used for work. Others draw the line at patient information. Keep that out, and you can use it for other things. A few let staff use Microsoft Copilot for admin, because it sits inside the Trust's own setup.

There's no national rule. NHS England hasn't put out a page that just answers the question for clinicians. The closest we've got is the UKMi position statement, which says public AI tools shouldn't be used routinely, or on their own, to make clinical decisions.

So the real question isn't "can I use ChatGPT?" It's what you're putting into it, and what your Trust says about that.

The difference that matters most

There are two very different ways of using AI at work, and most of the confusion comes from mixing them up.

The first is a tool you've signed up for yourself. ChatGPT on your phone, the free version on your laptop. Whatever you type in is handled under that company's terms, not your Trust's. This is what every Trust policy is worried about.

The second is a tool your Trust has bought, set up and approved. Copilot on your NHS account, or an AI scribe your Trust has rolled out properly. Different contract, different rules for your data.

Most of the bans exist because people are using the first one as if it were the second.

What the national guidance says

The UKMi position statement came out in December 2025. It's the clearest thing written for clinicians so far, and it says three things:

• Don't use public AI tools like ChatGPT, Copilot or Gemini routinely, or on their own, to make clinical decisions.
• Never put patient identifiable information into an AI tool.
• If AI tells you anything about medicines, a trained professional has to check it against the BNF, BNFC or NICE.

NHS England has also written AI guidance for information governance teams. It isn't written for us, but it's probably what your Trust's policy is based on. If you want to know why your Trust's rules say what they say, start there.

What Trusts actually do

Most Trusts land in one of three places.

Some ban it. Mersey Care names ChatGPT and Otter AI directly. Their thinking is simple: these are consumer tools, and the Trust can't control what happens to the data.

Most allow it with limits. No patient information, but you can use it for drafting, summarising public documents, learning. This is the most common position, and the vaguest. Where does "not clinical" end? You're left to work that out yourself.

Some approve specific tools for specific jobs. Copilot for admin. An AI scribe that's been through IG. Here the Trust has done the work, and the rules are usually written down somewhere you can find them.

Search your Trust's intranet for "AI policy" or "generative AI". That's the only document that answers this for you. If you can't find one, flag it. People are using these tools whether there's a policy or not. As Ryan Samuels put it in Healthcare Today, ChatGPT "is often the first name that crops up in the shadow AI conversation." The question is whether people are using it safely.

Would you paste it? Five quick checks

Before you put anything into an AI tool, ask yourself these. This matters more than memorising any policy.

1. Could this identify a patient? Not just a name, NHS number or date of birth. A rare condition, a small clinic and a date can be enough on their own. If the answer is yes, it doesn't go into a public tool. Ever.

2. Which kind of tool am I using? My own account, or something my Trust has approved? If you're not sure, assume it's your own and act like it.

3. What does my Trust actually say? Not what you think it says. What's written down. If you've never read it, that's your first job.

4. Am I asking it to decide, or to help me write? Asking it what a guideline says is one thing. Asking it what to do with a patient is something else. UKMi is clear on that one: not routinely, not on its own.

5. If this ended up in an incident report, could I explain it? Which tool, what I put in, what I checked before I used the answer. If that question makes you uncomfortable, stop.

Three quick examples.

You paste a patient's name, NHS number and history into ChatGPT to make a letter sound more professional. No. That's patient identifiable information in a public tool. A nicer letter isn't worth the breach.

Your Trust has given you Copilot. You ask it to turn your meeting notes, with no patient details in them, into a list of actions. That's fine, and it's exactly what Copilot is there for. Still worth knowing where your Trust says so.

On your own phone, you ask ChatGPT to sum up the latest NICE guidance on a condition. Then you open the actual guideline and check it before you use any of it. That's fine. The checking is the important part.

If you want to go further, the Clinician's AI Safety Check is nine questions to run before you use AI at work. It's free.

Before you rely on this

This is general information, not legal or IG advice. Trust policies change, so check the current version of yours, not the one you remember from last year.

The rules are moving too. The government has accepted all 44 recommendations on how AI in healthcare should be regulated. The direction is clear: tools will be checked for as long as they're in use, not just when they're approved. What your Trust allows now might change next year. I'm breaking down what that means for the people actually using these tools in Issue 18 of Clinically Intelligent.

And there's no universal yes or no here. It depends on where you work.