Care staff using ChatGPT on their phones? What to do next

If your care staff are using ChatGPT on their own phones, don't start with a ban. Find out what they're using it for, tell them clearly what must never go into a free AI tool, and give them a safer option for the jobs they're already doing. That's the short answer, and it lines up with the Department of Health and Social Care's guidance on using AI in adult social care, published in September 2026.

Why are care staff using ChatGPT in the first place?

Usually for good reasons. A senior carer whose first language isn't English wants a handover note to read well. A deputy manager is staring at a care plan review at ten at night. Someone wants fresh activity ideas for a resident who's gone off bingo. ChatGPT is free, it's already on their phone, and it gives a polished answer in seconds.

This is called shadow AI. It's better to think of it as a signal, rather than a mark against that team member. It shows you where the paperwork is heaviest and where people feel least supported. The risk is real, though, and it mostly sits in one place: what gets typed in.

What's the actual risk?

Most of what happens in care involves health information. The ICO treats "data concerning health" as special category data, which gets extra protection under UK GDPR. That covers things like diagnoses, medical history and treatment, and an NHS number combined with health details. In a care home, most notes about a resident fall into it.

DHSC's guidance is plain about free tools: they should not be used with personally identifiable information, because without a contract you can't guarantee how that data is kept safe or used.

There's a second issue. On personal ChatGPT accounts, OpenAI says it trains its models on conversations unless the user turns that off in Settings, under Data Controls ("Improve the model for everyone"). Most staff have never opened that menu. And turning it off still doesn't give your organisation a contract covering that data.

The third issue is what comes out. A care plan that reads beautifully but wasn't written about this person, by someone who knows them, is a care quality problem whatever produced it. DHSC says a member of staff must review any AI-assisted care plan for accuracy.

What will CQC expect?

CQC hasn't created a separate rulebook for AI. Its statement on AI in health and social care, last updated in May 2026, says most of the regulations it already enforces have a role, including good governance. It expects AI to support rather than replace human decisions, outputs to be monitored, and the people using AI to be "sufficiently trained and confident in using the technology". Staff quietly using personal accounts, with no rules and no training, is hard to square with that.

Should we just ban it?

A ban on its own tends to push use out of sight rather than stop it. People keep doing the same thing; they just stop telling you. Even DHSC's guidance says that if you prohibit AI for work, you should still have a policy and share it with staff, so everyone knows where the lines are.

The care workers' statement of expectations, written by frontline care workers at a roundtable co-hosted with the University of Oxford's Institute for Ethics in AI, as part of the Oxford initiative now known as the AI in Care Alliance, makes a fair point too: responsibility for using AI well shouldn't rest "solely on the shoulders of care workers". If the organisation hasn't given people rules, training or a proper tool, it can't be surprised when they improvise.

What to do on Monday

Ask, without blame. Run a short anonymous survey or a team meeting conversation: which AI tools do you use, for what, and on which device? Make it clear nobody is in trouble. You can't govern what you can't see. I wrote this free resource on how to talk to your team about AI.
Give everyone three questions. Before typing anything into an AI tool: What am I about to share? Where is it going? Am I allowed to share it? If the first answer involves a real, identifiable person, stop and check.
Sort tools into three tiers. Public tools (free ChatGPT, Gemini, Claude and the like) are fine for ideas, general explanations and anything already public, never resident or staff details. Business tools your organisation pays for, with a data agreement in place (Microsoft 365 Copilot under a work account is a common example, not a recommendation, and licences and settings vary), are for everyday professional work within your policy. If resident data will go into one, a data protection impact assessment is likely to be needed first, so check with whoever handles data protection for you. Specialist tools built for care records, with the right contracts and a data protection impact assessment, are for anything clinical or sensitive.
Offer a safer option. If staff are using ChatGPT to tidy handover notes, the need is real. Point them to an approved business tool or to features in your care management system, and show them how to use it.
Write a policy and name a champion. DHSC suggests your AI policy sets out who is responsible, how AI use is overseen and who is accountable, and recommends digital champions to support staff. I've put together some free resources to help you draft your own AI policy.

Where to start

None of this needs a big project. It can start with one team meeting and one page. If you want help agreeing the rules, our AI governance guide sets out how to get to a policy your senior team will actually back.

Frequently asked questions

Is it illegal for care staff to use ChatGPT?

The tool itself isn't the problem; what goes into it is. DHSC says free or online AI tools should not be used with personally identifiable information, and the organisation stays responsible for how residents' data is handled.

If staff turn off 'Improve the model for everyone', is ChatGPT safe for resident data?

No. That setting stops conversations being used to train OpenAI's models, but there's still no contract between your organisation and the provider covering that data. Keep resident and staff details out of personal accounts.

Is removing names enough to make it safe?

This relies on your people never making a mistake. What's more, in a small home, a room number, a diagnosis and a date can be enough to identify someone. Use an approved tool your organisation pays for.

Do we need an AI policy if we don't allow AI at all?

Yes. DHSC recommends having an AI policy and sharing it with staff even if AI use is prohibited, so everyone knows where the lines are.