Lesson · 20 min

AI as a Cloud Service

See how AI fits the cloud service models you already know, and what that means for where your data goes.

By the end of this lesson you can

Place AI services within the IaaS, PaaS, and SaaS framework
Explain what happens to a prompt after you submit it
Distinguish consumer AI products from enterprise agreements
Identify what must never be entered into a consumer AI tool

📘 Reading Lesson

Lesson Notes

Read through the key concepts before you try the challenge.

Your prompt is an upload

On the job

You draft a difficult letter at Lakeside Medical Associates.

To get help with the wording, you paste the draft into a free AI assistant. The draft contains a patient's name, date of birth, and diagnosis. That content has now left the practice, been transmitted to a third party, and may be retained — and under the free tier's terms, may be used to improve the service.

Your task: Understand where your input actually goes, before you decide what may be put into these tools.

AI services sit squarely in the models from Module 2. A consumer chat assistant is SaaS — a finished application you simply use. An API a developer builds against is closer to PaaS. Renting GPU capacity to run your own model is IaaS. The same shared responsibility applies at every level: the provider secures the infrastructure, and your data remains yours to govern.

Step	What occurs	Implication
You submit the prompt	Text is transmitted over the internet to the provider	It has left your network
The provider processes it	The model runs in the provider's data center	The content exists on their systems
The response returns	Generated text comes back to you	Fast, and easy to forget a transmission occurred
Retention	Depends entirely on the terms you agreed to	Consumer tiers commonly retain, and may train on, your input

What happens to a prompt

Consideration	Consumer / free tier	Enterprise agreement
Data used for training	Often yes by default	Contractually excluded
Retention	Varies; often indefinite	Defined and limited by contract
Business associate agreement	Not available	Available from some vendors
Administrative control	None	Central policy and audit
Appropriate for PHI	Never	Only under a signed BAA and an approved configuration

Consumer against enterprise AI

Never enter protected health information into a consumer AI tool. Not a patient name, not a date of birth, not a diagnosis attached to any identifiable person — and not a document you have skimmed rather than read. Doing so is a disclosure of PHI to a third party without authorization, and it is reportable. If a task genuinely needs AI applied to patient data, that requires an enterprise agreement, a business associate agreement, and your employer's explicit approval. When in doubt, de-identify completely or do not use the tool.

Worked example

Getting AI help without disclosing anything

Improve the wording of a difficult letter to a patient about a missed follow-up, without transmitting any patient information.

1
Decide what you actually need help with.
You need help with tone and structure, not with this patient's specifics. Naming the real need reveals that the identifying details are not required for the task at all — which is usually the case.
2
Write the request generically, with no identifiers.
'Help me phrase a letter to a patient who missed a follow-up appointment, warm but clear about the importance of rescheduling' contains no PHI whatsoever and gets you the same quality of help.
3
If you need structural feedback on your own draft, replace every identifier with a placeholder first.
[PATIENT NAME], [DATE], [CONDITION]. Do this in a separate scratch copy, not in the real letter, so there is no chance of sending the placeholder version. And read the whole draft while doing it — identifiers hide in sentences you did not write.
4
Apply the suggested wording to the real letter yourself, in your own system.
The AI output is a template. Merging the real details happens inside the practice's systems, where the data belongs. The identifying information never crosses the boundary.

Result: Better wording, with nothing identifiable transmitted to a third party.

Ask for the general help you actually need. The specifics almost never have to leave the building, and taking thirty seconds to strip them is the whole discipline.

Check your understanding

You want help rewording a letter about a patient's missed appointment. What is the appropriate approach?

Challenge

Apply what you've learned in this lesson.

Read the terms you have already agreed to.

Find the data usage policy for an AI tool you use. Determine whether your input is retained and whether it may be used for training. Note how hard it was to find.
Check whether that vendor offers a business associate agreement, and on which tier.
Take a realistic workplace request containing sensitive details and rewrite it as a generic prompt that gets the same help with nothing identifiable.
Draft a three-rule policy for your practice on AI use, covering what may never be entered, what requires approval, and who to ask.

Finished this lesson?

Progress is saved in this browser only. It is not a grade — official progress lives in Brightspace.

← What AI Actually Is Module 7: Working with AI Tools →