Key Highlights: 

• Use only approved AI services for U-M sensitive data (see the Approved AI Tools section in this guide)
• Follow all MM and UM policies and guidelines around safe data use
• Be aware of internal research requirements and policies as well as those of sponsors and outside agencies
• Disclose AI use when appropriate and as directed (e.g., funding agency, journal), or when used in clinical care
• Ensure AI-generated information and code is always reviewed by a human; faculty members must confirm the credibility of reviews
• Only use institutional data classified as low with AI services that do not have a contract or data agreement with U-M (see the U-M Data Classification Levels in Key Resources section in this guide) 

Practices to Avoid 

• Do not assume AI-generated information is correct or current 
• Do not allow AI to replace professional judgment, expertise, or critical thinking
• Do not assume an AI tool is approved, secure, or appropriate simply because it is convenient
• Do not place sensitive data in an AI service unless there is a U-M contract or data agreement in place that permits it
• Do not use AI-generated code for institutional IT systems and services unless it is reviewed by a human, as well as meets the requirements of Secure Coding and Application Security (DS-18) 

GUIDING PRINCIPLES FOR AI USAGE WITHIN THE MEDICAL SCHOOL 

1. Data Protection, Privacy, & Compliance

Protecting sensitive information is a shared responsibility. When using AI tools you are accountable for the secure and compliant use of regulated and sensitive data within these systems, per U-M policies (listed below in Key Resources) and all other applicable laws, regulations, and University policies, including the Health Insurance Portability and Accountability Act (HIPAA), the Family Educational Rights and Privacy Act (FERPA), and other institutional requirements, must be followed by every user.  

• Do not share sensitive data (including PHI) with third party applications unless explicitly authorized
• When authorized, using only the minimum necessary sensitive data (including PHI) for the intended purpose
• Ensuring PHI is accessible only to individuals with authorization or a legitimate need to know
• Verifying AI-generated information before using it in patient care or medical decision-making
• Following HIPAA and institutional data protection requirements
• Complete the following training: MM Institutional Mandatory - AI: An Introduction for Michigan Medicine Employees (UMHS-10001) 

Students, faculty, and staff are expected to use AI tools responsibly and protect the privacy, confidentiality, and consent of others when handling information. Refer to the Sensitive Data Guide to IT Services page for more information on what kinds of data is permitted for use. 

Related University policies: Responsible Use of Information Resources (SPG 601.07), Privacy and the Need to Monitor and Access Records (SPG 601.11), Security of Personally Owned Devices That Access or Maintain Sensitive University Data (601.33), Information Security (601.27), and Institutional Data Stewardship Policy (SPG 601.12). 

 2. Maintain Human Oversight, Transparency, & Accuracy 

AI can support education, research, clinical work, and administrative tasks, but its outputs may be inaccurate, biased, incomplete, or fabricated. AI should assist, not replace, human judgment. You remain responsible for reviewing AI-generated content, making informed decisions, and ensuring its appropriate use. 

Be transparent about AI use when appropriate. Depending on the context, you may need to disclose when AI has been used to support coursework, educational materials, research, or other content.  Consider including an AI Usage Disclosure statement such as: “Created with the assistance of [AI Tool Name] for [e.g., initial drafting / data visualization/slide layout generation]. All outputs were reviewed, edited, and approved by the author/team.” Do not present AI-generated work as solely human-created when that distinction matters. Remember, you are responsible and liable for the AI generated output you use.   

Always verify AI-generated information using trusted sources, especially clinical, legal, regulatory, or policy-related topics. Review content for accuracy, bias, accessibility, and appropriateness before using or sharing it. 

3. Appropriate Academic Use 

Academic and instructional requirements may vary. Students are responsible for following course, program, and instructor expectations regarding AI use in assignments, assessments, and scholarly work. Faculty should communicate AI use expectations clearly within courses and learning activities. 

APPROVED AI TOOLS 

Use of pre-approved AI vendors and technologies is the recommended approach for incorporating AI into U-M work. The following tools are optimized and approved: U-M Gen AI Services provided by ITS and M365 Copilot.  

U-M GPT, U-M Maizey, and U-M GPT Toolkit Services and M365 Copilot are approved for use with data classified as high (e.g., PHI). Faculty, staff, and students are responsible for knowing when the use of AI tools is prohibited (e.g., grant reviews, manuscript reviews). These tools are designed for use within the U-M environment, and usage data are not shared with external developers or used to train public models. For this reason, U-M users should use these approved AI resources and must not enter institutional data into public AI services. Third-party AI tools may only be used with institutional data classified as low, unless otherwise formally approved. Users are responsible for confirming the appropriate data classification before using any public AI tool (see U-M Data Classification Levels for descriptions and examples of each data classification). Continue to consult the Safe Computing Guide for updates regarding the approved data sensitivity for AI tools. 

All other AI tools are subject to shared responsibility, appropriate use requirements, and institutional security review. OpenClaw is currently blocked, and additional tools may be blocked in the future based on security, privacy, compliance, or operational risk. 

If you are uncertain whether a specific AI tool is appropriate for your use case, contact MM Information Assurance before using it. Use of U-M information technology resources carries an individual responsibility and obligation to comply with university policies, security requirements, and applicable laws and regulations. 

GETTING AI TOOLS APPROVED 

As with any technology, you must follow established processes on how to buy or incorporate new technology. AI tools are subject to the same information security standards and protocols as any new technology.  

Partner with HITS or another Trusted IT Service Provider (TSP). TSPs are the only entities authorized to develop and/or manage applications, manage IT vendors, or anything related to IT delivery at Michigan Medicine. You can contact HITS at help.medicine.umich.edu. 

KEY RESOURCES 

• MM Institutional Mandatory - AI: An Introduction for Michigan Medicine Employees (UMHS-10001)
• Related General IT and Security Policies
  • Responsible Use of Information Resources (SPG 601.07)
  • Privacy and the Need to Monitor and Access Records (SPG 601.11)
  • Institutional Data Stewardship Policy (SPG 601.12)
  • Security of Personally Owned Devices That Access or Maintain Sensitive University Data (601.33)
  • Information Security (601.27)
  • Michigan Medicine Incident Response Policy
  • Secure Coding and Application Security (DS-18) 

• Related MM AI Guidelines, Policies, and Information
  • KB Article: Using Artificial Intelligence (AI) Tools at MM
  • Guideline on Generative Artificial Intelligence Tools at MM
  • Michigan Medicine Appropriate Clinical Use of Generative Artificial Intelligence Tools Policy 

• Related U-M AI Guidelines, Policies, and Information
  • Generative AI at U-M
  • Use U-M GPT
  • Use U-M Maizey
  • Please read and review ITS AI Services Terms of Service before using any AI software. 

• Sensitive Data Guide to IT Services
  • Artificial Intelligence and U-M Data
  • Sensitive Data Guide for ITS AI Services
  • See U-M Data Classification Levels for descriptions and examples of each data classification 

FAQs 

Q: Should I cite AI? 

A: Depending on the academic, research, or publication context, users should always follow instructor, journal, disciplinary, and institutional requirements. Any type of AI use in  

Q: Can I enter PHI into AI tools?

A: Use only approved AI services for U-M sensitive data. Refer to the Sensitive Data Guide to IT Services page for more information on what kinds of data is permitted for use, which varies by service. 

Q: What types of sensitive data can I use with U-M Gen AI Services provided by ITS? 

A: High. Refer to the Sensitive Data Guide to IT Services for more information. 

Q: Is there a way to receive notifications on updates and changes to the U-M Gen AI Services provided by ITS? 

A: Yes. Join ITS-AI-Services-Notify to receive email updates on ITS AI Services.