Putting patient data into ChatGPT is a HIPAA question, not a policy preference. What a BAA changes, what de identification really requires, and the safer path.