A VA medical record can contain diagnoses, family details, identifiers, medication history and information about other people. "Secure," "private" or "HIPAA-compliant" on a sales page does not tell you what happens to a particular PDF after upload. Before using any AI tool, ask for the processing path, how long both the source file and the result are kept, who can access them, how to delete them, and what the analysis actually covers.

Claim Raven sells AI tools that read claim documents, so it has a commercial interest in this topic; the same checklist applies to it. This is a purchasing checklist, not a security audit or legal certification, and provider configurations change. A health-data label, a model-training opt-out or a consent toggle does not by itself remove every retained copy.

First, decide whether the upload is needed at all

If the question is general, use VA's evidence guide or ask a question without attaching records. If the question is about a sentence in a decision, one selected document may be enough. A whole C-file analysis needs the actual file and has a much larger data footprint than a single-letter read. A summary of one selected record is not a review of your complete history, whatever the product calls it.

Do not remove a page that changes the medical context just to fit an upload limit. Ask the vendor whether a smaller excerpt will answer your narrow question and what warning it gives if left-out pages could change the conclusion. For a broader review, first request your C-file from VA if you do not have it, and list the files you hold. Keep unaltered originals offline.

The pre-upload checklist

Ask the vendorWhy the answer mattersWhat a usable answer looks like
Which company operates the product, and which AI, text-recognition, hosting, storage and support providers receive my text, image or file?A product can use several processors even if only one brand appears.A current list of named providers, or clear categories by feature, with a place to check for changes.
Is my original PDF stored? Are extracted text, prompts, chat history, screenshots and findings stored separately?Deleting a report may not delete its source or every intermediate copy.A feature-by-feature list of what is kept, and a delete control for each.
Is any content used to train models? Which product tier, API agreement and opt-in or opt-out apply?Consumer chat and business API terms can differ.Current terms for this exact processing path, not a blanket "AI never trains" slogan.
How long does the company keep the source, the report and backups? How long can a processor keep a safety or abuse copy?"30 days" may describe one log, not your saved record.Separate retention periods, with stated exceptions for legal holds, safety review and backups.
Who can access the content for support or quality review, and how is that access logged or limited?Encryption alone says nothing about human access.Written roles, purposes and controls, not only a badge.
What happens if I turn off AI consent, delete one scan, close my account or disconnect a VA connection?These are different actions with different effects.A step for each, confirmation that deletion from active systems is complete, and stated limits for providers and backups.
What pages and formats can the tool read, and how are text-recognition failures reported?Privacy exposure without adequate coverage is a poor trade.Page and file limits, unreadable-page warnings, source references and a list of what was analyzed.

Save a copy or dated screenshot of each answer and the terms you accepted. If a record includes another person's information, make sure you have the authority to share it. Never send a VA.gov password, a sign-in code or a complete record in an ordinary support email.

Apply the checklist to every vendor, including Claim Raven, whose answers for its own AI features are in its AI vendor data FAQ.

"HIPAA-compliant" is not the same as "protected"

HIPAA applies to particular kinds of organizations and their business relationships, not to a document because it is medical. Whether it covers a given app is a legal question about that company, so a medical record in a consumer tool is not proof of a HIPAA relationship. The reverse also holds: a company outside HIPAA can still owe you privacy duties under its own terms and other laws. Ask what the company commits to in writing rather than relying on the label.

Consumer ChatGPT and a specialized tool are different data arrangements

OpenAI's data-use page says content from its services for individuals, such as ChatGPT, may be used to train its models unless you opt out, and that it does not train on business products such as ChatGPT Enterprise and the API by default. Its Temporary Chat guidance says a temporary chat is not used to improve models while it stays temporary, that OpenAI may keep a copy for up to 30 days for safety purposes, that saving the chat later applies your regular settings, and that data sent through a GPT action to a third party follows that recipient's policy. None of this is a promise about a saved file, a custom GPT's action or every account type. How to check a ChatGPT answer about a VA claim covers the accuracy side.

A specialized claims product may offer source-page references, a saved work area or different processor agreements. Those features can help the work and also create different storage. Read the specific vendor's current notice before deciding it is safer or riskier than a consumer chatbot; this article makes no head-to-head security claim. To compare the tools themselves, see what to compare in AI tools for VA claims.

A practical stop-or-go decision

Test the output with a harmless sample before you submit private material. If the vendor cannot say who receives the file, what is kept, how to remove it, or whether the product reads the pages your task needs, stop and ask for a written answer. If the answer is clear but you find the disclosure unacceptable, use VA guidance, a trusted treating clinician or a VA-accredited representative instead. A VSO's claim help is free; ask that office how it handles records too.

If you do upload, send the minimum material that keeps the relevant context, check the file list and cited source pages in the result, download what you need, and use the actual delete control when the work is done. Keep the confirmation. An AI finding is a lead to verify in the original record, not a diagnosis, a medical nexus or a VA decision.

Sources and limits

Checked September 23, 2026: OpenAI's data-use page and Temporary Chat guidance; VA's records request, evidence and accredited help pages; Claim Raven's AI vendor data FAQ. Provider configurations, notices and terms change; check them before sending sensitive records.