Coos County adopts generative AI use policy, urges caution on sensitive data

The Coos County Board of Commissioners approved a generative AI usage policy on May 6, 2025, and signed resolution 25-04-072-L effective May 6, 2025.

The policy sets guidelines for employee use of generative AI tools, warning that information entered into public systems can become publicly accessible and recommending that staff avoid placing personally identifiable, HIPAA-protected or criminal-justice information into public AI services. Caroline (HR), who led policy drafting with IT and safety staff, told the board she kept the policy separate from the employee handbook to allow faster updates as AI capabilities change and to make distribution to staff simpler.

Darius (IT) told commissioners that public AI tools can expose data and introduce biases, and he recommended staff always review AI-generated content before publishing and disclose when AI assisted in creating material. Commissioners asked for cross-references from the employee handbook to the AI policy and discussed whether departments with sensitive data—Coos Health & Wellness (HIPAA) and the sheriff’s office (criminal-justice information)—should require additional acknowledgments or obtain private AI contracts that prevent data sharing.

Commissioners discussed practical mitigations staff could use immediately: strip names and other identifiers before uploading prompts, use initials or generic labels (for example, “client” or “inmate”), and consider paid private AI environments for analyses involving claims or protected data. Caroline said the county will publish the policy to the HR web page and intranet and will reference it in onboarding; final decisions about mandatory acknowledgments would be coordinated with the county counsel and department heads.

The board voted to approve the policy; the motion carried. The board also directed implementation actions including staff notification and training planning, without placing a formal requirement in the employee handbook at this time.

The policy is codified in resolution 25-04-072-L and will be available to employees through HR channels.

Less critical details: commissioners and staff agreed on the need for department-level follow-ups for HIPAA and CJIS data and discussed the option to pursue private AI contracts if departments determine public tools present unacceptable risk.