Weber County reviews draft AI use policy, emphasizes CJIS, HIPAA and PII protections

County staff presented a proposed AI-use policy at the Nov. 3 Weber County Commission work session, urging a ‘‘common-sense’’ approach that protects sensitive data while preserving access to AI-enabled tools in routine software.

The draft policy, explained by staff member Quinn Foward and an AI assistant used in drafting, recommends strict handling rules for criminal justice information (CJIS), health information governed by the Health Insurance Portability and Accountability Act (HIPAA) and personally identifiable information (PII). "We're really focusing on making sure we protect certain types of sensitive data," the AI assistant summarized, listing CJIS, HIPAA and PII as primary categories to avoid uploading to external AI tools.

Why it matters: Staff said AI features are now embedded across phones and mainstream software and that enumerating permitted tools quickly becomes out of date. The proposed policy therefore focuses on the kinds of data that should not be uploaded (for example Social Security numbers, health records and unredacted personnel files) rather than naming a static approved-tool list.

What staff reported: Presenters described past incidents and technical risks, including a widely reported early ChatGPT history glitch and employees who uploaded large batches of resumes to a public AI service. Staff noted paid AI versions typically retain conversation histories in cloud services; some services allow users to delete sessions or opt out of saving history, but retention remains a risk if identifiable data are uploaded.

Social media and human responsibility: The draft includes a disclosure requirement for county social-media posts that are "substantively" generated by AI; staff clarified that minor AI-assisted edits (for example a short caption) would not require the same disclosure. The policy also underscores that humans remain responsible for any final product produced with AI assistance.

Training and next steps: Staff recommended short, targeted employee training that clarifies PII definitions and the county's expectations for CJIS- and HIPAA-handling staff. No formal adoption took place at the work session; staff said the policy will appear on the commission agenda for further consideration.

Evidence: Staff noted the draft borrowed concepts from neighboring counties but moved away from enumerating specific approved tools after those lists quickly became outdated.