AI Underway
Guide · Privacy

Using AI with patient records in Australia.

A practical checklist for clinics and medical-legal practices choosing an AI tool or vendor. General information, not legal advice.

Before using AI on patient records in Australia, a practice should confirm where the data is processed and stored, that the AI provider does not train models on it, that a clinician reviews every output, and that the AI has only the access it needs, with every action logged. Health information is sensitive information under the Privacy Act 1988, and the practice remains accountable for how its vendors handle it.

Book a 15-minute callSee pricing and the savings calculator →

The rules that apply

  • Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health information is "sensitive information" and gets extra protection. Health service providers are generally covered regardless of size.
  • APP 8, cross-border disclosure. If a vendor sends records offshore, your practice can remain accountable for what happens to them there.
  • APP 11, security. You must take reasonable steps to protect records from misuse and unauthorised access.
  • Notifiable Data Breaches scheme. Eligible breaches must be reported to the OAIC and affected people.
  • State laws. Some states have their own health records law, for example the Health Records Act 2001 in Victoria.
  • Professional guidance. Ahpra and the National Boards published guidance in 2024 on meeting professional obligations when using AI in healthcare. The OAIC published guidance in 2024 on privacy and commercially available AI products.

Nine questions to ask any AI vendor

  1. In which country and cloud region are records processed and stored?
  2. Do any AI model providers see the data, and are they contractually barred from training on it?
  3. Does a clinician or staff member approve every output before it is filed or sent?
  4. What exact permissions does the AI have in our practice system? Can it delete anything?
  5. Is every action the AI takes logged, and can we see the log?
  6. How long is data kept, and how is it deleted on request?
  7. Who monitors errors, and how fast are they fixed?
  8. If we stop, what do we lose? Are our records still in our own system?
  9. Who do we call when something goes wrong?

How AI Underway answers them

  • Australian cloud regions by default. If a service must process data offshore, we tell you before it is used.
  • AI providers on terms that exclude your records from training.
  • A person at your practice approves every output.
  • Least-privilege access, and every action logged.
  • Monitored every day; fixing errors is part of the monthly fee.
  • Your records stay in your own software. Stop any time without losing anything.

This page is general information, not legal advice. For your own obligations, speak with a privacy adviser or see the OAIC website.

Questions

Common questions

Does the Privacy Act apply to small clinics?

Generally yes. Health service providers that hold health information are covered by the Privacy Act 1988 and the Australian Privacy Principles regardless of turnover. Check your own position with a privacy adviser.

Can patient data be processed overseas?

It can, but Australian Privacy Principle 8 means the practice generally stays accountable for what happens to it offshore. Many practices prefer Australian cloud regions to keep this simple.

Is it safe to paste patient notes into a public chatbot?

The OAIC's guidance on commercially available AI products recommends against entering personal information, particularly sensitive information, into publicly available generative AI tools.

Do clinicians stay responsible for AI-drafted notes?

Yes. Ahpra and the National Boards' guidance on AI in healthcare says practitioners remain responsible for the care they provide and the records they keep, including when AI drafts them.

Last updated 9 November 2026

AI clinical notesAI worker that drafts consult notes in your template and files them into Cliniko or Nookal. The practitioner approves every note. English and Mandarin. Medical-legal chronologiesAI worker that reads scanned records and builds a dated medical chronology with page references, then drafts report sections for the doctor to sign. AI scribe or AI worker?An AI scribe drafts notes in its own app. An AI worker runs the whole task inside your practice system. When each makes sense, with honest trade-offs.
Book a 15-minute call

Tell us the task your team hates most.

Send a few lines and we will reply within one business day with whether it fits and a time to talk.

  1. What the task is and what it produces
  2. Who does it, and roughly how many hours a week
  3. Which software it touches

也可以用中文填写。 You can write in Mandarin too.

We use these details only to reply to you.

Prefer email?