AI compliance for health practices
AI compliance for Australian health practices, whatever the practice's turnover
The small business exemption most Australian businesses rely on does not reach a practice that provides a health service and holds health information. Size is not the test. So when an AI scribe starts sitting in consultations, every privacy obligation you already had is engaged, immediately.
Health information is also sensitive information, which carries a higher bar than ordinary personal information. That is the specific reason this sector cannot treat AI adoption as a productivity decision.
General information about Australian obligations, not legal or clinical advice.
Does the Privacy Act apply to a small health practice?
Yes. The small business exemption does not apply to an organisation that provides a health service to an individual and holds health information other than in an employee record. Annual turnover is irrelevant to that. A sole-practitioner physiotherapist holding patient records is covered on exactly the same terms as a large clinic.
The OAIC reads "health service provider" broadly. It covers medical and dental practices, allied health such as physiotherapy, psychology and occupational therapy, telehealth businesses, counselling and drug and alcohol services, and organisations where providing a health service is not even the main activity. If your business holds health information about people it has treated or assessed, assume it is covered.
This matters for AI because a great deal of published AI guidance is written around the assumption that a small business can decide how much privacy compliance to take on. A practice cannot. The obligations were already there and an AI tool brings them straight into the consulting room.
See the OAIC's Guide to health privacy and What is a health service provider? Also relevant: state health records legislation in New South Wales, Victoria and the Australian Capital Territory sits alongside the Commonwealth Act.
AI scribes and transcription: what to settle before, not after
Ambient documentation tools are the fastest-spreading AI use in Australian practices, and for good reason. They give clinicians back time and they reduce the after-hours notes burden. They also introduce a third party into every consultation, which is a decision the practice makes once and lives with.
-
What the tool receives, and for how long
Whether audio is retained or discarded after transcription, how long transcripts and summaries are kept, and whether a practice administrator can control any of that. Ask specifically about audio, because it is often handled differently from text.
-
Where the processing happens
If consultation content is processed outside Australia, APP 8 applies to that disclosure and you generally remain accountable for what the overseas recipient does with it. Patients frequently have views about this and are entitled to know.
-
Whether the content is used to improve models
Get the answer from the provider's current documentation for the plan you are on, and record where you found it. This is the question most likely to have a different answer for the free trial than for the practice subscription.
-
What the patient is told, and when
Health information is sensitive information, which generally requires consent. The OAIC is explicit that consent cannot be implied merely from a notice of collection. Work out what your practice says, when it says it, and what happens if a patient declines.
-
Who reviews the note before it becomes the record
A generated summary is a draft until a clinician has read it. Once it is in the file it is what the next clinician relies on, and APP 10 accuracy obligations attach to it. The review is not a formality.
-
What happens to third parties in the conversation
Family members, carers and interpreters are in the room and in the recording. Their information is being collected too.
-
Who in the practice approved it
A named person, on a date, with the assessment recorded. If a scribe was adopted by an individual clinician on their own account, the practice has a governance gap rather than a technology problem.
Software as a medical device is a separate question
Documentation and transcription tools are administrative. Software intended for diagnosis, screening, monitoring or treatment decisions may be regulated as a medical device by the Therapeutic Goods Administration, which is a different regime with its own requirements. If a tool is making or materially informing a clinical judgement rather than writing down one already made, check its regulatory status before it is used in patient care.
Where AI shows up in a practice, and what each one raises
| Use | What it raises |
|---|---|
| Ambient scribing in consultations | Sensitive information, consent, third parties present, overseas processing, accuracy of the resulting record. |
| Referral and report drafting | Clinical detail leaving the practice management system. Whether the receiving clinician knows a draft was AI-assisted. |
| Summarising a patient history | Bulk upload of a file. Far more exposure than a typed question, and the least examined. |
| Correspondence and recalls | Names and clinical context in outbound communication. Accuracy matters because it reaches the patient. |
| Website chatbot or booking assistant | A collection channel. Patients should be able to tell they are dealing with AI, and it should not give clinical advice. |
| Coding, billing and claiming support | Financial and health information together, plus accuracy obligations that carry their own consequences. |
| Triage or prioritisation | A decision affecting a person's access to care. The highest-risk band, and the one to approach most slowly. |
| Rostering and HR tools with AI features | Employee information, and work health and safety considerations if it influences workload or performance. |
| AI features inside practice software | Your data handling changed without a procurement decision. Check what a vendor update switched on. |
How this usually starts
A six-practitioner allied health clinic
One clinician trials an AI note-taking tool and it works. Two months later four practitioners are using it, one on a personal subscription from the trial. Nobody assessed the provider. The clinic's privacy policy predates the tool and describes storage in the practice management system only. Patients have not been told.
What is going well
- Notes are completed on the day rather than at night
- Clinicians are more present in consultations
- The summaries are genuinely good
- Nobody has done anything unreasonable
What has quietly become true
- Health information is processed by an unassessed third party
- The published privacy policy is now inaccurate
- Patients were not told and did not consent
- One practitioner's account is outside clinic control
- Nobody can say where consultation content is stored
The fix is not to stop using it. It is to choose one tool, assess it, put it on a clinic account, decide what patients are told and when, confirm who reviews notes before they are filed, update the policy to match, and write down that all of that happened. About a day, and the clinic keeps the benefit.
What a practice should be able to produce
If a patient complains, a health complaints body asks, or the OAIC makes an enquiry, these are the things that answer the question of what the practice had in place.
- Which AI tools the practice has approved, with who approved them and when.
- The provider assessment, including retention, processing location and training use, with sources.
- What patients are told, in what form, and how consent is handled where it is required.
- A current privacy policy that reflects the tools actually in use.
- Collection notices that cover AI-related purposes and disclosures.
- Staff acknowledgement of the rules about what may go into an AI tool.
- Training completions by name, covering the AI-specific failure modes.
- The clinical review rule: who checks an AI-generated note before it is filed.
- MFA and access control on every AI account, with departures handled.
- Incident records, including any breach assessment where information went somewhere it should not have.
- A review date against each of the above, owned by a person.
The practice manager usually owns this, and usually alone
In most practices the compliance work sits with one person alongside rostering, billing and everything else. Cleverer holds the organisational layer so it does not depend on that person remembering.
Providers recorded as what they are
The supplier register flags whether a vendor involves health information or other sensitive information, records storage country and offshore disclosure, and carries a business owner, a review owner and a next review date.
Policies with acknowledgement
An AI Governance Policy and a Privacy and Data Handling Policy built from the practice's own answers, with adoption, audience and named acknowledgements rather than a document on a shared drive.
Breach assessment when it is needed
A structured notifiable data breach workflow, so an exposure of health information is assessed and recorded at the time rather than discussed and forgotten.
Cleverer does not connect to your practice management system, review clinical content or make clinical judgements. It is the compliance record around the practice's decisions. It does not guarantee legal compliance, and no platform can.
Which AI tools are in your consulting rooms right now?
Ask without consequences attached, and expect a scribe somebody trialled, a summariser inside the practice software and at least one personal account. Everything else on this page depends on that list. The Readiness Check tells you what the rest of the practice's compliance position looks like.
Questions from Australian health practices
Does the Privacy Act apply to a small allied health practice?
Yes. The small business exemption does not apply to an organisation that provides a health service to an individual and holds health information other than in an employee record. Turnover does not affect this. Allied health professionals including physiotherapists, psychologists and occupational therapists are covered.
Can we use an AI scribe in consultations?
Practices do, and the tools are useful. What has to be settled first is which tool the practice has approved, what the provider does with the audio and transcript, where it is processed, what patients are told and how consent is handled, who reviews the note before it is filed, and whether any of that is written down. Health information is sensitive information, so the consent question is not a formality.
Do patients have to be told an AI tool is being used?
Handling sensitive information generally requires consent, and the OAIC says consent cannot be implied merely because someone was notified of a collection. Separately, the OAIC's AI guidance expects businesses to be transparent about AI use in their privacy policies and notifications. In practice a clinic needs a clear position on what it tells patients, when, and what happens if someone declines.
Is an AI-generated clinical note acceptable?
As a draft that a clinician reviews and corrects before it becomes the record, it is documentation like any other. Filed unread, it is a clinical record produced by a system that can be confidently wrong, which engages accuracy obligations and creates real risk for the next person who reads it. The review is the control.
What if a clinician started using a tool on their own account?
Treat it as a governance gap rather than misconduct. Establish what was used, for how long, and what the provider does with the content. Assess whether health information was disclosed without authorisation and whether that meets the notifiable data breach threshold. Then decide what the practice approves and tell everyone.
Are AI tools regulated as medical devices?
Some are. Software intended for diagnosis, screening, monitoring or influencing treatment decisions can fall within the Therapeutic Goods Administration's remit for medical device software, which is a separate regime from privacy. Administrative tools such as transcription and correspondence drafting generally do not. Check the status of anything that is doing clinical work rather than clerical work.
