A clinic's AI use policy needs three rules before anything else. Patient information never goes into a tool the clinic has not approved, nothing listens to a consultation until the patient has said yes, and a person reads anything AI writes before it is filed, sent or published. Those three rules follow the published guidance from Ahpra, the Office of the Australian Information Commissioner (OAIC) and the Australian Commission on Safety and Quality in Health Care, and the rest of the policy (which tools are approved, for what, and what happens when something goes wrong) is built around them.
This is general guidance for Australian allied health clinics, drawn from the sources listed at the end. This is not legal advice.
The three rules
- Patient information never goes into a tool the clinic has not approved. The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools (OAIC, Guidance on privacy and the use of commercially available AI products). Health information is sensitive information.
- Nothing listens to a consultation until the patient has said yes. Ahpra's guidance says AI scribes that use generative AI generally require the patient's informed consent, ideally noted in the health record (Ahpra, Meeting your professional obligations when using AI in healthcare).
- A person reads anything AI writes before it is filed, sent or published. Ahpra's guidance is that the practitioner remains responsible for safe, quality care whatever technology is used, and the Commission's guide asks clinicians to review AI outputs for accuracy and correct any errors (ACSQHC, AI Clinical Use Guide, August 2025).
Which tools are approved and for what
The simplest way to make the first rule usable is a short table in the policy itself, so nobody has to guess at the front desk. A typical one looks like this.
| Tool | Approved for | Patient information |
|---|---|---|
| General purpose AI on a free or personal account | Admin and marketing drafts, rewording, research | Never |
| The clinic's own organisation account, approved by the owner | Policy questions, internal documents, email drafts for a person to check | Only what the policy allows, after the owner has checked where the data is stored and whether it trains the model |
| An AI scribe the clinic has approved | Clinical notes, checked and signed by the practitioner | Only with the patient's consent, asked each time |
| AI features inside software the clinic already uses | Only once the owner has reviewed and switched them on | As the policy sets for that tool |
The Commission's guide makes the same point for small practices. It advises using only AI tools that are authorised or supplied by the organisation, notes that this applies to sole traders and smaller organisations as well, and asks clinicians to confirm that personal and sensitive information is stored and processed in Australia, or overseas only where equivalent privacy and security standards are met.
What must never go into a general purpose tool
- Names, dates of birth, addresses, phone numbers and email addresses of patients.
- Medicare, DVA, NDIS, WorkCover and private health numbers.
- Clinical notes, referral letters, reports and imaging results.
- Photos or videos of patients.
- Anything else that could identify a patient, even with the name taken off.
Ahpra also asks practitioners to understand whether patient data is used to train an AI model. Free and personal accounts are the hardest place to be sure of that, which is why the policy keeps patient information out of them entirely.
AI scribes need consent first
An AI scribe records or listens to a consultation and drafts the clinical note. Ahpra's guidance says scribes that use generative AI generally need the patient's informed consent, that the response should ideally be noted in the health record, and that recording a consultation without consent may have criminal implications. It suggests transcription software builds an explicit consent step in at the start.
The Commission's ambient scribe scenario and clinical use guide add that the clinician should tell the patient about the scribe at the start of the consultation, explain its risks and limitations, offer the chance to discuss alternatives, and remain responsible for the accuracy of the note that goes into the record (ACSQHC, AI safety scenario, ambient scribe). So the policy says who asks, when, how a no is respected, and where the answer is recorded.
Admin, marketing and website content
Most of a clinic's AI use is here, and most of it involves no patient information at all. Drafting a newsletter, tidying a policy document or rewording a page on the website is a good use of a general purpose tool. Two things still apply. A person reads it before it goes out, and anything that advertises the clinic still has to meet the Ahpra advertising guidelines, which an AI tool will not check for you.
AI does not make clinical decisions
The Commission's guide asks clinicians to treat AI as decision support and to watch for automation bias, the habit of trusting a tool's output over your own judgement. It also notes that an AI tool used for diagnosis, monitoring, prediction or treatment meets the definition of a medical device and must comply with Therapeutic Goods Administration (TGA) regulation. The policy says plainly that diagnosis and treatment decisions belong to the practitioner.
AI features inside software you already pay for
New AI features turn up in practice management, email, phone and office software as part of an ordinary update. The policy treats each one like a new tool. The owner checks what it does with patient information before it is switched on, and the approved tools table is updated so staff know it is allowed.
When something goes wrong
The policy names who staff tell, straight away, if patient information has gone somewhere it should not have, or an AI tool has produced something wrong that reached a record or a patient. The Commission's guide lists where serious issues go from there. Adverse events from a medical device go to the TGA, breaches of personal and sensitive information go to the OAIC or the relevant state or territory privacy regulator, and actual or potential harm goes to the relevant health complaints authority.
How FFP writes one in the program
FFP writes one in month one of the AI program, before any AI tool goes into daily use. It is written with the owner, in plain language, around the tools the clinic actually runs. The clinic adopts it as its own policy, and each staff member reads and acknowledges it. It sits beside the setup described in how AI can help a physio clinic's reception without talking to patients. This is not legal advice, and the policy is the clinic's to own and keep current.
Straight answers
Can staff use ChatGPT with patient information?
Not on a free or personal account. The OAIC recommends, as best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. Health information is sensitive information. A clinic can approve a business account for more, but only after checking where the data is stored, who can see it and whether it is used to train the model.
Do we need a patient's consent to use an AI scribe?
Generally, yes. Ahpra's guidance says AI scribes that use generative AI generally require informed consent from the patient, and that the practitioner should ideally note the patient's response in the health record. Recording a consultation without consent may also have criminal implications, so the policy should make the question part of the start of every consultation where a scribe is used.
Does a small clinic really need an AI use policy?
Yes, and it can be short. The Australian Commission on Safety and Quality in Health Care notes that smaller organisations may need to set up their own governance so AI tools are used safely, and that its advice to use only tools the organisation has authorised applies to sole traders and small practices too. A one page policy the whole team has read does more than a long one nobody opens.
Who is responsible if an AI tool gets something wrong?
The practitioner. Ahpra's guidance is that the practitioner remains responsible for safe, quality care whatever technology is used, and the Commission's guide says clinicians remain responsible for the accuracy of records and documentation an AI tool produces. That is why the policy says a person reads everything AI writes before it is filed, sent or published.
Is this page legal advice?
No. It is general guidance drawn from published Ahpra, OAIC and Commission material. A clinic with a specific question about its privacy obligations should check the source guidance and get advice for its own situation.
Sources
- Ahpra and the National Boards, Meeting your professional obligations when using Artificial Intelligence in healthcare
- Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products (October 2024)
- Australian Commission on Safety and Quality in Health Care, AI Clinical Use Guide, Guidance for clinicians, Version 1.0 (August 2025)
- Australian Commission on Safety and Quality in Health Care, AI safety scenario, ambient scribe
FFP Digital Pty Ltd, ABN 85 696 412 692, Ipswich QLD. Text David on 0459 567 884 or email hello@ffpdigital.com.au.