AI tools and patient data privacy: What the Australian Privacy Act means for your practice
Artificial intelligence
print
Share:
As artificial intelligence (AI) tools become more widely used in clinical practice, it’s important to understand your obligations under patient data privacy laws.
From AI scribes that draft consultation notes to image analysis tools that support diagnosis, AI is quickly reshaping clinical workflows.
In fact, two in five Australian GPs are using AI scribes — a rate that nearly doubled in just over a year, from 22% in August 2024 to 40% in November 2025, according to the Royal Australian College of General Practitioners (RACGP).
But as more patient information is collected, processed and generated by AI tools, it’s increasingly important for GPs to understand how Australian health data laws apply.
This guide explains what GPs need to know about privacy risks of AI in Australian healthcare — and practical steps for safeguarding patient data.
How privacy laws apply to Australian doctors using AI
All health information is considered ‘sensitive information’ under the Australian Privacy Act 1988, so privacy and security are paramount.
“The Privacy Act applies to any personal information inputted into an AI tool, as well as in the outputs generated or inferred by AI,” a spokesperson for the Office of the Australian Information Commissioner (OAIC) explains.
In practice, this means Australian doctors using AI tools must meet the following requirements:
- Informed consent: Patients must consent before an AI tool collects their health information.
- Transparency: Your practice’s privacy policy should disclose the use of AI tools, including whether patient data could be used for secondary purposes like AI model training.
- Accuracy: Doctors remain responsible for the accuracy of all health information collected or generated by AI.
- Security: Healthcare providers must take reasonable steps to protect patient information and remain accountable for any breaches.
Additional state and territory laws
Beyond the Australian Privacy Act, dedicated state and territory laws may also apply.
Recording a private conversation — as an AI scribe does — without consent is a criminal offence in some Australian jurisdictions. It’s important therefore to check the specific requirements that apply where you practice.
Before using an AI tool: A checklist for GPs
Meeting your privacy obligations starts with choosing an AI tool carefully.
“When healthcare providers are looking to adopt an AI product, they should take a ‘privacy by design’ approach and conduct due diligence to ensure it is suitable for their intended use case,” the OAIC spokesperson advises.
The following checklist — based on guidance from the OAIC, the RACGP and the Australian Commission on Safety and Quality in Health Care (ACSQHC) — can help ensure you’re set up to use AI safely and responsibly.
- Is the AI tool appropriate for clinical use? Consider its intended purpose and how it’s been developed. Are you confident there’s enough evidence to support its accuracy, safety and effectiveness?
- How will you ensure accuracy? AI can ‘hallucinate’ and make mistakes. Decide how you will review AI-generated outputs for accuracy, quality and completeness.
- Do you have a policy for how staff will use the tool? Developing clear guidelines and procedures will help ensure everyone in your practice is consistent in responsible AI use.
- What security protections are in place? Know how the AI tool protects your data and who has access to it. As the OAIC guidelines highlight, doctors remain accountable for any patient data privacy breach, even if it originates with the vendor.
- Does the AI tool store or process data overseas? Under Australian health data laws, overseas data storage is permitted only if the vendor meets equivalent privacy and security standards. If this isn’t clear, ask the vendor to confirm in writing.
- Is your data being used for any other purpose? Some tools use your data to train their own models, or on-sell it to third parties. Your practice’s privacy policy must disclose if this is the case.
- Do you have a process for obtaining patient consent? Patient consent laws require you to obtain consent before using AI tools that touch sensitive information. It’s good practice to document this in your patient records.
- Can you explain to patients how the AI tool is being used? Be prepared to explain in plain language the purpose, scope of use, and your processes and safeguards for any AI tool you’re using.
- Is your privacy policy up to date? Your privacy policy should clearly explain how you collect, use, store and disclose patient information, including when using AI tools.
Maintaining safe and responsible AI use
AI tools are constantly evolving, and GPs using these tools in clinical practice should continue to review how they’re safeguarding patient data.
“Due diligence for AI healthcare tools should not amount to a ‘set and forget’ approach,” the OAIC spokesperson advises.
“Regular reviews of the performance of an AI product, staff training and monitoring should be conducted throughout the entire AI product lifecycle to ensure it remains fit for purpose and compliant with privacy obligations.”
Quick reference: AI tools and patient data privacy
- The Australian Privacy Act 1988 applies to all patient information entered into an AI tool, as well as in outputs generated or inferred by AI.
- All patient information is considered ‘health information’, which is classified as ‘sensitive’ and therefore held to strict requirements.
- Informed consent and transparency are key requirements for doctors using AI. Make sure your privacy policy is up to date.
- GPs are accountable for safeguarding patient data, which includes how the AI tool stores and handles it.
- Doctors must ensure the accuracy of patient information collected, generated or inferred by AI.
The information provided in this article is for general informational purposes only. It does not, and is not intended to, constitute legal advice.
Rebecca Howden is a freelance writer and health communications specialist based in Melbourne.
Loading comments…
Authored byRebecca Howden
Opinions
Voluntary assisted dying7 September 2026
The Northern Territory has just voted to legalise voluntary assisted dying. Here’s how it will work
News
Neurodiversity7 September 2026
Autism experts still in the dark on Thriving Kids initiative
Opinions
Women’s health7 September 2026
Iron deficiency and the Medicare gap in women’s health
Opinions
Respiratory disease7 September 2026
Pulmonary fibrosis is becoming more treatable
Explainer
General practice7 September 2026
GP referrals to specialists: A practical guide for Australian doctors
