Patient Privacy and AI Tools: Questions to Ask First

Why does patient privacy come first?

Names, phone numbers, appointment dates and anything about someone's health are personal information. Once typed into a tool, they may leave the clinic's control. The questions below help you find out where they'd go.

This page isn't legal advice. Rules differ by country, and the official source is the one to follow.

What should a clinic ask before using an AI tool?

Ahpra's guidance for health practitioners lists what to understand about a tool. It says to understand how data is used to retrain the AI, where it's located and how it's stored.¹ Turn that into questions for the maker or the tool's terms:

• Is what we type kept, and for how long?
• Is it used to train the tool for other customers?
• In which country is the data held?
• Can the clinic delete it, and who can see it?
• Is there a business plan with different terms from the free version?
• What happens if the maker has a data breach?

Write the answers down with the date. Terms change.

What's the problem with free public chatbots?

Ahpra gives an example when it discusses practitioners recording consultations: if public generative AI software is used, personal information becomes public domain.¹ Our own precaution is to keep patient details out of public tools altogether.

So a sensible habit is to keep patient details out of public tools altogether. Use blank templates, as in the reminder template advice.

Should patients be told?

Ahpra says practitioners should tell patients about their use of AI and consider any concerns raised.¹ That's guidance for registered practitioners in Australia. A clinic can follow the idea in its privacy notice and at reception, in words patients understand. Who writes that notice, and what it must contain, comes from your regulator and adviser.

Which official bodies set the rules?

It depends where the clinic is. Go to the body's own pages and read them, not a summary from a tool maker.

In Australia, the Australian Privacy Principles replaced two older sets of principles under the Privacy Act.² The OAIC publishes the current text.

In the United States, HIPAA applies to covered entities. The 2013 Omnibus Rule update extended the Security Rule and Breach Notification requirements to business associates.³ A business associate is an outside company that handles protected health information for a covered entity. An AI maker could fall into that category depending on the setup, which is a question for the HHS pages or a US adviser.

Other countries have their own regulator. Find yours and read it.

Who in the clinic is responsible?

Someone must be named. Under HIPAA, covered entities must train all staff in procedures for protected health information.³ That's a US rule, but the idea is sound anywhere: write a short staff rule for AI tools and train people on it. At minimum, say which tools are allowed, which data must never go in, and who to ask.

What about insurance?

Ahpra says to consult your insurance provider if you're unsure whether AI tools used in your practice are covered.¹ That's about professional indemnity insurance. If a tool changes how the clinic handles patient information, ask the insurer, and keep the reply on file.