Government warns Australian clinics over AI transcription tools' patient privacy risks

Australia's federal health department issued a formal privacy caution this week directed at medical practitioners using artificial intelligence scribing tools during patient consultations, signalling that the technology's rapid uptake has outpaced any regulatory framework designed to govern it. The warning, released through the Office of the Australian Information Commissioner, reminds clinicians that recordings made by third-party AI platforms may be stored on overseas servers, potentially outside the reach of the Privacy Act 1988.

The timing matters. AI scribes, software that listens to a doctor-patient conversation and automatically generates clinical notes, have moved from novelty to near-ubiquitous inside two years. Tools including Nabla, Heidi Health and Dragon Medical One are now being used in general practices, emergency departments and specialist rooms across the country. For a healthcare system still grinding through post-pandemic backlogs and a GP workforce stretched thin, the productivity appeal is obvious: practitioners report cutting documentation time by 30 to 40 minutes per shift, freeing them for more patients.

Sydney Clinics Already Deep Into the Transition

The technology has embedded itself across Greater Sydney with particular speed. Western Sydney Primary Health Network, which covers suburbs from Blacktown to Penrith and coordinates care for roughly one million residents, confirmed this year that a growing number of its affiliated practices had independently adopted AI scribing without network-wide policy guidance in place. At Westmead, clinicians at several outpatient services attached to Westmead Hospital have trialled transcription tools alongside existing electronic medical record systems, according to NSW Health's own digital health strategy documents published in 2025.

Inner-city practices have not been slower to move. Several bulk-billing clinics along Parramatta Road in Camperdown and in the Surry Hills medical precinct have advertised shorter appointment times as a benefit, partly enabled by reduced note-taking burdens. The pitch to patients rarely mentions that their spoken words about symptoms, medications and mental health may be processed by a server in the United States or the United Kingdom before the consultation ends.

That is precisely what has regulators worried. The OAIC guidance issued this week spells out that consent requirements under the Australian Privacy Principles apply to the collection of health information by AI tools just as they do to paper records. Consent, the guidance stresses, must be explicit, informed and documented, not buried in a clinic's general terms-of-service form at reception.

What the Privacy Warning Actually Requires

The practical obligations are not trivial. Practices must identify where data is stored, confirm whether the AI vendor has a data processing agreement that meets Australian standards, and be able to demonstrate they have told patients clearly that a third-party system will process their conversation. For smaller suburban practices operating on tight margins, the average Medicare rebate for a standard Level B consultation sits at $42.85 following the most recent indexation, the compliance cost of auditing technology contracts is a genuine burden.

The Australian Medical Association has been tracking the issue and, without the OAIC's formal guidance having been matched by binding regulation, the field remains one of professional self-governance for now. The My Health Record system, operated by the Australian Digital Health Agency, does not currently integrate with most AI scribe platforms, meaning the notes generated exist in a parallel ecosystem with its own security questions.

For patients with appointments coming up, the OAIC's advice is straightforward: ask your clinic before the consultation begins whether an AI tool will be used, how the recording is stored and whether you can opt out without affecting the quality of your care. Clinics cannot legally require consent to AI processing as a condition of receiving medical treatment. Patients who believe their information has been mishandled can lodge a complaint directly with the OAIC through its online portal, a process that carries no fee. The federal government has signalled it will release a fuller regulatory framework for AI in healthcare settings before the end of 2026, though no legislation has been introduced to parliament yet.