AI documentation and
practice accreditation

General practice accreditation runs against the RACGP Standards for general practices, assessed by an agency approved to operate under the National General Practice Accreditation Scheme, which the Australian Commission on Safety and Quality in Health Care administers. It is voluntary in law and close to universal in practice, because accreditation is a condition of Practice Incentives Program payments, and it runs on a three year cycle. Indicators in the current edition are written as things a practice shows or demonstrates, so an intention to document well counts for nothing without the record proving it was acted on.

Your agency books the assessment with you, so the timing holds no surprises. What catches practices is accumulation, because the evidence has to have built up across the cycle. A policy written the week before the visit looks like one, and so does a training register where every entry carries the same date. Plan as well for who gets asked. Surveyors put similar questions to different people, so the person explaining your AI documentation arrangements is as likely to be a receptionist as the manager who wrote the policy. The gap opens there, when the document exists and nobody in the building has read it.

Practices outside general practice sit under different schemes that ask for the same things. Hospitals and day procedure services are assessed against the NSQHS Standards, where Clinical Governance and Communicating for Safety carry most of the weight for a documentation tool, and since July 2023 those assessments run on short notice, which removes the window to assemble a folder at all. Other primary and community healthcare services can be assessed against the Commission's National Safety and Quality Primary and Community Healthcare Standards. What an assessor asks about a scribe barely changes across any of them.

The edition most practices are still assessed against was written before ambient scribes were in consulting rooms, so no criterion in it carries the words artificial intelligence. That is not an exemption. A surveyor reaches the tool by following the ordinary questions about records, security, privacy, patient rights, training and governance, and each of those carries its own criteria and its own evidence.

AI documentation therefore cannot belong to whoever introduced it. Records sit with the clinicians, information security with the practice manager or an external IT provider, the privacy policy with whoever maintains it, and training with whoever runs induction. A tool reaching all four needs one person who can speak to the whole of it, because that is how the assessment will encounter it. These are the six places a surveyor meets a scribe.

• Content of patient health records. Each encounter has to be recorded accurately and comprehensively and be identifiable to the person who made the entry. A drafted note a clinician signs is that clinician's note.
• Information security. A scribe adds a processor of health information, so the questions are access control, who can open a draft, what happens to a departing clinician's account, and where the data sits.
• Privacy and confidentiality. Patients have to be told what happens to information about them, including disclosure to a third party that processes it for the practice.
• Rights and needs of patients. A patient who declines the recording gets exactly the same consultation, and staff have to know that without being told twice.
• Education and training of clinical and non-clinical staff. Reception fields the first patient question about the tool more often than the GP does.
• Practice governance and risk management. Which tools are approved, who approved them, what happens when one fails, and how incidents are recorded.

Spread across that many criteria, one tool produces evidence that different people usually own separately, which is how half of it goes missing. Give it a single owner and a single file, kept current through the cycle rather than assembled in the fortnight before the visit. Every item below needs a date on it, and the policy needs a named owner and a review date, because an undated policy invites the question of whether anyone has read it since the tool was installed.

• The approved AI documentation policy, naming the tools actually in use. An assessor checks the version, the approval and review dates, and whether those names match what clinicians are running today.
• The patient notice and where it appears: the waiting room, the practice information sheet, the privacy policy at the desk, and the published version on the website.
• Vendor due diligence in writing. Where data is stored and processed, retention and deletion for audio and transcripts, whether recordings or notes train the vendor's models, which subcontractors touch the data, breach commitments, and the contract itself.
• Training records. Who was trained, on what, against which version of the policy, and when, including new starters, locums and registrars.
• An incident log covering what went wrong and what was done about it, including any privacy incident assessed under the Notifiable Data Breaches scheme and the outcome.
• Note audit results: dates, sample sizes, what was found, and what changed as a result.
• A register of who can use the tool, tied to onboarding and offboarding so an account closes when a clinician leaves, and the decision record showing when the practice adopted it and who approved it.

The Australian Privacy Principles require a practice to notify patients about the collection of their information at or before the time it is collected, or as soon as practicable afterwards, covering who is collecting it, why, who it may be disclosed to and whether it goes overseas. They also require a privacy policy that is clearly expressed, up to date and available free of charge. Every private health service provider is covered regardless of turnover, because the small business exemption does not reach a business that provides a health service and holds health information.

Three documents do different jobs. The waiting room notice and the practice information sheet warn patients before they are in the room with the door shut. The privacy policy carries the detail: the categories of information involved, the fact that a service provider processes the content of consultations, where it is held and how long the audio is kept. The spoken statement in the room is the consent itself, and it is where the patient gets a real chance to decline. The published policy is where this comes apart, because practices update the printed copy at the desk and leave the website version, which is the one patients and surveyors read.

RACGP guidance on AI scribes states that GPs must obtain consent before using a scribe in a consultation, that practices should give patients information about the tools in use and how they work, and that where the tool does not capture consent itself the GP can take it verbally and record it in the consultation notes. Record it there rather than only in the vendor's console, because the clinical record is the one an insurer, a surveyor or a court reads years later. A patient who says no still gets the consultation, documented the old way, and reception has to be able to arrange that without going to find the GP.

The training criteria cover clinical and non-clinical staff, and an assessment tests them by asking a staff member a question. Reception hears the first patient question about the tool, usually a version of what is that listening to me. A receptionist who has to go and find someone is a finding. One who answers in a sentence and knows how to flag a patient who would rather not be recorded is evidence the training landed.

Training that produces evidence covers a short list: what staff say to a patient who asks, how a refusal is handled and recorded, what a clinician does when a draft contains content belonging to the previous patient or something said before consent was taken, and who to tell when the tool behaves oddly. The record is plain. Name, date, topic, the version of the policy they were trained against, and a signature. A vendor webinar sits alongside practice training rather than replacing it, because the assessment tests your policy rather than the product's features.

Registrars need a position of their own. RACGP guidance discourages AI scribe use by first term registrars, on the basis that GPs in training should develop clinical documentation skills before handing the drafting to a tool. If your practice teaches, say in the policy who may use a scribe at which stage and who approves that, and put the supervisor's conversation in the training record.

Every practice using a scribe will tell an assessor that the clinician reviews and signs every note. The question that follows is how the practice knows, and it is where an otherwise complete file falls down. Your clinical software records who authored and saved each note and when, and the scribe's own audit trail shows when a draft was created and when it was accepted. Neither shows judgement being applied. A note audit comparing what the tool drafted with what was signed, on a sample, is the only source that does.

Design the audit so it can find something. Sample per clinician rather than per practice, because review discipline varies by person and a practice level average hides it. Read for what an unedited draft looks like: a symptom listed that was never asked about, an examination line that reads like the patient's own words, a heading left empty, a dose that does not match the chart. A dozen notes signed inside two minutes at seven in the evening tells you the same thing from the other direction.

Run it monthly while the tool is new, then quarterly, and write down what was found and what changed. The audit doubles as a continuous quality improvement activity of the kind the Standards already expect, so the work counts twice. It also separates the practice's obligation from the individual's. Ahpra and the National Boards have published guidance on artificial intelligence in healthcare which holds the practitioner responsible for what a tool produces under their name. Accreditation covers the practice, while the registration consequences of an unreviewed note land on the clinician who signed it.

The RACGP consulted on a second draft of the sixth edition in September 2025 and piloted it in general practices, including self assessments and discussions with surveyors during accreditation visits. The draft restructures the Standards into four mandatory standards covering the foundations of general practice, clinical governance, patient participation and continuous quality improvement, with an optional point of care testing standard. Indicators become criteria and the old musts become sub-criteria, which changes the language a surveyor uses more than it changes the work. The college has said practices will be able to seek accreditation against either the fifth or the sixth edition for a period after publication, and that it will confirm the length of that period beforehand, so criterion codes are the wrong thing to organise around for now. Ask your accrediting agency which edition your next assessment runs against.

The substantive change for documentation is a group of criteria on artificial intelligence, applying to any practice using AI in clinical or administrative work. A separate draft criterion on digital health technologies asks for informed consent processes, a documented process for assessing, implementing and managing those technologies, and access to technical expertise for the practice team. A scribe sits inside both descriptions. Little of this is new work if the file described above exists, but two items are worth checking now. The deidentification criterion asks what leaves the practice and in what form, which is answered from vendor due diligence rather than from a sentence in a policy. The requirement to discuss AI with the practice team turns an informal rollout conversation into something you have to be able to show.

In the second draft, the artificial intelligence criteria ask the practice to do the following.

• Facilitate processes for the clinical team to obtain and document informed consent when aspects of care will be delivered using AI.
• Clearly define that clinicians are accountable for care decisions supported by AI tools, and document the processes supporting their clinical oversight.
• Facilitate deidentification or anonymisation of data when using AI tools that process patient data.
• Discuss the implementation and use of AI with the practice team to identify practical implications and training needs.
• Hold a process to assess and evaluate the use of AI, including risk mitigation.

Undeclared tools are the hardest part of this to answer for. A clinician using a personal account on a consumer product sits outside every document in your file, and a policy on its own does not find them. What does is a register of approved tools, an approval route quicker than going around it, and a periodic check of what is actually installed and logged in. The rest of the assessment is predictable enough to rehearse with the people who will be asked.

• Which AI tools are in use here, who approved them, and how would you know if a clinician had signed up to something else?
• Where is the consultation audio and the transcript held, for how long, and who can retrieve it?
• Show me the consent for this patient.
• Show me a note this tool drafted, and tell me what you changed before you signed it.
• The vendor tells you it has had a breach. Who do you notify, and in what timeframe?
• A vendor update changes how the tool writes. How would the practice notice?
• What do you say to a patient who says no, and what happens on a day the tool is unavailable?