Medico-legal risk
and the AI-drafted note

Australian courts and tribunals treat the clinical record as the contemporaneous account of what happened in a consultation. When a complaint or claim arises years later, memories have faded and the note is often the only detailed evidence available. The Medical Board's Good medical practice code, and the equivalent codes for other registered professions, expect clinicians to keep accurate, up-to-date records, and AHPRA holds the individual clinician to those obligations.

An AI scribe changes how the first draft of that note is produced. Responsibility for the finished record stays exactly where it was: with the clinician who signs it. Once a note is signed, the law reads it as that clinician's account of the encounter, whatever tool helped draft it. Explaining a wrong entry by pointing at the software is unlikely to help in a hearing, because the professional obligation was always to review the draft before adopting it.

This cuts both ways. A clinician cannot outsource responsibility to a vendor, and equally, a well-run review-and-sign workflow leaves an AI-drafted note with the same legal standing as a typed one. Most of the medico-legal risk sits in the workflow the practice builds around the tool.

Australian medical defence organisations have engaged with AI scribes directly, and their published guidance is broadly consistent. Used properly, an AI scribe is treated like any other practice tool: professional indemnity responds to claims arising from your practice, and using drafting software does not of itself void cover. The usual conditions apply: obtain and document the patient's consent to recording, review every draft before it becomes part of the record, and apply your own clinical judgement to the content. Cover questions are always policy specific, so the safest step before rollout is a call to your own MDO's advisory service.

The same guidance asks clinicians to understand the tool at a basic level: where audio and transcripts are stored, whether health information leaves Australia, how long drafts are kept, and what the vendor does with the data. None of this requires technical depth. It requires being able to give a straight answer if a patient, a colleague or a tribunal asks how the note was produced and where the information went.

Practice managers have a parallel question at the entity level. If the practice signs the vendor agreement, it is worth checking how practice indemnity and any cyber insurance policy treat the arrangement, and reading the vendor contract's liability and incident-notification clauses before anyone needs to rely on them.

MDO guidance, college guidance and AHPRA's expectations converge on the same principle: nothing an AI scribe produces is a clinical record until a clinician has reviewed it and signed it. The draft has no status of its own. The signature is the act that adopts the content as the clinician's professional account, and it is the point where medico-legal responsibility attaches.

In practice, review means actually reading the draft. Check the history and examination findings against what happened, correct transcription and attribution errors, and add the clinical reasoning an ambient tool cannot infer, such as your interpretation of findings and the basis for the plan. Signing after a skim defeats the protection the review step gives you. Most clinicians settle into a rhythm of reviewing between patients or in a short block at the end of a session, while the consult is still fresh.

The principle also protects the clinician. Because a draft carries no status until it is signed, an error caught during review never enters the record at all. The failure mode that generates real exposure is routine signing without reading, and that is a workflow choice within the practice's control.

Two things are worth documenting. The first is consent. MDO and college guidance consistently advises recording the patient's consent to the consultation being captured, either as a standing consent noted in the file and confirmed at each visit, or as a brief note each time. The second is the fact of AI assistance. There is no blanket legal requirement in Australia to annotate every note as AI-assisted, but a short, consistent statement that the note was drafted with an AI scribe and reviewed by the treating clinician takes seconds to add. It shows the practice was transparent and that review actually happened.

A written practice policy holds this together. It should name the tool in use, who is authorised to use it, the consent script and what happens when a patient declines, the review-before-signing requirement, and the retention settings the practice has chosen. If a dispute arises years later, a dated policy plus consistent notes is strong evidence that the practice used the tool carefully and systematically.

Discovery and subpoena processes in Australian litigation can reach any document relevant to the issues in dispute, and 'document' is read broadly. If audio, a transcript, an unsigned draft or version history still exists when proceedings begin, it can potentially be sought, in the same way early drafts of a letter or an internal email can be. The signed note does not exhaust what a party might ask for. A draft that differs from the signed note is not in itself damaging; review is supposed to change the draft, and the difference is evidence that review happened.

The practical response is a deliberate retention posture. Know exactly what the scribe keeps: the audio, the transcript, intermediate drafts, and how long each survives. Short, defined retention windows for working material reduce the volume of ancillary records and are easier to explain than an ad hoc mix. Retention settings should be a documented decision in the practice policy rather than a default nobody chose.

One caution sits above every retention schedule. Once a practice knows of a claim, complaint or likely proceeding, an obligation to preserve relevant material arises, and deleting drafts or audio at that point can be far more damaging than anything they contain. Routine deletion stops for material connected to a live matter, and if in doubt, ask your MDO or the practice's lawyer before anything is removed.

Errors will occasionally get through. When a signed note turns out to contain a mistake, the correction rules are the same as for any clinical record: add a dated addendum or amendment identifying what was wrong and what is correct, and leave the original entry intact. Practice software keeps an audit trail, and a quiet edit discovered later looks far worse than the error it was meant to fix.

Wrong-patient events deserve their own drill, because a consult attached to the wrong file can put one patient's health information into another patient's record. That is a record-keeping error and potentially a privacy breach at the same time. Correct both files with addenda, and assess the disclosure under the practice's privacy obligations.

For privacy incidents more broadly, the Notifiable Data Breaches scheme under the Privacy Act applies, with the OAIC as regulator. Assess whether the incident is likely to result in serious harm, notify where the threshold is met, and check that the vendor agreement obliges the vendor to tell you promptly about incidents on their side. For anything with claim potential, call your MDO early, before writing anything reactive in the record. Advisory support is part of the membership and an early call is routine.