Consent for AI documentation,
done properly.
Disclose it, record it, honour a no.
What the law expects.
A plain-language summary of the two Australian Privacy Principles that bear most directly on AI-assisted documentation. It applies to any AI scribe, not only aurii. Read them alongside your own obligations under the Privacy Act 1988.
Collect only what you need, and get consent for sensitive information
An AI scribe captures the consult, and a clinical record is sensitive information under the Privacy Act. Collecting sensitive information generally needs the patient's consent, and it should be reasonably necessary for the care you are providing. In practice that means recording the consult to draft the note, nothing beyond it, and asking first.
OAIC guidance on APP 3Tell the patient at, or before, the point of collection
APP 5 asks that a patient is told what is being collected and why, at or before the time it happens. For an AI scribe that is a brief disclosure at the start: that a tool will help draft your notes from the conversation, that you read and sign everything, and where the information is held. Said once, clearly, before you begin.
OAIC guidance on APP 5Health information carries specific protections. The OAIC sets out how the Privacy Act treats it, including consent, access and correction. Start here: OAIC on health information
What good practice looks like.
The law sets the floor. In a busy clinic the workable version fits into four habits, none of which slow the consult down.
- Disclose briefly, at the start. A sentence before you begin is enough: what the tool does, that you read and sign everything, and where the data is held. It is a disclosure, not a consent form to fill in.
- Once per episode, where appropriate. A first appointment warrants the full sentence. For a known patient on a course of care, a lighter reminder is usually enough. Use your judgement about when it needs saying again.
- Record that you asked. A short line in the note that consent was given for AI-assisted documentation turns a verbal exchange into part of the record. If it is ever questioned, the record shows the conversation happened.
- Honour a no, without friction. If a patient would rather you did not, document the visit the way you always have. Declining should cost the patient nothing and change nothing about their care.
What RACGP alignment means
The RACGP has published guidance on AI scribes that speaks to disclosure and consent. aurii is designed to fit the way it describes safe use. That is what "aligned" means. It does not mean the RACGP has reviewed or endorsed aurii, and we will never claim it has.
The consent conversation stays between you and your patient. aurii supports the habit; it does not run it for you.
RACGP guidance on AI scribesWords that work.
Short, verbatim scripts you can use as they are, or shape to your own voice. Each covers the disclosure and the ask in one breath.
"I use a tool called aurii that drafts my notes from what we discuss. I read and sign everything. Your information stays in Australia. Are you comfortable with that?"
"I have a documentation tool listening so I can face you rather than the screen. I check and sign every note. All good?"
"That is completely fine. I will write my notes the usual way for this visit."
Adapt the wording to your setting and your patient. The point is not the exact phrasing, it is that the disclosure is clear, the patient can decline, and the record shows you asked.
How this works in aurii.
The conversation is yours. aurii is built so the workflow supports it rather than getting in the way.
Consent-dependent features stay off until consent is recorded
aurii gates its consent-dependent workflow at the module level: the parts that rely on a patient having agreed do not run until that is captured. It is a real, shipped control, not a checkbox you can talk past. Alongside it: your data is held in Australia (Sydney primary, Melbourne backup), and a named clinician reviews and signs every document before anything is filed. The scripts above reflect exactly how aurii behaves.
- Consent-dependent workflow gated at the module level
- Data held in Australia: Sydney primary, Melbourne backup
- A named clinician reviews and signs every document
- Every action written to a tamper-evident, 7-year audit
This page is general information, not legal advice. Privacy obligations turn on your own circumstances. Check your obligations under the Privacy Act 1988 and any state or territory health-records law, your medical defence organisation's advice, and your hospital or practice policy before you rely on any of it.
Ask the question.
Record the answer.
If you want to see how consent, review and signing fit together on a real round, request access and try it on your own workflow.
hello@aurii.com.au
Stay in the loop.
Leave your email and we'll be in touch. No spam, unsubscribe any time.