Health data is
sensitive information

The Privacy Act 1988 (Cth) applies to personal information generally, but the Australian Privacy Principles carve out a narrower category called sensitive information, and health information sits inside it alongside things like genetic information and biometric data. The practical effect of that classification is that the default rules for collecting personal information do not apply on their own. Collection of sensitive information generally needs the individual's consent, with defined exceptions such as providing a health service or responding to a threat to someone's life or health. Everything else in the Australian Privacy Principles, the rules on use, disclosure, security and access, still applies on top.

For a practice, this means the classification is not academic. It sets the consent threshold for every point where health information is collected, including a consult recording that becomes the source material for a clinical note. The Office of the Australian Information Commissioner (OAIC) administers the Act and publishes guidance on exactly this question, and it is the body a patient can complain to if they believe their health information was mishandled.

Standard personal information can often be collected on the strength of a clear notice at the point of collection, with an opt out available for some secondary uses. Sensitive information is held to a stricter standard: a practice generally needs the patient's consent to collect it in the first place, not just a chance to object afterwards. That distinction matters the moment a device in the room starts recording a consult. The patient is not just the subject of a note anymore, they are a party whose sensitive information is being captured in a new form, and that new form needs its own, plainly stated consent at the point it happens, not buried in a form signed months earlier at registration.

In practice this tends to work best as a short, spoken exchange before the recording starts: what is being recorded, what it becomes (a draft note, letter or summary), who reviews it, and that declining does not affect the care the patient receives. A practice that can point to that exchange, and to a record that it happened, sits in a materially stronger position than one relying on a line in an intake pack nobody reads.

None of this changes what makes a clinical record adequate. AHPRA's expectations for record keeping and the Medicare Benefits Schedule's requirement for contemporaneous, clinically relevant notes sit alongside the privacy rules, not instead of them. A note drafted from an ambient recording becomes the practice's clinical record once a clinician has reviewed it, corrected it where needed and signed it. Until that happens it is a draft, not a record, and the distinction is not a technicality: it is what keeps the practice able to answer for what is in the file.

The underlying audio is a separate question again. It is sensitive information in its own right, and a practice needs a clear view of how long it is kept, who can reach it, and when it is disposed of. Retention periods for health records themselves vary by state and by whether the patient was a minor at the time of the consult, so a practice's retention policy for recordings should be set deliberately, not left to whatever a vendor happens to default to.

Storage location is a genuine privacy question, not a technical footnote. A practice should be able to say plainly whether consult audio, transcripts and drafts are held in Australia or offshore, whether they are encrypted at rest and in transit, and which staff at the vendor, if any, can view identifiable content and under what conditions. Australian Privacy Principle 8 covers disclosure to overseas recipients, and the effect is that a practice generally remains accountable for how an overseas recipient handles health information it has disclosed, unless a specific exception applies. Sending identifiable health information offshore does not hand off the privacy obligation, it usually just adds a layer the practice has to manage.

None of this overlaps with My Health Record, which the Australian Digital Health Agency operates as a separate, patient controlled system. A scribe drafting a local clinical note is not writing to My Health Record, and a practice should not assume that one satisfies the other.

A practice does not need to become a privacy lawyer to evaluate a scribe vendor, but it should be able to get direct answers to a short list of questions before signing anything.

• Where exactly is the data stored, and does that include backups, not just the primary copy.
• Is the original audio kept after the note is drafted, and if so for how long, and can the practice choose to have it deleted sooner.
• Who at the vendor can access identifiable content, under what conditions, and is that access logged.
• Is any consult data used to train models beyond improving the output for that same practice.
• What happens if the practice ends the contract: is data exported, and is it then deleted on a defined schedule.
• Is there an audit trail showing who viewed or edited a note, and for how long is that trail kept.

RACGP standards for general practices treat consent and record keeping as a matter of practice culture, not paperwork alone, and that is the right frame for an AI scribe. The strongest version of consent happens out loud, at the start of the consult, in language the patient actually understands: recording is starting, here is what it becomes, here is who checks it, and choosing not to proceed does not change the care on offer. A practice that builds this into its normal opening minute will rarely have to think about it again. One that treats it as a box ticked once at registration is the one that gets asked hard questions later.

It is worth updating the practice's own privacy policy and collection notice to name the new collection point too. Patients are entitled to know, in general terms, that consults may be recorded and drafted with the help of a documentation tool, and folding that into the existing notice is a small task that closes an otherwise obvious gap.