Choosing an AI scribe in Australia: what to check

An AI scribe listens to a consultation and drafts a clinical note. It can save time, but it records a conversation, handles health information and produces text for a legal record. Choosing one is a clinical governance decision, not only a software purchase.

This guide sets out what to check before you adopt one, with notes for paediatric practice. It is general information, not legal advice. Confirm your own obligations with your professional indemnity insurer, your college or association, and the regulators named below.

What does "safe for patient privacy" actually mean?

Safe does not mean a vendor says so. It comes down to questions you can ask and verify:

• Where is the data stored and processed?
• Is the audio kept, and for how long?
• Is the patient asked before recording starts?
• Does a clinician review and approve the note before it enters the record?
• Is patient data used to train the vendor's models?

The Office of the Australian Information Commissioner (OAIC) says privacy obligations apply to personal information entered into an AI system and to AI output that contains personal information. Health information is sensitive information under the Privacy Act, so the bar is higher than for ordinary data.

Where is the data stored and processed?

The Australian Commission on Safety and Quality in Health Care (the Commission) states that the audio and summary from an ambient scribe contain personal and sensitive information under the Privacy Act, and that these data must be stored and processed in Australia unless the patient has given explicit consent for offshore management.

The RACGP says personal data should ideally be stored in Australia, and that if it goes overseas the vendor must ensure comparable privacy protections; where a vendor cannot give that assurance, it advises avoiding the product.

A tool can store notes in Australia while sending audio or text to an overseas service for transcription or summarising. Ask about every step, including any third-party AI model the vendor relies on. The OAIC also points to overseas disclosure (Australian Privacy Principle 8) as a reason to check where servers are.

Is the audio kept?

The RACGP notes that most AI scribe providers do not store captured audio. "Most" is not a guarantee, so confirm it in writing.

If audio is deleted, find out when. If it is kept, ask who can access it and how it is secured. Less stored data means less to lose in a breach, which matters when a recording includes a child's voice and a family's circumstances.

Does the tool ask for consent before recording?

Ahpra says informed consent is generally needed for a generative AI scribe, and that the software should include an explicit consent requirement as an initial step, and recommends noting the patient's response in the health record. Ahpra also warns that recording a consultation without consent may have criminal implications under state and territory surveillance device laws. The RACGP and the Commission make the same point about those laws.

The OAIC adds that consent for sensitive information must be informed and specific, and cannot be implied merely because someone was notified.

In paediatric care, work out in advance:

• Who consents. For young children this is usually a parent or guardian. For older children and adolescents, consider whether they can understand and agree for themselves, and how you handle disagreement between a young person and a parent.
• Who else is in the room. Siblings and interpreters may be recorded. Say so at the start.
• What happens on a "no". The Commission asks organisations to decide how they will handle consent not being given, consistently across all clinicians. Have a plan for writing the note without the scribe.
• Withdrawal. The TGA notes patients can withdraw consent at any time and should be offered another way of recording.

Check that the tool makes consent a step in the workflow, not something that depends on someone remembering.

Does a clinician review the note before it enters the record?

Ahpra states that the practitioner is responsible for checking the accuracy and relevance of records created using generative AI. The RACGP says AI scribes may not always create factually correct or complete notes and that notes should be reviewed as soon as possible after each consultation.

The Commission explains why: scribes can produce "hallucinations", including fabricated diagnoses, omitted or added treatment steps and confused similar words.

Look for a design where nothing reaches the record until the clinician has read, edited and approved it. In paediatrics, read closely for ages, doses, weights, who said what (parent or child), and statements about safety or wellbeing.

Does the TGA regulate the scribe?

It depends on what the product does. The TGA says not all digital scribes are medical devices; whether the TGA regulates one depends on its intended purpose.

According to the TGA, a scribe that only records, transcribes, translates, summarises or drafts documentation, without adding clinical content or suggestions the health professional did not state, is not a medical device. A scribe is likely to be one if it identifies, recommends or suggests diagnoses or treatments, prioritises or triages patients, or generates clinical conclusions. Devices must be included in the Australian Register of Therapeutic Goods (ARTG) before supply, unless exempt.

Two points to carry into your evaluation:

• Marketing counts. The TGA says intended purpose is judged from the product's labelling, advertising and presentation, and that a general disclaimer such as "not for diagnosis" does not settle the matter if medical claims are made or device-like features are present.
• Features change. The TGA expects developers to reassess when updates add functions. The Commission notes that a scribe suggesting a diagnosis or treatment not discussed with the patient may trigger the need for ARTG inclusion.

The TGA tells clinicians to check the ARTG using the manufacturer's name and to reassess after software updates. Ahpra adds that TGA approval does not remove your duty to apply your own judgement.

What about record-keeping and de-identification?

An AI-drafted note is still your clinical record, with the same duties on accuracy, security, access and retention. Retention rules differ between states and territories, so confirm yours.

Ask also whether your data is used to train or improve the vendor's models. Ahpra suggests finding out whether recorded patient data is also used to train the AI model. The RACGP notes that vendors may use collected data for secondary purposes and that some use de-identified data to improve services, so read the user agreement.

De-identification is not a switch. Removing a name is often not enough, because other details can still identify someone. That is especially true for children with rare conditions or in small communities. Ask what is removed, by what method, and who may use the result.

A checklist for your evaluation

• Data is stored and processed in Australia, at every step, or offshore handling needs explicit patient consent.
• The vendor states whether audio is kept, for how long, and who can access it.
• Consent is a required step before recording, and the response can be noted in the record.
• You have a process for a parent, guardian or young person who says no, or withdraws.
• Nothing enters the health record until a clinician reviews and approves it.
• The product does not suggest diagnoses or treatments, or you have confirmed its TGA status.
• The vendor confirms whether your data is used for model training, and in what form.
• You have completed a privacy impact assessment, which the OAIC recommends and the Commission suggests considering.
• Your privacy policy and collection notices explain the scribe, and patients are told through signage, forms or booking.
• Your practice has a written policy on permitted tools and on reporting errors and breaches.
• Your indemnity insurer has confirmed cover for AI use.
• You will review performance over time. The OAIC says due diligence should not be "set and forget".

Related reading

For how Ahpra's expectations apply in paediatric practice, see Ahpra's AI guidance for paediatric practice. For why general-purpose chatbots are a different risk from a purpose-built scribe, see ChatGPT and patient information privacy in Australia.

Syntropic Health's scribe asks for consent before every recording, keeps no audio and processes in Australia; the clinician reviews and signs every note. See clinical notes.

Sources

• ahpra.gov.au
• oaic.gov.au
• tga.gov.au
• racgp.org.au
• safetyandquality.gov.au