What Do You Have to Tell Patients When AI Touches Their Care?

The question practices ask is whether they need a consent form. The more useful question is which principle is doing the work, because the answer changes what you say, when you say it, and whether a signature helps at all.

Which privacy principles actually apply to an AI tool in a consult?

Four. Australian Privacy Principle 3 covers collection, APP 6 covers use and disclosure, APP 8 covers cross-border disclosure, and APP 11 covers security of what is stored (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

Most practice conversations collapse all four into "do we need consent". They are separate obligations and a tool can satisfy one while failing another.

A tool can have flawless consent wording and still fail APP 8 because the processing happens offshore.

Do you need consent, or is telling them enough?

Consent, in most circumstances. Health information is sensitive information, and under APP 3 sensitive information generally requires consent, collected only for purposes the individual would reasonably expect (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

The reasonable expectation test is the part that bites. A patient cannot reasonably expect a tool they were never told about, so silence does not leave you with implied consent, it leaves you without the expectation the principle depends on.

Using an AI scribe without informing the patient likely breaches APP 3.

When should a patient be told?

Before the consultation, not during it. Telling someone at the moment the recording starts puts them in a position where declining is socially awkward, which is a poor foundation for consent.

For established patients meeting the tool for the first time, notification by letter, email or SMS ahead of the appointment gives them time to consider it and to ask questions, with verbal confirmation at the consult itself.

New patients can be told at intake, in the same place other collection notices sit.

What should the notice actually say?

Three things, in plain words: that a tool is used, what it does with what it hears, and that they can decline without it affecting their care. That last clause is the one that makes the first two meaningful.

Naming the vendor dates the notice the moment you change products. Describing the function lasts longer.

If the processing happens overseas, that belongs in the notice too, because APP 8 governs disclosure to overseas recipients and is a separate obligation from consent to collect (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

Can the recording be used for anything else?

Only for the purpose it was collected for, unless a further exception applies. APP 6 restricts secondary use, and health information processed through an AI tool is subject to the same secondary purpose restrictions as health information collected any other way (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

This is where model training becomes a live question. If a supplier uses consultation data to improve their product, that is a secondary use, and it needs to be surfaced rather than buried in terms.

Ask the supplier directly and keep the answer with the approval record.

Does a signed form solve it?

Not on its own. A signature evidences that a conversation happened; it does not make the underlying handling lawful, and it does nothing for the separate cross-border and security obligations in APP 8 and APP 11 (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

Practices sometimes reach for a form because it feels like the safe artefact. The safer artefact is a data path you can describe accurately.

Use the form to record the conversation, not to substitute for it.

What about the privacy policy itself?

It has to say this. APP 1 requires a clearly expressed and up to date privacy policy, and the OAIC's position is that practices should disclose when they use AI tools that process personal information, what types, and what information is processed (Source: OAIC, Australian Privacy Principles, Privacy Act 1988).

There is also a dated obligation coming. Privacy policies must disclose whether the organisation uses automated decision-making that significantly affects individuals by December 2026 (Source: OAIC, Privacy Act reforms, in effect December 2026).

That is a documentation change most practices can make in an afternoon, once they know which tools are in use.

What if a patient says no?

The consultation proceeds without the tool, and that has to be genuinely available rather than nominally offered. A practitioner writing notes by hand is the fallback, which is what happened before the tool existed.

Record the refusal so it is not re-asked at every visit. Being asked repeatedly to consent to something you declined reads as pressure.

Ahpra's expectation that practitioners meet their existing code of conduct obligations when using AI includes the consent obligations that already applied (Source: Ahpra, Meeting your professional obligations when using Artificial Intelligence in healthcare).

Where do practices get this wrong?

The most common failure is a notice that describes the vendor rather than the handling. Patients do not need the product name, they need to know what happens to what they say.

The second is treating consent as a one-off. A tool whose intended purpose changes has changed what the patient agreed to, and the notice has to move with it.

The third is assuming the supplier's consent template fits. It was written for their product across every customer, not for your data path.

If you want the patient-facing flow written for your practice rather than a generic template, the Patient Policy Flowchart is written by a person within 48 hours. The governance framework it sits inside is in AI governance for Australian healthcare providers.

Sources: OAIC, Australian Privacy Principles, Privacy Act 1988. OAIC, Privacy Act reforms, in effect December 2026. Ahpra, Meeting your professional obligations when using Artificial Intelligence in healthcare.