The short version
- Starts 10 December 2026. It is the new APP 1.7–1.9, added by the Privacy and Other Legislation Amendment Act 2024.
- General practices are covered. The small business exemption does not apply to health service providers that hold health information.
- It is a disclosure rule, not a ban. Where it applies, your privacy policy must describe the personal information used and the kinds of decisions involved.
- A doctor in the loop does not automatically take a tool out of scope. A program whose recommendation is a key factor in a decision can still count.
- Start with an inventory. Most practices use more software that sorts, scores or recommends than they realise.
This is general information, not legal advice. The OAIC has said it will publish guidance on these amendments during 2026; check the APP 1 guidelines for the latest, and have your policy reviewed by your adviser or medical defence organisation.
What the new rule says
APP 1 already requires every APP entity to keep a clearly expressed, up-to-date privacy policy. The 2024 amendments add a new trigger. It applies when all three of these are true:
- You have arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect an individual's rights or interests.
- Personal information about that individual is used in the operation of the program.
When the trigger is met, your privacy policy must describe:
- the kinds of personal information used in the operation of those programs;
- the kinds of decisions made solely by the operation of a computer program; and
- the kinds of decisions where a program does something substantially and directly related to making the decision.
"Decision" is read broadly: it includes refusing or failing to decide, and it applies whether the outcome helps or harms the person. The examples given for a significant effect include access to significant services or support, and rights under a contract or arrangement.
Does it apply to a general practice?
Almost certainly, in the sense that you must check. Businesses with an annual turnover of $3 million or less are usually exempt from the Privacy Act, but that exemption does not extend to an organisation that provides a health service and holds health information. A general practice is an APP entity at any size, so the new APP 1.7 obligations apply whenever the trigger above is met.
Whether it is met depends on the software you use and what it does, not on whether it is marketed as "AI".
Where automated decisions show up in a GP clinic
Ask of each tool: does it decide, or shape a decision, about a patient's access to care, a service or money? Some common examples, from more to less likely to be in scope:
| Tool | What it does | Worth assessing because… |
|---|---|---|
| Online triage or symptom checker | Routes a patient to an urgent slot, a routine slot, or elsewhere | It can shape or decide access to care |
| Automated booking rules | Offers, limits or refuses appointments by patient attributes | A refusal is a decision about access to a service |
| Risk scoring or recall prioritisation | Ranks patients for outreach, care plans or programs | A patient left out of a program is affected |
| Billing tools that recommend items or fees | Suggests what to charge or claim | It affects what a patient pays or can claim |
| Debt and payment automation | Flags accounts, restricts bookings for unpaid fees | Contractual rights and access to care |
| AI scribe | Drafts clinical documentation for a clinician to review | Depends on what it produces. See the next section |
Many of these tools come from your PMS, booking provider or a plug-in. You will need answers from those vendors to describe them accurately.
Where AI scribes fit
An AI scribe that records a consultation and drafts a note for the clinician to check and sign is, on its face, a documentation tool. The clinician makes the clinical decisions. That makes it a weaker candidate for APP 1.7 than, say, a triage tool that routes patients.
Two cautions, though:
- Human review is not a blanket exclusion. Commentary on the amendments notes that a program which recommends, guides or categorises can still be "substantially and directly related" to a decision where its output is a key factor. A scribe that proposes diagnoses, treatments or billing items is doing more than documentation.
- This rule is not the only one. Separately from APP 1.7, medical defence organisations such as Avant expect patients to be told about a scribe, and to consent before a consultation is recorded. The TGA has also said that a digital scribe going beyond transcription and summary, for example proposing a diagnosis or treatment, may be a regulated medical device.
So the useful question for your vendor is not "is this AI?" but "what does it produce, and does any of it recommend a decision about the patient?"
How Curaeon approaches this. Curaeon's scribe drafts the Subjective, Objective and Plan sections of a note and stops there: it does not write an Assessment, and it does not suggest MBS items. Billing staff search the Medicare schedule themselves, and the clinician signs off every note. It runs on an appliance inside the practice, so the recording and the draft stay on your network. We designed it this way for clinical and regulatory reasons. It does not replace your own assessment under APP 1.7. How the on-premises scribe works →
A five-step checklist before 10 December
- List your software. PMS modules, booking and triage, recalls, billing, payments, the patient app, the scribe, and any plug-ins. Include tools individual doctors use on their own.
- Ask each vendor five questions.
- What personal information does the tool use?
- Does it make any decision about a patient on its own?
- Does it recommend, rank, score or categorise patients or options?
- Where is the data processed and stored, and is it used to train models?
- Can we switch the automated parts off?
- Classify each tool as a solely automated decision, substantially and directly related to a decision, or neither, and record why. Keep that record: it is what you will point to if asked.
- Update the privacy policy for anything in the first two groups, in plain language. Keep it short and specific rather than listing every product.
- Tell the team. Reception should know where the policy is and what it says. Clinicians should keep AI scribe consent as its own conversation.
A privacy impact assessment is not required of a private practice, but the OAIC encourages one, and the inventory above is most of the work.
Illustrative privacy policy wording
Only use wording like this if it is true for your practice, and have it reviewed first:
Automated decision-making. We use software that uses your personal information, including your contact details, appointment history and the reason for your visit, to [prioritise appointment requests / identify patients due for a recall]. The software [recommends / sorts]; a member of our clinical team makes the final decision. We do not use software to make decisions about your care solely by automated means.
If you use no software that meets the trigger, you do not need to add anything. Some practices add one sentence saying so, which makes it clear the question was considered.
Questions practices ask
When exactly do the rules start?
10 December 2026. The Act received Royal Assent in December 2024 and gave entities 24 months to prepare.
We are a small practice. Are we exempt?
Almost certainly not. The small business exemption does not cover organisations that provide a health service and hold health information.
Does using an AI scribe mean we must update our privacy policy?
Not automatically. It depends on whether the scribe makes, or does something substantially and directly related to, a significant decision about a patient. A scribe that only drafts documentation for review is a weaker candidate than one that recommends diagnoses, treatments or billing. Patient consent to the scribe is a separate obligation either way.
If a doctor reviews everything, are we out of scope?
Not necessarily. Where a program's recommendation, guidance or categorisation is a key factor in the decision, it can be "substantially and directly related" to it even with a human making the final call.
What happens if we get it wrong?
The OAIC can issue infringement notices and compliance notices for a privacy policy that does not meet the new requirements, and civil penalties are available.
Sources
- OAIC, APP guidelines, Chapter 1: APP 1
- Allens, Automated decision-making transparency: what APP entities need to know about the APP 1 amendments (June 2026)
- Johnson Winter Slattery, Practical implications of new transparency requirements for automated decision making
- Avant, AI scribes and patient consent
- TGA, Digital scribes