Home / Allied health / AI privacy checklist for allied health practices: the 10 December 2026 changes

AI privacy checklist for allied health practices: the 10 December 2026 changes

New Privacy Act requirements about automated decisions start on 10 December 2026. Here's what they mean for a practice that uses AI scribes or chatbots, and a checklist to get ready.

8 min read · Updated 10 October 2026 · For practice owners and managers

What changes for health practices using AI on 10 December 2026?

From 10 December 2026, privacy policies must explain when computer programs use personal information to make, or substantially help make, decisions that could significantly affect people. Most allied health practices are covered regardless of turnover, so list your AI tools, map where data goes, and update your privacy policy and patient consent before that date.

The Privacy and Other Legislation Amendment Act 2024 changed the Privacy Act in several stages. One change starts on 10 December 2026: privacy policies must explain when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect people's rights or interests.

Most allied health practices are covered. Small businesses under the $3 million turnover threshold are usually exempt from the Privacy Act, but that exemption doesn't apply to health service providers that hold health information. If you see patients, the Act almost certainly applies to you.

Not legal adviceThis is a practical starting point. For your specific situation, check the Office of the Australian Information Commissioner (OAIC) and your professional association, or ask your indemnity insurer or a privacy lawyer.

Does my practice make "automated decisions"?

Probably fewer than you think, but it's worth checking each tool. The new rule is about decisions that could significantly affect someone, made or substantially shaped by a computer program.

Likely to need a closer look: tools that triage or prioritise patients, recommend eligibility for funding or services, flag patients for discharge or decline, or set pricing for individuals.
Usually lower risk: an AI scribe or chatbot that drafts a note or letter a clinician reviews and owns. The clinician makes the decision. Even so, these tools still handle health information, so the rest of this checklist applies.

If you're not sure which side a tool falls on, describe it openly in your privacy policy anyway. Transparency costs you a paragraph.

The checklist

List every AI tool in the practice. Scribes, note software with AI features, booking or triage tools, and free chatbots staff use for letters or emails.
Map the data. For each tool: what personal or health information goes in, where it's stored, whether it leaves Australia, how long it's kept, and whether the vendor uses it to train models.
Check overseas disclosure. If information is sent to or stored overseas, your privacy policy should say so and you need to be satisfied the vendor will handle it in line with the Australian Privacy Principles.
Identify automated decisions. Use the section above. Write down any tool that makes or substantially contributes to a significant decision about a patient.
Update your privacy policy before 10 December 2026. Describe the kinds of personal information your AI tools use and, where relevant, the kinds of decisions they make or contribute to.
Update collection notices and consent. Tell patients at intake which tools you use and get informed consent for anything that records a session. See Ahpra's AI guidance in plain English.
Set a rule for general chatbots. The OAIC recommends against putting personal information, especially sensitive information, into publicly available generative AI tools. Use de-identified shorthand instead.
Read your vendor agreements. Look for data location, retention and deletion, breach notification, and whether your data is used for training. Keep a copy.
Check your breach plan. An AI vendor breach can trigger the Notifiable Data Breaches scheme. Make sure you know who you'd call and what you'd do.
Write a one-page AI policy for staff covering approved tools, what can't go into them, and the review-before-signing rule.

Draft the AI section of your privacy policy

This prompt works from a description of your tools only, with no patient information. Treat the result as a first draft for review, not finished wording.

I run a [profession] practice in Australia. Help me draft a plain-English section for our privacy policy about how we use AI tools.

Our tools:
- [Tool 1]: [what it does], [what information goes in], [where data is stored], [how long it's kept]
- [Tool 2]: ...

Does any tool make or substantially contribute to decisions that significantly affect patients? [yes: describe / no: clinicians make all decisions]

Write:
1. A short section (under 250 words) for our privacy policy covering the kinds of personal information each tool uses, why, and where it is stored.
2. If relevant, a description of the kinds of decisions made or substantially assisted by these tools.
3. A two-sentence version for our intake form.

Use only the facts I've given. Mark anything you're unsure about with [CHECK] instead of guessing.

Replace the [brackets] with your details

🩺 Get the full Allied Health AI Prompt Pack 30 privacy-first prompts for notes, reports, patient handouts, clinic admin and CPD. Instant PDF download.

Buy for $19 AUD

Common questions

What changes on 10 December 2026 under the Privacy Act?

From 10 December 2026, privacy policies must describe when computer programs use personal information to make, or substantially and directly contribute to, decisions that could reasonably be expected to significantly affect an individual's rights or interests. The change comes from the Privacy and Other Legislation Amendment Act 2024.

Does the Privacy Act apply to small allied health practices?

Generally yes. The small business exemption does not apply to businesses that provide a health service and hold health information, so most allied health practices must comply regardless of turnover.

Is an AI scribe an automated decision?

An AI scribe that drafts notes a clinician reviews and approves usually doesn't make the decision itself. But it still collects and stores health information, so consent, privacy policy disclosures and vendor checks still apply. Get advice if a tool does more than draft.