--- title: "AI scribe privacy in Australia: government guidance explained" description: "What Ahpra, the OAIC and the TGA expect from clinicians using AI scribes: consent, privacy, overseas processing and accuracy, and how Hanah meets each point." source: https://hanah.health/blog/australian-government-ai-scribe-privacy-guidance/ --- 1. [Home](https://hanah.health/) 2. [Blog](https://hanah.health/blog/) 3. Australian government guidance on AI scribe privacy, and how Hanah meets it Article # Australian government guidance on AI scribe privacy, and how Hanah meets it By [Ahmed](https://hanah.health/blog/authors/ahmed/) · 8 min read Published 27 October 2026 ## Key takeaways - Ahpra expects informed consent before an AI scribe records a consultation, ideally with the patient's answer noted in the health record. - The OAIC treats an AI scribe as collecting health information, which usually needs consent, and expects practices to know where that information goes, including overseas. - The TGA's October 2026 review found many scribes have functions that may make them medical devices. Software limited to transcription and documentation is generally unlikely to meet the definition. - Hanah reads each patient's recording consent from their forms, notes and visit transcripts, including Cliniko notes, forms and attached PDFs, and keeps it on the patient's profile with a link to where it came from. - Hanah's Trust Center lists where data is stored, which providers process it and where, and publishes the accuracy benchmark behind every number we quote. In February 2026 the federal health department prepared briefing papers for Senate Estimates describing AI scribes as having little oversight. The papers raised consent practices that vary from clinic to clinic, patient data sent to servers outside Australia without clinicians knowing, and transcription errors that end up in the record. In October the TGA published the outcomes of its review of digital scribes and said it is moving to compliance action. If you use a scribe, you should be able to answer the questions a patient, a privacy officer or a regulator would ask. Below is what each regulator has said and how Hanah handles it. ## Who is responsible for what Oversight of AI scribes is shared. - [Ahpra](https://www.ahpra.gov.au/Resources/Artificial-Intelligence-in-healthcare.aspx) sets your professional obligations as a registered practitioner. - The [OAIC](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) enforces the Privacy Act and the Australian Privacy Principles (APPs), which apply to the health information a scribe collects. - The [TGA](https://www.tga.gov.au/products/medical-devices/software-and-artificial-intelligence-ai/overview/types-software-based-medical-devices/digital-scribes) decides whether a scribe is a medical device. Under all of them, you stay responsible for the care you provide and the records you keep. ## Consent Ahpra's guidance asks practitioners to "obtain informed consent from your patient" before using a scribe that records the consultation, and to note the patient's response in the health record. It also warns that "there may be criminal implications if consent is not obtained before recording", because several states and territories make recording a private conversation without consent an offence. The OAIC is just as direct. Health information is sensitive information, and collecting it with an AI tool "will usually need" consent. A line in your privacy policy is not enough, and consent cannot be implied because a patient was notified. Most clinics collect consent on the intake form, as a verbal yes at the start of the session, or with a signed consent form. The hard part is finding that answer again when you need it. ### How Hanah captures consent Every patient in Hanah has a Recording consent field on their profile: Yes, No or Not set. Hanah fills it in by reading the patient's own records, and it reads every kind of record a clinic keeps. - Visit transcripts, including a verbal "yes, that's fine" at the start of a session - Notes written in Hanah - Forms the patient completed in Hanah - Cliniko treatment notes and Cliniko patient forms - PDFs attached to the patient in Cliniko, such as a signed consent form Hanah counts the answer whatever the form calls it: being recorded, transcribed, audio captured, an AI or digital scribe, or AI-supported note-taking, even where the form says recordings are not kept. Consent to treatment, to sharing information or to clinical photos does not count, and a question left blank is not an answer. Hanah only records a clear yes or no. Each answer cites where it came from, with the date and a link that opens the source, in Cliniko where that is where it lives. If you set the answer yourself, yours stands. If a newer form or transcript says the patient has since declined, Hanah shows you a warning. Clinics can also choose to show recording consent above the patient's summary before each visit, which puts the answer in front of you before you press record. That covers the part of Ahpra's guidance that asks for the patient's response to be noted in the record, and it covers the patient who said no last time. ## Privacy and where data goes The OAIC asks practices to do their due diligence before adopting an AI product: understand the data flows, check whether the developer can access or train on what you put in, and consider whether personal information could be disclosed outside Australia. APP 8 applies when it is. The health department's briefing papers named this as the gap. Some providers call their products privacy compliant without being clear about how patient data is processed, and clinicians may not know data is leaving the country. - LLM and speech to text providers are contractually bound not to train on your content or retain it beyond the terms listed. - Raw audio is deleted once the transcript is produced. Transcripts and other recording material are kept for a short window and then deleted automatically, and every automatic deletion is written to a tamper-evident log. - Data is encrypted in transit and at rest. If you are completing a privacy impact assessment or updating your privacy policy, the [Trust Center](https://hanah.health/au/trust/) is written for that job. Our [Data Processing Agreement](https://hanah.health/dpa/) is published too. ## Accuracy and review Ahpra says it is the practitioner's responsibility to check records for accuracy and relevance, even when they are created with generative AI, and that tools should be tested to make sure they are fit for purpose. Hanah is one of the only AI scribes on the market that publishes its benchmarking, which lets you make a more informed decision about whether it is right for you. The [AI scribe benchmark](https://hanah.health/benchmark/) compares Hanah with seven other scribes, and the [Australian validation report](https://hanah.health/au/trust/transparency/) shows the results behind it. ## Is an AI scribe a medical device? The TGA's [digital scribe review](https://www.tga.gov.au/resources/publication/corporate-reports/digital-scribe-review-outcomes), published on 16 October 2026, looked at 12 products in detail. None of the suppliers described their software as a medical device, but the TGA found 8 of the 12 included functions likely to meet the definition. The dividing line is what the software does with clinical information. A scribe that generates diagnoses, treatment recommendations or other clinical conclusions is likely to be regulated. Software limited to transcription and administrative documentation is generally unlikely to be. Hanah drafts the record of the findings, diagnoses and plans you give it. It helps you find and summarise information in existing notes and documents, and it does not independently diagnose, choose treatment or decide what to investigate next. You make the clinical decisions and check every draft against its sources. ## A checklist for your practice - Ask every patient for consent to the scribe, and record their answer where you can find it again. - Offer patients who decline a way to be seen without the scribe. - Update your privacy policy to say you use an AI scribe, what it collects and where it is processed, including overseas. - Read your scribe's subprocessor list and data retention terms before you sign. - Review every AI-drafted note before it becomes part of the record. - Ask your vendor for evidence of accuracy testing, and read how it was measured. If you would like to see how Hanah handles consent with your own forms and your Cliniko account, [start a free trial](https://hanah.health/go/signup) or [book a demo](https://hanah.health/index.html#demo) and we'll walk through it with you. _This post summarises public guidance as of October 2026 and is not legal advice. Check the current guidance from Ahpra, the OAIC and the TGA, and your state or territory's surveillance device laws, for your circumstances._ ## Frequently asked questions **Do I need patient consent to use an AI scribe in Australia?** Ahpra expects informed consent before a scribe records a consultation, and the OAIC says collecting health information with an AI tool will usually need consent. Some states and territories also make recording a private conversation without consent an offence. **Can Hanah tell me whether a patient has already consented?** Yes. Hanah reads each patient's forms, notes and visit transcripts, including Cliniko notes, forms and attached PDFs, and shows a Yes, No or Not set answer on their profile with a link to where it came from. **Does a verbal yes count as consent?** Consent can be verbal or written, as long as it is informed, voluntary and specific to the scribe. Ahpra asks that the patient's answer be noted in the record. When a patient says yes at the start of a recorded session, Hanah picks it up from the transcript and saves it to their profile. **What should I do if a patient says no?** Don't record the session. You can still jot down notes in the visit's context section in Hanah during the consult, and once the patient has left, dictate the session details and Hanah drafts the note from them. Hanah shows No on the patient's profile, and clinics that show consent before each visit see it before pressing record next time. **What should my privacy policy say about an AI scribe?** The OAIC expects your privacy policy and collection notice to explain that you use an AI scribe, what it collects, how it is used and where it is processed, including any processing outside Australia. Hanah's Trust Center lists that detail for each provider, which makes the policy easier to write. ## Sources cited in this article - [Ahpra](https://www.ahpra.gov.au/Resources/Artificial-Intelligence-in-healthcare.aspx) — ahpra.gov.au - [OAIC](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products) — oaic.gov.au - [TGA](https://www.tga.gov.au/products/medical-devices/software-and-artificial-intelligence-ai/overview/types-software-based-medical-devices/digital-scribes) — tga.gov.au - [Trust Center](https://hanah.health/au/trust/) — hanah.health - [AI scribe benchmark](https://hanah.health/benchmark/) — hanah.health - [Australian validation report](https://hanah.health/au/trust/transparency/) — hanah.health - [digital scribe review](https://www.tga.gov.au/resources/publication/corporate-reports/digital-scribe-review-outcomes) — tga.gov.au ## About the author [Ahmed](https://hanah.health/blog/authors/ahmed/) · Co-founder and CEO, Hanah Ahmed is the co-founder and CEO of Hanah, with a technology background spanning software engineering, game development, sports analytics, fintech and artificial intelligence. He began building software at 13 and has worked at Electronic Arts, Catapult Sports, Commonwealth Bank and SEEK, run an independent game studio, and served as Head of AI at sixclicks, a governance, risk and compliance company. At Hanah, he brings that experience to the product’s software architecture, AI workflows and user experience. His work connects clinical documentation with the feedback loops that help patients stay engaged with their care. He writes about Hanah’s technology, product design, evaluation methods and AI scribe comparisons. [View articles](https://hanah.health/blog/authors/ahmed/). [Ahmed on LinkedIn](https://www.linkedin.com/in/meds/) [How we write, source and review articles](https://hanah.health/blog/editorial-policy/) ## Related reading - [The real cost of a free AI scribe](https://hanah.health/blog/no-free-ai-scribe/) We don't want to sacrifice output quality by using cheaper LLMs, that's why Hanah offers a generous 30 day trial and no cheap model option. - [Deploying AI in your practice: six questions to ask before you sign](https://hanah.health/blog/deploying-ai-in-your-practice/) Every AI scribe demo looks the same. The differences turn up later — in the invoice, the subprocessor list, and the first consult you record in a room with no signal. Six questions to put to every vendor, with our own answers written down. See Hanah in your own practice. [Book a demo](https://hanah.health/index.html#demo)