AI scribe adoption has moved faster than practice governance. RACGP polling found use among respondents rose from 22% in August 2024 to 40% in November 2025. Every captured consult can create audio, a transcript, a draft note and system logs, each with a different privacy risk. For Australian clinicians and practice managers, the task is to understand that data path, match it to the Australian Privacy Principles (APPs), and build a workflow patients can trust.

AI scribe privacy depends on the whole data path

An ambient AI scribe listens during a consult and prepares draft clinical documentation for clinician review. Privacy assessment needs to cover every data artefact the system creates, including copies that sit outside the visible note.

The Office of the Australian Information Commissioner (OAIC) makes an important point in its commercial AI guidance: privacy obligations apply to personal information entered into an AI system and personal information in its output. An unsupported statement about an identifiable patient can still be personal information, even when it is wrong.

Audio deletion is only one control. A system can delete audio promptly while retaining a transcript, draft, support log or backup. Ask for retention periods by artefact rather than accepting a single statement that “data is deleted”.

The Australian privacy and professional obligations that matter

Private health service providers are generally covered by the Privacy Act 1988 and the APPs, including providers that would otherwise fall within the small business exemption. The OAIC has specific guidance for health service providers. Public health services and some private providers may also have state or territory duties, health-record laws, funding conditions and organisational policies.

For an AI scribe workflow, six APP duties deserve particular attention:

The OAIC’s APP 3 chapter states that sensitive information generally requires consent unless an exception applies. It also cautions that notice of a proposed collection does not, by itself, establish consent. The broader APP guidelines explain the other principles. The practice still owns its obligations when a vendor processes the information on its behalf. A privacy policy, certification or contract clause from the vendor is evidence to assess, rather than a transfer of accountability.

Professional and product regulation sits alongside privacy law. AHPRA says practitioners remain accountable for care, must apply human judgement to AI output and should understand where data is stored and whether it is used to retrain a model. Its professional obligations guidance also addresses transparency and informed consent.

The Therapeutic Goods Administration (TGA) regulates a scribe as a medical device when its intended purpose includes therapeutic analysis or interpretation, such as producing a diagnosis or treatment recommendation that the practitioner did not state. A documentation tool that only transcribes and translates the conversation into a written record is outside that definition. The TGA scribe guidance also places responsibility on health professionals to obtain informed consent and verify what enters the patient record.

Schedule 1 Part 15 of the Privacy and Other Legislation Amendment Act 2024 commences on 10 December 2026. The privacy-policy requirement applies where an entity has arranged for a computer program to make a decision, or do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect an individual’s rights or interests; and personal information about that individual is used in the program. When that threshold is met, the policy must describe the kinds of personal information used and the kinds of relevant decisions. The test turns on the enabled function and its effect, rather than the AI scribe label.

Australian hosting is only one part of APP 8

Data residency answers where data is located. It does not tell you who can access it, whether a subprocessor receives it, which law governs that recipient, or whether the practice retains effective control.

APP 8 generally requires an entity to take reasonable steps before disclosing personal information to an overseas recipient and can make the Australian entity accountable for the recipient’s handling. The OAIC also distinguishes disclosure from some limited arrangements where an overseas contractor remains under the entity’s effective control. Its cross-border disclosure guidance points to contract terms, subprocessor duties, access, security and deletion rights as relevant factors.

Ask a vendor to map four separate paths:

1. Processing: where speech recognition and model inference occur.
2. Storage: where audio, transcripts, drafts and backups reside.
3. Access: where support, security and engineering personnel work, and when they can view clinical data.
4. Subprocessors: which organisations handle data for transcription, model inference, hosting, monitoring or support.

Australian processing and storage can reduce cross-border exposure. It does not replace access controls, retention limits, a subprocessor review or a binding contract.

How we minimise the clinical data surface at Lyrebird

For our Australian service, the core application data remains in Australia. Application databases and transcripts, authentication and user data, speech processing and encrypted backups stay in the AWS Sydney region. Limited overseas processing still occurs: Azure OpenAI may process de-identified health information in the European Union for language processing, with region pinning where available. We continue to treat de-identified health information as personal information for compliance purposes. Payment metadata, pseudonymised monitoring logs and non-health website analytics may also be handled by named services in the United States. Our privacy policy sets out each category and recipient.

We encrypt clinical data in transit and at rest, apply strict access controls, and do not use customer notes or transcripts to train external AI models. Our compliance approach keeps the draft under clinician control and requires review before it becomes part of the patient record.

Retention needs three separate answers: the standard default, the maximum the policy permits and the setting or contract that applies to the organisation.

• Default: audio is destroyed immediately after transcription. Generated notes and transcriptions are deleted after seven days by default.
• Optional maximum: if audio retention is enabled, audio may be kept for up to six months. Transcripts and clinical notes may also be retained for up to six months and are typically deleted after delivery to the electronic health record.
• Configured or contracted setting: an organisation may operate with a shorter setting or a contract-specific schedule within those maxima. The privacy impact assessment and data-handling agreement should record the setting that actually applies.
• Other lifecycle limits: point-in-time recovery backups are retained for 28 days. Application logs are generally retained for 30 to 90 days, while audit logs are kept for compliance and security monitoring.

These controls reduce the amount of clinical data available to expose. The practice still needs a clear consent process, secure user accounts, appropriate device controls, clinician review and its own incident plan.

What to require from an AI scribe vendor

Move vendor assessment from broad assurances to documents, settings and contract commitments. The OAIC recommends due diligence, privacy by design and a privacy impact assessment before deploying a commercial AI product.

Review the signed contract as well as the public policy. The contract should state which party is responsible for each control, what evidence the practice can obtain and how material changes will be communicated.

Build privacy into the clinical workflow

1. Define the permitted use. State whether the tool may draft notes and letters only, or whether any billing, triage or clinical suggestion features are allowed.
2. Complete a privacy impact assessment and record the accepted risks, control owner and review date.
3. Approve one configuration. Record processing regions, recipients and actual retention settings. Disable unnecessary secondary uses, require multifactor authentication and limit access by role.
4. Update the practice privacy policy, collection notice, AI scribe policy, data-breach plan and staff training. Keep consent procedures in the relevant clinical policy and use the patient consent guide for that separate implementation work.
5. Require the clinician to review the draft against the encounter and patient record, correct omissions or unsupported statements, and sign off the final note.
6. Remove unnecessary intermediate copies according to the configured retention schedule. Keep access and correction pathways clear for patients, including when disputed information originated in an AI-generated draft.
7. Review vendor access, retention, subprocessors, software changes and incidents on a set cycle. Reassess the privacy impact when a new model, integration, support process or feature changes the data flow.

Responding to an AI scribe privacy incident

Treat exposed audio, transcripts, drafts, prompts and identifiable logs as potential health-information incidents. The practice response should:

1. Contain access without destroying evidence. Disable the affected account, token or integration and preserve relevant audit logs.
2. Establish which patients, artefacts, systems, recipients and time period are involved.
3. Require the vendor and subprocessors to preserve evidence and provide facts under the contractual incident process.
4. Assess whether the incident is likely to result in serious harm under the Notifiable Data Breaches scheme, without waiting for the vendor to make the practice’s decision.
5. Notify affected people and the OAIC when the incident is an eligible data breach, then correct the control failure.

The OAIC provides a specific health service action plan for preparing and responding. Run the workflow before an incident occurs so staff know who can contain the system, contact the vendor and make the notification assessment.

AI scribe privacy questions clinicians ask

Is HIPAA compliance enough for an Australian clinic?

No. HIPAA may be relevant evidence for some security and US healthcare controls. An Australian practice must also assess the Privacy Act, APPs, applicable state or territory laws, professional duties and the actual data flow. A HIPAA claim does not answer APP 8, local notice, consent, access, correction or retention questions.

Does deleting the audio make an AI scribe private?

Audio deletion reduces risk. The transcript, prompt context, draft note, logs and backups may still contain health information. Obtain the retention and deletion position for each artefact and recipient.

Can an AI scribe use patient data to train its model?

Model training is a separate data use that needs its own APP analysis. A practice should know exactly which data is used, whether it remains identifiable, which model or provider receives it, how a patient can exercise their rights and whether participation is optional. The clearest low-exposure configuration keeps consult data out of model training by default.

Privacy holds when the legal position, vendor design and clinical workflow all agree. That lets clinicians use an AI scribe while keeping patient trust and professional judgement at the centre of documentation.

Contact us