Before an AI Answers Your Patients' Calls

The words patients hear, agreed and identical everywhere.

• AI disclosure wording agreed and written downStates it is an AI assistant for the practice, in plain words, before the patient says anything of substance.
• Disclosure delivered at the start of every call, in hours and after hoursSame words in the greeting, the after-hours greeting and any transfer message.
• Recording decision made: on, off, or for specific call types onlyA deliberate choice, documented, with the supplier configured to match.
• Recording notice wording agreed, if recording is onStates that the call is recorded and why, at the start of the call.
• State or territory surveillance or listening devices law checkedThe rules differ by jurisdiction. Record which law applies and what it requires.
• Disclosure repeated on the website and in the waiting roomPatients can find out before they call that an AI may answer.

An AI phone system is a new way of collecting, and usually a new recipient.

• Practice privacy policy updated to name the AI phone system and its supplierAPP 1 requires a clearly expressed and up to date privacy policy.
• Collection notice covers what the system collects and whyAPP 5 matters: purposes of collection, who it is disclosed to, and how to access or complain.
• Any overseas disclosure stated in the noticeIf any processing step is outside Australia, the notice says so and names the likely countries.
• Notice available where patients will see itWebsite, waiting room and on request, not only in a document nobody reads.
• Previous policy version kept with a change dateSo the practice can show what changed and when, if asked.

Every processing step, in writing, before go-live.

• Written confirmation of where audio, transcripts and summaries are storedCountry and provider for each, not a general assurance.
• Written list of every processing location and sub-processorTelephony, speech recognition, language model and storage may each sit somewhere different.
• Cross-border position assessed against APP 8 and the reasoning recordedA decision with reasons, kept on file.
• Written confirmation that call content is not used to train shared modelsOr, if it is, a documented decision that this is acceptable, which for health information it rarely is.
• Retention period set for recordings and transcriptsAligned with your records policy and a decision on whether transcripts form part of the medical record.
• Access rules defined: who at the practice and at the supplier can listen or readLeast privilege, logged, and reviewed when staff change.
• Deletion on request and on exit confirmed in writingIncluding what happens to backups and how deletion is evidenced.

The exit must work, or nothing else on this list matters to the patient.

• Patients told they can ask for a person at any timePart of the disclosure wording, not buried in a policy.
• In-hours route to a person definedTransfer to reception, or a callback within a stated time, with a named owner.
• After-hours route to a person definedFollows the after-hours protocol, with the emergency direction for anything urgent.
• Escalation triggers on distress or confusion, not only on a requestA caller who is upset, unclear or repeating themselves is routed to a person.
• Opt-out route tested before go-live and quarterly afterA real test call in hours and after hours, with the result recorded.

The people who will be asked about the AI need to know the answers first.

• All staff briefed on what the system does and must never doBooking and administrative tasks only. No symptom advice, no clinical judgement.
• Reception has a short answer for patients who ask about the AIWhat it is, what it does with their information, and how to reach a person.
• Staff know what an escalated call looks like and what to do with itHow it arrives, what information comes with it, and the expected response time.
• Route for staff to report a call the system handled badlyReviewed regularly, with changes fed back to the supplier.
• Supplier breach notification timeline agreed in writingHow quickly they tell you, what they provide, and who notifies patients.
• Practice breach response plan updated for a breach at the supplierNotifiable Data Breaches scheme obligations understood and allocated to a named person.
• Named owner for the system and a review dateSomeone reviews call handling, complaints and escalations, and the date is in the practice calendar.