AI in Australian Healthcare: The Complete Compliance Guide

At the federal level, AI in healthcare must comply with the Privacy Act 1988 and its 13 Australian Privacy Principles, which provide the primary data protection framework for health information. The My Health Record Act 2012 adds specific obligations for systems accessing the national digital health record, including criminal penalties for unauthorised data handling. The Health Insurance Act 1973 governs Medicare billing and creates offences for false or misleading claims, which extends to claims generated or assisted by automated systems.

The Therapeutic Goods Act 1989, administered by the TGA, determines whether an AI system constitutes a medical device. This classification hinges on the software intended purpose: administrative communication tools such as appointment booking and recall reminders are not medical devices, but AI that provides clinical decision support, diagnostic interpretation, or treatment recommendations is likely classified as Software as a Medical Device and must be registered on the Australian Register of Therapeutic Goods before it can be lawfully supplied.

The NDIS Act 2013 and associated Quality and Safeguards framework create additional obligations for AI systems communicating with NDIS participants. Registered NDIS providers must meet the NDIS Practice Standards and Code of Conduct, which include requirements for accessible communication, respect for individual rights, and transparent complaint mechanisms — all of which apply to automated communications.

The Health Practitioner Regulation National Lawestablishes AHPRA and the 15 National Boards that regulate Australia registered health practitioners. Section 133 of the National Law governs advertising by registered health practitioners and creates offences for advertising that is false, misleading, or deceptive. The AHPRA Guidelines for advertising a regulated health service apply to any communication that promotes a health service, which includes AI-generated recall messages, appointment reminders, and promotional communications.

Critically, the practitioner is responsible for all communications sent on their behalf, regardless of whether those communications were drafted by a human staff member or generated by an AI system. This means that the practice owner bears personal regulatory risk for any AI-generated message that violates AHPRA advertising guidelines. Penalties include fines, conditions on registration, or in serious cases, suspension or cancellation of registration. AI Healthcare mitigates this risk through pre-approved template libraries, prohibited-language screening, and regular compliance audits aligned with AHPRA enforcement trends.

In addition to federal legislation, several states and territories have their own health records legislation that imposes additional obligations. The Health Records Act 2001 (Vic) establishes Health Privacy Principles that apply to health service providers in Victoria, with some provisions that are more stringent than the federal Privacy Act. The Health Records and Information Privacy Act 2002 (NSW) creates analogous obligations for NSW health service providers.

For AI systems operating across multiple states, this creates a layered compliance requirement. The system must comply with the most restrictive applicable standard at any given time, which may vary depending on the patient location, the practice location, or both. AI Healthcare is configured to apply the highest applicable standard across all jurisdictions, ensuring compliance regardless of where your patients or practice locations are situated.

The rapid expansion of telehealth since 2020 has created new compliance considerations for AI systems managing virtual appointments. Under the Privacy Act and Australian Privacy Principles, telehealth sessions involve the transmission of sensitive health information and require end-to-end encryption, secure session links, and explicit patient consent for the telehealth modality. AHPRA national boards have published telehealth-specific guidance requiring that practitioners maintain the same standard of care in virtual settings.

AI systems managing telehealth scheduling must ensure that consent is obtained and documented before the first telehealth session, session links are delivered securely, and patients are informed of their right to request an in-person consultation instead. For paediatric telehealth, additional considerations include verifying that a responsible adult is present and that the child environment is appropriate for the session. AI Healthcare manages the full telehealth consent and communication lifecycle in compliance with these requirements.