Why does a practice need its own AI scribe policy?
When practitioners choose AI scribes individually, a practice can end up with several products, different consent habits and no view of where patient data goes. The RACGP says practice owners who decide not to permit AI scribes, or to limit use to a particular scribe, need a policy, must inform all tenant GPs and staff, and should consider how they will monitor compliance. The Australian Commission on Safety and Quality in Health Care notes that smaller organisations may need to establish governance and processes so AI tools are deployed safely and in line with their intended use. A practice policy is that process in writing.
Which tools are approved, and who decides?
List the approved products, the plan or version, and any settings that must be on or off, such as whether transcripts are kept. Name who approves a new product and the evidence they need first. RACGP's selection questions include evidence of safety and suitability for Australian general practice, whether data will be processed or stored outside Australia, and whether any secondary use of data in the user agreement is acceptable. Ahpra says tools should be tested by the user or organisation to confirm they are fit for purpose before clinical use. The Commission's guide notes that an AI tool used for diagnosis or treatment must comply with TGA regulation, so record the vendor's stated intended use.
How is patient consent sought and recorded?
The RACGP advises obtaining patient consent to use an AI scribe at the beginning of each consultation, and asking your medical defence organisation whether written consent is required; if it is not, verbal consent can be recorded in the consultation notes. Ahpra says informed consent is particularly important for AI that records private conversations. The Commission's guide suggests clinicians be ready to explain why the tool is used, its benefits, limits and risks, and that they review outputs and remain responsible for the record. Your policy should give the consent wording, where consent is recorded and what happens when a patient declines.
- Consent wording staff use at the start of each consultation
- Where consent or refusal is recorded
- How to stop the scribe when a patient declines or asks for it to stop
- Arrangements when an interpreter, carer or other person is present
What review and sign-off rules should apply to notes?
Ahpra says practitioners must apply human judgement to any AI output and are responsible for checking the accuracy and relevance of records created with generative AI. The RACGP advises reviewing all notes generated by an AI scribe as soon as possible after the consultation, and warns against relying on AI scribes to decide whether MBS requirements have been met. Your policy should say that no AI-generated note, letter or referral is relied on until the treating practitioner has reviewed it, set a time limit for that review, and explain how to remove content nobody said. Item numbers a scribe suggests are checked by the practitioner.
What does the policy say about data, retention and access?
Record what the product keeps and where. The RACGP notes that most AI scribe providers do not store captured audio, and that practices should check what assurances the vendor gives about how captured data is encrypted, stored, destroyed and managed. The OAIC says privacy obligations apply to personal information entered into an AI system and to its output, that personal information should be used only for the primary purpose unless an exception applies, and that privacy policies should explain the use of AI. Your policy should state the storage location, the retention period for drafts and transcripts, who can access them, and the wording added to your privacy policy.
How are errors and incidents handled?
Give staff one way to report a problem: a note containing words nobody said, a missing allergy, a recording that started without consent or a suspected data breach. Log each report with the date, product, what happened and the action taken. The Commission's guide suggests using existing forums, such as incident management or practice management meetings, to discuss AI tool performance, because performance can change over time. It lists escalation channels including adverse event reports to the TGA for medical devices and the OAIC or the state or territory privacy regulator for privacy breaches. Report product faults to the vendor as well.
How do you audit use and keep the policy current?
Audit a fixed sample of AI-assisted notes each month for two things: consent recorded and practitioner review completed. Compare vendor usage reports with the approved user list. The RACGP says facilitating initial and ongoing education and training for all AI scribe users is important, so keep a training register. Review the policy at a set interval and whenever the vendor changes the product, its data handling or its terms. Keep each version with its approval date. If an audit finds gaps, record the action taken and check the same items in the next sample.