AI Billing Software and Medicare: What the ANAO Audit Means for You

Key Takeaways

• The ANAO published Report No. 5 of 2026-27, Artificial Intelligence and Medicare Benefits Integrity, on 21 September 2026. It found "approximately one-fifth" of listed billing software websites refer to using AI, and one suggested "the most lucrative combination of MBS item numbers".
• Nothing prohibits item suggestion software today. DHDA told the ANAO in March 2026 that "there are no regulatory requirements in place to enforce compliance" over AI billing software.
• The practitioner stays responsible for every claim. The Department's Medicare billing assurance toolkit says practitioners answer for claims under their provider number "even if the practice software was used to facilitate the process".
• DHDA agreed Recommendation 1 to assess AI risks in Medicare claiming, but gave no date. Its data and analytical modelling to "identify unusual item co-claiming combinations" is anticipated "by the end of 2026".
• The PSR records standard is technology-neutral. Section 6 of the PSR Scheme Regulations 2019 sets out what a record must contain and says nothing about who or what drafts the entry. The note must still "provide sufficient clinical information to explain the service".
• The practice can share a Medicare debt. Under section 129ACA of the Health Insurance Act 1973, an excess may be recoverable from a practice that engaged the practitioner, where it could have influenced the circumstances and obtained a financial benefit. Applying that to billing software is our reading, not a Department statement.
• Privacy obligations change on 10 December 2026. APPs 1.7 to 1.9 start that day, and an item suggestion tool may need disclosure in your privacy policy depending on three limbs in APP 1.7.

AI billing software is legal and, on DHDA's own words, unregulated. It is also now on the Medicare integrity radar: the ANAO's 21 September 2026 report found prompted billing tools raise risks the Department is only starting to model. Responsibility for every claim stays with the practitioner, and the practice can share a debt.

What did the ANAO find about AI billing software?

Auditor-General Report No. 5 of 2026-27, Artificial Intelligence and Medicare Benefits Integrity, was published on 21 September 2026. The performance audit covers the Department of Health, Disability and Ageing (DHDA) and examines "the effectiveness of DHDA's management of AI use in supporting health provider compliance" on two fronts: DHDA's own AI, and AI used by health providers. This post covers the provider side.

The backdrop: $52 billion in 2024-25 MBS and PBS spend, non-compliance costed at $1.5 to $3 billion, and 3,779 identified fraud and non-compliance cases that year.

Paragraph 3.7 says: "Services Australia lists practice management software on its website that integrate with MBS claiming channels. On software websites, approximately one-fifth refer to using AI, particularly AI scribes. Practice management and MBS billing software websites often refer to optimising billing processes, identifying missed billing opportunities, increased billing volumes, and in one case, suggesting the most lucrative combination of MBS item numbers." The ANAO names no software or vendor. Its own term, from footnote 87: "prompted billing" is "software that uses data analytics and/or AI to suggest MBS item numbers that could be applicable for billing".

In June 2025 the Benefits Integrity Division began drafting a "prompted billing software including AI" scoping paper, listing four risks: "MBS item descriptors; practitioner complacency; full automation; and the clinical appropriateness of billing items." In October 2025 Services Australia raised a concern with DHDA about providers using AI to test MBS eligibility across multiple items, a risk not recorded in the shared risk registers. A May 2026 draft strategic intelligence report identified "four commercial tools" analysing consultation notes, and said "existing capability does not enable the identification of practices or practitioners using prompted billing functionality (including those that use AI)", though "most inappropriate claiming should be detectable through existing capability". It was not finalised as of August 2026.

The clearest statement of the gap is paragraph 3.15: DHDA told the ANAO in March 2026 it cannot analyse claiming by users of prompted billing software "due to a lack of data to confirm whether a health provider has used an AI billing assistant", that it knew of "free software, offered without any proof of identity that may have been used to commit fraud", and that "there are no regulatory requirements in place to enforce compliance" (full report).

One boundary, in one sentence: the ANAO notes "digital scribe or practice management software is subject to TGA regulation if it meets the definition of a medical device" (para 3.14), a separate test.

What has the Department agreed to do, and by when?

Recommendation No. 1 (para 3.20): "The Department of Health, Disability and Ageing work with other government entities and sector stakeholders to identify and assess: the risks associated with the use of artificial intelligence in healthcare settings, including from health providers using artificial intelligence in Medicare Benefits Schedule claiming; whether current regulatory and other controls are effective in mitigating risks; and possible treatments for artificial intelligence risks outside of tolerance." DHDA's response: "Agreed." Of the three recommendations in the report, only this one concerns providers, and neither sets a date: the work runs through "existing governance and risk management processes".

DHDA's written response (para 3.22) sets the tone: "While artificial intelligence is not currently assessed as a demonstrated Medicare integrity risk in its own right, artificial intelligence-enabled technologies may increase the scale, speed or sophistication with which existing integrity risks manifest. In relation to Medicare benefits integrity, the department's focus will remain on preventing and responding to incorrect, inappropriate and fraudulent claiming." Its summary response adds that the focus holds "regardless of how claims are prepared or submitted".

The one dated commitment is analytical, not regulatory. In June 2025 the Medicare Integrity Reform Steering Group agreed to "perform data and analytical modelling to identify unusual item co-claiming combinations", standing up an "agile" team to look into AI billing. DHDA told the ANAO in April 2026 it anticipated finishing "by the end of 2026". The modelling runs on claims data, not on which software a practice uses.

The Department's earlier view of the market appears in its Senate Estimates brief released under FOI (FOI 26-3154, February 2026): "Some scribe suppliers advertise directly to health professionals that they can achieve a 30% revenue increase with no additional hours or patient consultations, which has implications for MBS costs." The brief also noted "some suppliers may be unaware their cloud platforms send data outside Australia". No supplier is named.

Which practice software already suggests MBS items?

The ANAO named no products, so the examples below come from vendors' own pages: what is on the market, not what the ANAO or the Department reviewed, and not a complete list.

Lyrebird Health's "MBS Billing Suggestions" (help article, updated 20 August 2026) is "a streamlined feature that appears after each patient consult, helping you quickly identify and copy eligible MBS item numbers for billing". "When you finish a consult in Lyrebird, an MBS Suggestions chip automatically appears at the top of the consult view if billable items are eligible", and after copying, "review and adjust as needed for your workflow". The feature "is currently available to Australian GPs using Lyrebird" and "requires no additional setup". (source)

In the Lyrebird and Cubiko integration (updated 23 August 2026), Lyrebird "surfaces the eligible MBS codes and patient entitlements that are provided by Cubiko", but "the clinician remains responsible for ensuring they complete all the correct steps and documentation required for each item". The codes "are not automatically linked to the consult or used to generate claims within Lyrebird". (source) Both Lyrebird pages put responsibility on the clinician in the vendor's own words.

MediBetter's "BOSS" (solutions page, read 24 September 2026) "analyses your consultation notes and instantly interprets the MBS, offering potential item numbers for you to review and select for billing", and "ensures MBS item optimisation and maximises revenue for you and your clinic". (source)

None of this is the "one case" in paragraph 3.7 or one of the "four commercial tools" in paragraph 3.10: the ANAO did not name what it looked at, and nothing here suggests any named product did anything wrong.

Who is responsible if the software suggests the wrong item?

The Department's Medicare billing assurance toolkit (published 6 February 2017, still live) states it plainly: "Practitioners are responsible for all Medicare billing claims made under their Medicare provider number or name, even if the practice software was used to facilitate the process, for example, by automatically pre-populating the MBS item numbers to be billed."

The colleges and insurers agree. RACGP guidance (updated October 2025): "Avoid relying on AI scribes to determine whether MBS requirements have been met... verify any suggested item numbers and ensure the consultation meets any specific Medicare requirements." Avant (27 March 2026) is blunter: "Responsibility for MBS billing remains with you, irrespective of whether an AI scribe is used", and "it will not be a defence to say an error was due to the use of an AI scribe."

The Health Insurance Act 1973 backs this with three sections. Under s 129AAD, the Chief Executive Medicare can require a practitioner to produce records where an amount paid "may exceed the amount (if any) that should have been paid", covering claims from the "2 years immediately before" the request (s 129AAD(4A)). Under s 129AC(1), an overpayment caused by false or misleading information "is recoverable as a debt due to the Commonwealth from the person by or on behalf of whom the information was given", whether or not anyone is convicted. Under s 129ACA, that debt can also fall on the engaging practice as "secondary debtor", where it "could have controlled or influenced the circumstances" and "directly or indirectly obtained a financial benefit". The Act says nothing about software or AI: applying s 129ACA to a practice's choice of billing software is our reading of the text, not a Department statement, and it is untested.

Mistakes have a designed exit. The Department's how to comply page (updated 30 August 2025): "Let us know as soon as you realise you have made an incorrect claim. You must repay the incorrect payment amount... no penalty will apply to voluntary acknowledgements."

Does an AI-drafted note meet Medicare's record-keeping standard?

Section 6 of the PSR Scheme Regulations 2019 sets the standard: "the standards for a record of the rendering or initiation of services to a patient by a practitioner are that: (a) the record must include the name of the patient; and (b) the record must contain a separate entry for each attendance by the patient for a service; and (c) each separate entry for a service must: (i) include the date on which the service was rendered or initiated; and (ii) provide sufficient clinical information to explain the service; and (iii) be completed at the time, or as soon as practicable after, the service was rendered or initiated; and (d) the record must be sufficiently comprehensible to enable another practitioner to effectively undertake the patient's ongoing care in reliance on the record."

Section 6 says nothing about technology or who drafts the entry. An AI-drafted note meets the standard only when the finished entry satisfies every limb above.

The professional bodies fill the gap with warnings, not rules. MDA National (July 2026): "Once entered into the patient's clinical record, the notes are deemed to have been reviewed and approved by the clinician, regardless of whether the clinician has checked them or not." Avant adds that scribe-drafted notes "must meet the requirements of the Medical Board's Good medical practice: a code of conduct for doctors in Australia and the Medical Benefits Schedule (MBS), Health Insurance Act 1973 (Cth) and Health Insurance Regulations 2018 (Cth)."

No Services Australia or PSR public statement on AI-drafted notes exists as at 24 September 2026. PSR's own AI transparency statement (updated February 2026) says it "is considering AI usage in a longer-term timeframe with specific regard to ... the use of AI for managing and viewing medical records ... during a review". That is a plan to think about it, not a rule.

Volume, not records, drives the other PSR trigger: under section 8 of the Regulations, a practitioner enters the prescribed pattern by rendering 80 or more relevant services on each of 20 or more days in a 12-month period, or 30 or more relevant phone services on the same basis. See our 80/20 rule guide for the mechanics.

What should a practice do now?

1. Inventory every tool that suggests, pre-fills or confirms MBS items, including scribes, PMS add-ons and analytics products, noting which appear without anyone switching them on. (Lyrebird's chip "automatically appears" after a consult and "requires no additional setup"; do not assume that generalises to other products.)
2. Keep human review: the practitioner checks each suggested item against the MBS descriptor and "any specific Medicare requirements" (RACGP) before the claim goes in.
3. Make sure the note explains the service billed. Section 6(c)(ii) requires "sufficient clinical information to explain the service", completed at the time or as soon as practicable after.
4. Keep the software updated, as the toolkit advises, and name who in the practice owns MBS updates.
5. Run a periodic self-audit of item combinations against your historical pattern, our suggestion, framed around the co-claiming modelling DHDA expects to finish by the end of 2026.
6. If you find a wrong claim, use the voluntary acknowledgement route: "no penalty will apply to voluntary acknowledgements."
7. Put the item suggestion tool in your privacy policy review before 10 December 2026: see our automated decision-making post on APP 1.8(c).
8. Check where your scribe vendor processes data. The Estimates brief noted some suppliers "may be unaware their cloud platforms send data outside Australia"; our AI privacy guide covers the rest.

Does the 10 December 2026 privacy change apply to billing suggestions?

APP 1.7, inserted by the Privacy and Other Legislation Amendment Act 2024 and starting 10 December 2026, requires the privacy policy to contain the APP 1.8 information if "the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision", "the decision could reasonably be expected to significantly affect the rights or interests of an individual", and "personal information about the individual is used in the operation of the computer program". Whether an item suggestion the practitioner accepts satisfies those three limbs is worked through in our automated decision-making post, which covers billing and item selection under APP 1.8(c).

Frequently Asked Questions

Is it illegal to use software that suggests MBS item numbers?

No. DHDA told the ANAO in March 2026 that "there are no regulatory requirements in place to enforce compliance" over AI-enabled prompted billing software. The claim rules still apply in full, and the practitioner remains responsible for every claim, "even if the practice software was used to facilitate the process".

Does an AI-drafted note meet Medicare's record-keeping requirements?

Section 6 of the PSR Scheme Regulations 2019 sets a technology-neutral standard: patient name, a separate entry per attendance, the date, "sufficient clinical information to explain the service", timely completion, and comprehensibility for another practitioner. An AI-drafted note meets it only if the finished entry satisfies every limb. No PSR or Services Australia statement on AI notes exists.

Will Medicare know if my practice uses AI billing software?

No, not directly. The draft May 2026 intelligence report said "existing capability does not enable the identification of practices or practitioners using prompted billing functionality (including those that use AI)", though "most inappropriate claiming should be detectable through existing capability". DHDA anticipates completing co-claiming modelling by the end of 2026.

Who is responsible if an AI tool suggests the wrong item?

The practitioner. The Department's toolkit says practitioners are responsible for all claims "even if the practice software was used to facilitate the process". Avant is blunt: "It will not be a defence to say an error was due to the use of an AI scribe." The engaging practice can also share a debt under section 129ACA, our reading, if it controlled the circumstances and gained a financial benefit.

Do I have to disclose AI billing tools in my privacy policy?

From 10 December 2026, possibly. APPs 1.7 to 1.9 start that day, and disclosure is required where a computer program makes a decision that could reasonably be expected to significantly affect rights or interests, using personal information in its operation. Whether an accepted item suggestion meets those limbs is analysed in our automated decision-making post.

What did the ANAO recommend about AI in Medicare claiming?

Recommendation 1 asks DHDA to work with other agencies and sector stakeholders to identify and assess AI risks in healthcare, including in MBS claiming, and whether current controls are effective. DHDA agreed. Neither the recommendation nor the response gives a date; the only dated item is the co-claiming modelling anticipated by the end of 2026.

Can the Department ask for records to check a billed item?

Yes. Under section 129AAD of the Health Insurance Act 1973, the Chief Executive Medicare may issue a notice to produce documents where there is a reasonable concern a payment exceeded what was due. The notice can cover claims made in the 2 years before the first written request.

Should we switch off item suggestions?

Nothing requires it. DHDA confirmed there are no regulatory requirements governing this software, and its own response says providers "may use artificial intelligence in ways that are consistent with Medicare requirements". The decision is the practice's; what keeps it safe is human review of every suggested item and a note that explains the service billed.