AI in Healthcare Compliance

What AI compliance means for a practice

There is no single AI law in Australia. The rules come from bodies applying powers they already have (Ahpra, the RACGP, the ACSQHC, the OAIC, the TGA, the NDIS Commission and Medicare), and they bite from the moment a practice uses any AI tool, administrative tools included. Whoever supplies the tool, the practice answers for it: "When AI tools are provided by third parties, practices remain responsible for their safe and appropriate use" (RACGP criterion F11). Some of these rules are law, and others are accreditation criteria or guidance. For the broad picture, start with AI privacy in healthcare.

In-depth guideAI Privacy for Healthcare: 2026 OAIC Compliance Guide

The framework at a glance

Each body has published its own document, and they do not all say the same thing.

Medicare adds an eighth source of risk, billing software, covered below.

RACGP F11: the accreditation criterion for AI

The RACGP published the Standards for general practices, 6th edition, on 26 August 2026. F11 has two criteria, F11.A on safe and secure use and F11.B on assessment, and it applies only where AI is used: "The AI criteria are only applicable and mandatory for practices who use AI tools." Administrative AI counts too. F11 is not yet assessed at accreditation: the ACSQHC, on a page updated 26 August 2026, says "Accreditation under the NGPA Scheme currently uses the 5th edition of the Standards. Information about arrangements for the 6th edition of the Standards will be provided in due course," and no transition date has been announced. F11 leans on F4, CG7 and F10.A. The evidence checklist, RACGP Standards and RACGP accreditation pillar cover the detail; an AI acceptable use policy carries an AI register.

Privacy law: the APPs, overseas vendors and the 10 December 2026 duty

The OAIC's first takeaway in its Guidance on privacy and the use of commercially available AI products (21 October 2024, updated 17 January 2025) says: "Privacy obligations will apply to any personal information input into an AI system, as well as the output data generated by AI (where it contains personal information)." Where a vendor sits overseas, APP 8 and s 16C can make its breach the practice's own. From 10 December 2026, APPs 1.7 to 1.9 (tranche 1 of the Privacy Act reforms) require a practice to disclose where an automated decision could significantly affect a person's rights or interests. Section 6D(4)(b) covers every health practice, whatever its turnover, by taking anyone who provides a health service and holds health information out of the small business exemption. The OAIC published its guidance on the duty on 30 September 2026: chapter 1 of its APP guidelines, Open and transparent management of personal information (version 2.0), now has a section headed "Information relating to decisions made by a computer program". The Australian Privacy Principles, automated decision-making entry and privacy and cyber security pillar carry the detail.

In-depth guideAutomated Decision-Making, Privacy Act: Healthcare 10 Dec 2026 Deadline

Patient consent: where the bodies disagree

The bodies that have spoken on AI consent do not agree on the form, and the practice's medical defence organisation (MDO) decides.

Ahpra's word is "ideally"; it does not require consent to be recorded. Consent has three legal sources: the profession's expectation, state surveillance devices law (NSW Surveillance Devices Act 2007 s 7 requires all principal parties' consent to record a private conversation; other states differ), and APP 6 where the vendor gets access or training rights. The AI scribe patient consent form holds the state-by-state table.

When AI software is a medical device

The TGA's test, on its digital scribes page (last updated 30 January 2026), turns on what the tool does. Scribes intended only to transcribe "without performing analysis or interpretation are not considered medical devices", but "if a digital scribe analyses or interprets clinical conversations, for example by generating a diagnosis, differential diagnosis or treatment recommendation not explicitly stated by the healthcare practitioner, it is considered a medical device," and must be included in the ARTG. From 1 November 2026, F2026L01167 tightens item 2.15, the clinical decision support exemption, and the change applies to software already in use. The duties fall on the sponsor, and the practice's part is to ask each vendor for its ARTG basis in writing. The clinical decision support system entry explains the category.

In-depth guideTGA CDSS Changes 1 November 2026: Which AI Tools Need ARTG Listing

AI scribes: assess before use, check every note

Ahpra says: "If using an AI scribing tool, the practitioner is responsible for checking the accuracy and relevance of records created using generative AI." Before relying on a scribe, assess it: the TGA test, where the data goes, training terms, APP 8, retention and consent. The AI scribe entry defines the tool and the scribe assessment guide walks through the steps. The governance pack covers permitted tools, and a privacy impact assessment gives the assessment a structure.

AI on the phones: receptionists, booking and triage

An AI receptionist records and handles calls, so state recording law and the APP 5 collection notice both apply. The OAIC's fact sheet on the 10 December 2026 automated decision-making duty (published 30 September 2026) lists "computer programs used to prioritise the provision of health or disability services to individuals" among decisions that "would generally be considered in scope". So a tool that books, declines, prioritises or routes callers by urgency may need testing against the duty, though whether a given receptionist tool is caught is our reading, not the OAIC's. Anything clinical goes to a person. The AI phone receptionist guide covers the deployment.

AI billing suggestions and Medicare

The ANAO's Auditor-General Report No. 5 of 2026-27, Artificial Intelligence and Medicare Benefits Integrity (21 September 2026), found about one-fifth of listed billing software websites refer to using AI. Under the Medicare billing assurance toolkit, practitioners answer for claims under their provider number "even if the practice software was used to facilitate the process". The PSR records standard (s 6) is technology-neutral; no AI-specific statement exists. The Medicare billing compliance pillar covers the rest.

In-depth guideAI Billing Software and Medicare: What the ANAO Audit Means for You

NDIS providers and AI

The NDIS Commission's position statement "Use of artificial intelligence in the development of behaviour support plans" (February 2026) does not prevent AI use, but sets an expectation: "The NDIS Commission expects that, if a provider decides to use AI, all information is appropriately de-identified and that no personal information of participants is disclosed to AI systems." No health body quoted above goes that far, and the statement does not say whether it also reaches progress notes. The NDIS Code of Conduct and NDIS provider compliance pillar carry the detail.

The documents a practice needs

Four documents cover most of what the bodies above ask for: an AI acceptable use policy with a register of every tool in use, a patient notice and consent process, a scribe governance pack where a scribe is used, and the digital health technology governance policy, which covers RACGP criterion F10.A's process for assessing digital health technologies.

Common mistakes

• Treating a new AI tool as an IT purchase. F11.B asks for assessment before implementation.
• Leaving administrative AI off the list. F11 names administrative automation, so the booking tool counts.
• Collapsing consent into one "must". Ahpra says "ideally", the other bodies differ on the form, and the MDO decides.
• Assuming the vendor carries the risk. Practices remain responsible for a third party's tool.
• Assuming a tool stays what it was when bought. An update can add a diagnosis and change its TGA status.

Frequently asked questions

Is there a law that regulates AI in Australian healthcare?

No. There is no AI-specific law. The rules come from bodies using powers they already have: Ahpra and the National Boards through the codes of conduct, the RACGP through accreditation criteria, the OAIC through the Privacy Act, the TGA through the Therapeutic Goods Act, and the NDIS Commission through the NDIS Code of Conduct.

Do we need patient consent to use an AI scribe?

Yes. Every body that has spoken on AI consent expects informed consent, but they differ on its form. Ahpra says the patient's response should "ideally" be noted in the health record, the APS wants written, tool-specific consent, and the ACSQHC accepts an opt-out notice. The practice's medical defence organisation (MDO) decides the form, and state recording law also applies.

Is RACGP F11 assessed at accreditation yet?

No. The RACGP published criterion F11 in the 6th edition of its Standards on 26 August 2026. The ACSQHC, on a page last updated 26 August 2026, says accreditation under the NGPA Scheme currently uses the 5th edition of the Standards, and no transition date to the 6th edition has been announced. F11 applies only to practices that use AI tools, administrative AI included.

Is an AI scribe a medical device?

No, not if it only transcribes without analysis or interpretation. Yes, if it generates a diagnosis, differential diagnosis or treatment recommendation the practitioner did not state: the TGA's digital scribes page (last updated 30 January 2026) treats such a scribe as a medical device that must be included in the ARTG.

Does the 10 December 2026 automated decision-making duty apply to small practices?

Yes. Section 6D(4)(b) of the Privacy Act takes any practice that provides a health service and holds health information out of the small business exemption, so the duty applies whatever the practice's turnover. From 10 December 2026, under APPs 1.7 to 1.9, a privacy policy must disclose automated decisions that could significantly affect a person's rights or interests. The OAIC explains the duty in chapter 1 of its APP guidelines (version 2.0, updated 30 September 2026).

Can NDIS providers use AI?

Yes. The NDIS Commission's February 2026 position statement on AI in behaviour support plans does not prevent AI use, provided it complies with legal obligations, but it expects all information to be de-identified and no participant personal information to be disclosed to AI systems. The statement does not say whether that expectation also reaches progress notes.

Last reviewed 6 October 2026