What's in this pack?
From 10 December 2026, APPs 1.7 to 1.9 require a practice whose computer programs make, or substantially and directly help make, significant decisions about patients to say so in its privacy policy: the kinds of personal information used and the kinds of decisions. The RACGP privacy policy template (last updated June 2025, file metadata May 2025) has a section on AI scribes and no automated decision-making clause, and Digital Rights Watch found only "4 out of the 60" AI-scribe practices it reviewed explained the scribe in their privacy policy. This pack is that missing section, built as an insert for the policy you already have, with the inventory and test that decide which clauses apply.
- Cover and how to use this pack. Practice details, a six-step how-to, the dates the pack was checked against and a boundary table.
- Part A, ADM inventory. One row per system: the feature and whether it was on by default, each limb of APP 1.7, who reviews the output, and the clause block used. A short list of AI features often on by default sits under it.
- Part B, the three questions. APP 1.7 in full, the OAIC's flowchart logic in our words as three yes or no questions, and its rule for doubt: take the cautious approach.
- Part C, the clauses. A section opening, then seven blocks: AI scribe and clinical documentation; online booking and triage; AI phone agent or receptionist; document triage; billing and Medicare item suggestion; recall and risk ranking; clinical decision support. Each has a note on when it applies in our reading and the three APP 1.8 clauses. Then a grouped variant and a section closing.
- Part D, review record. The first row is pre-filled for 10 December 2026, with rows for every later change.
- Approval. Sign-off by the approver and the privacy officer.
Editable placeholder fields
The practice name, ABN, address, privacy officer name and email, approver and dates are yellow-highlighted {{placeholder}} fields. The clauses are plain text you edit: strike what your program does not use and choose one (b) option per block. The free Privacy Policy template uses the same placeholder names, so one set of details fills both.
A sample block
This is the AI scribe block from Part C. It is our illustrative wording, not OAIC text.
(a) Kinds of personal information
The AI scribe we use works from the audio and content of your consultation. This is health information: what you tell your clinician about your symptoms, history, medicines and concerns, and what your clinician says in reply.
(b) Kinds of decisions made solely by the program
Where it decides alone:
Our AI scribe records the diagnoses, problems or Medicare items it suggests in your record or claim without a clinician checking them first.
Where it never does (the usual case):
No decisions about you are made by the AI scribe on its own. Your clinician checks everything it drafts before it is saved, sent or billed.
(c) Kinds of decisions the program helps make
Your doctor or other clinician uses the AI scribe's suggestions when deciding which diagnoses or problems to record, which tests, treatments or referrals to offer you, and which Medicare items to bill. Your clinician can change or reject any suggestion.
The other six blocks follow the same shape, each naming health information wherever the program uses it.
An insert for the policy you already have, not a new privacy policy
| Document | The question it answers |
|---|---|
| AI and ADM Privacy Policy Clauses (this pack) | Which programs make or feed significant decisions about patients, and what the privacy policy must say about them under APP 1.8 |
| Privacy Policy (free) | The public APP 1 document this section is pasted into |
| AI Acceptable Use Policy (free) | Which AI tools staff may use and how; its AI register's "features that suggest or decide" column feeds Part A |
| AI Scribe Patient Information and Consent Form (free) | What patients are told about a scribe in the consultation, and how consent is asked for and recorded |
| AI Scribe Governance Pack | How an approved scribe is run, monitored and evidenced for F11 day to day |
| Patient Data Collection Notice | The APP 5 notice at the point of collection, updated if it names a program |
| Privacy Impact Assessment | Whether a program's data flows are acceptable before it goes live |
A worked example. A practice switches on item suggestion in its billing software, and the AI Acceptable Use Policy's register records it as a feature that suggests. Part A of this pack runs the three questions over it and Part C gives the billing clause, which the privacy policy then carries.
What APPs 1.7 to 1.9 require from 10 December 2026
APP 1.7 is inserted by item 88 of Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024:
1.7 Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if:
(a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
(b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
(c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.
APP 1.8 sets out what the policy must contain:
1.8 The information covered by this subclause is:
(a) the kinds of personal information used in the operation of such computer programs; and
(b) the kinds of such decisions made solely by the operation of such computer programs; and
(c) the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.
APP 1.9 widens both. Refusing or failing to make a decision, or to do a thing, counts. A decision affects a person's rights or interests whether the effect is adverse or beneficial.
Item 89 settles old systems. The duty applies to every decision made after 10 December 2026, even if the arrangement with the program was made before that day, the program used the personal information before it, or the information was acquired or created before it. A policy that leaves out APP 1.7 information falls under the civil penalty in s 13K: up to 200 penalty units for an individual and 1,000 for a body corporate, which at $364 a unit is $72,800 and $364,000 (our calculation).
What the OAIC's guidance adds
The OAIC published version 2.0 of chapter 1 of the APP guidelines on 30 September 2026, with a fact sheet. The fact sheet lists "computer programs used to prioritise the provision of health or disability services to individuals" among decisions generally in scope.
Its first worked example is a health and aged care provider whose spreadsheet scores people on details including blood pressure, body mass index and medication, and ranks them so staff can decide whom to contact and book. That is in scope, and it stays in scope if staff use the ranking to decide whom not to contact.
A person checking the output does not end the question, as chapter 1 says: "Importantly, a decision may be within scope of the APP 1.7-1.9 transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review."
Paragraph 1.70 says entities "may group information about the categories of decisions and types of personal information in their privacy policy to comply with the transparency obligation. However, the level of detail provided about these processes must be meaningful to a reasonable person." Paragraph 1.71 adds: "Privacy policies should be able to clearly articulate where more sensitive types of information (e.g. health information or biometric templates) are used in the making of a computer’s decision."
Where a practice is unsure, the fact sheet is direct: "APP entities in doubt of whether their use of a computer program falls within the scope of the transparency obligation should take a cautious approach and include information in their APP privacy policy necessary to comply with APP 1.8 requirements."
The guidance names no practice system, so where each of the seven falls is our reading, recorded in Part B and in each block's note. Our ADM deadline post has the full analysis and the glossary has the definition.
RACGP F11, the evidence side
Criterion F11 of the 6th edition Standards says: "If the practice uses AI tools, it needs to inform patients of how these tools use their health information", and that "it must consider how to meet its obligations under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs)." The ACSQHC says accreditation under the NGPA Scheme "currently uses the 5th edition of the Standards" and that "Information about arrangements for the 6th edition of the Standards will be provided in due course" (page last updated 26 August 2026). The pack will be evidence for F11 once it is assessed; the duty it answers is the Privacy Act's, which starts on 10 December 2026.
How to use this pack
- List every program that touches patient information and makes or feeds a decision, including features that were on by default (Part A).
- Answer the three questions for each (Part B), and record the answer either way.
- Keep the Part C blocks that apply, delete the rest, and choose the "solely" or "assisted" wording in each.
- Paste the section into your privacy policy as a new section headed "Decisions made by computer programs", after your AI scribe section if you have one, and update your APP 5 collection notice if it names the programs.
- Publish before 10 December 2026 and complete the first row of Part D.
- Repeat Parts A to D whenever a feature is switched on or off, a program changes or a vendor update adds a feature, and at least once a year.
Related templates and tools
- Privacy Policy (free): the APP 1 policy this section goes into, with the same placeholder names.
- AI Acceptable Use Policy (free): the internal rulebook whose AI register feeds Part A.
- AI Scribe Patient Information and Consent Form (free): what patients are told about a scribe in the room.
- AI Scribe Governance Pack: the scribe's policy, register, monitoring and F11 evidence map.
- Patient Data Collection Notice: the APP 5 notice to update if it names a program.
- Privacy Impact Assessment: for a program's data flows before it goes live.
- Privacy policy wording for automated decision-making: the full analysis, the penalties and the same example clauses.
- Automated decision-making (glossary): the APP 1.7 definition, limb by limb.
- How to deploy an AI phone receptionist without breaching privacy: the steps behind the phone agent block.
- How to assess an AI scribe for privacy compliance: the assessment that tells you what your scribe actually does.
- AI privacy for healthcare: the wider APP obligations when a practice uses AI.
Frequently asked questions
Does my practice have to add this by 10 December 2026?
Yes, if any program you have arranged for meets all three limbs of APP 1.7. Every health practice is an APP entity whatever its turnover, so there is no small business exemption to fall back on. If you are unsure whether a program is caught, the OAIC says to "take a cautious approach" and include the information.
Is this a new privacy policy?
No. It is one new section for the policy you already have, plus the inventory, test and review record behind it. If you have no policy yet, start with the free Privacy Policy template.
Does an AI scribe count as automated decision-making?
In our reading, it depends on what it does. A scribe that only drafts a note the clinician reviews, edits and signs is documentation: chapter 1 leaves out a program used "for purposes other than facilitating the decision-making (such as using a word processing program to document a decision)". A scribe that proposes diagnoses, item numbers or referrals the clinician routinely accepts is APP 1.8(c), because the OAIC treats generative AI outputs used in significant decisions as generally in scope "unless subject to extensive human oversight and control".
What if a person always reviews the output?
That alone does not take the program out: chapter 1 says a decision may be in scope even where the output "is subject to human review." What matters is whether the output is a key factor in the decision. Part B helps you judge that and Part A records the answer.
Can we group several programs in one clause?
Yes, if the result is meaningful to a reasonable person (paragraph 1.70). Where all decisions rely on the same type of information, paragraph 1.72 says an entity is "not required to separate out each decision on a granular basis". The pack's grouped variant still names health information, as paragraph 1.71 asks.
Where do the clauses go in our policy?
In a new section headed "Decisions made by computer programs", the heading the OAIC's own sample sections use. If your policy follows the RACGP template, whose sections are questions such as "How are Artificial Intelligence (AI) Scribes used?", put it straight after that scribe section; the pack also gives a question-style heading to match.
How is this different from the AI Acceptable Use Policy?
The AI Acceptable Use Policy is an internal rulebook: which tools staff may use, on which settings, with what information. This pack is public policy content: what patients are told about programs that make or feed decisions about them. The AUP's register is the starting list for Part A.