Six privacy risks to review before the new AI transparency rules begin

Healthcare practices increasingly use software to organise patient information, support clinical work and manage recruitment. As these tools become more capable, practice owners need to understand how they influence decisions about people. 

A program that helps prioritise appointments or assess job applicants may do more than save administrative time. Its output may affect access to care or employment opportunities. 

On 30 September 2026, the Office of the Australian Information Commissioner (OAIC) published new resources explaining privacy transparency obligations that commence on 10 December 2026.  

This transparency obligation was introduced by the Privacy and Other Legislation Amendment Act 2024 through amendments to APP 1 of the Australian Privacy Principles. It requires APP entities to include additional information in their Privacy Policies where computer programs use personal information to make, or substantially and directly contribute to, decisions that could reasonably be expected to significantly affect an individual’s rights or interests.  

For medical and allied health practice owners, preparation starts with understanding what your systems actually do. Adding a general statement that “we use AI” may leave patients and applicants without the information the new rules require. 

1. Assuming a small practice is outside the rules 

The new requirements sit within APP 1.7–1.9 and apply to APP entities. Private organisations that provide a health service and hold health information are covered by the Privacy Act 1988 (Cth), including small businesses. 

A small psychology clinic, physiotherapy practice or general practice should therefore avoid assuming its turnover removes its privacy obligations. 

However, being covered by the Privacy Act does not mean every software function triggers these additional disclosures. The particular use must satisfy the decision-making test. 

In practical terms, the practice must have arranged for a computer program to make a decision, or do something substantially and directly related to making it. The program must use personal information about the individual, and the decision must reasonably be expected to significantly affect that person’s rights or interests. 

Practice owners should assess these requirements together, rather than treating every digital process as significant automated decision-making, and this is something that You Legal regularly assists practices with.  

2. Looking only for tools labelled “AI” 

The OAIC’s guidance covers a broad range of computer programs. Rule-based systems and spreadsheet formulas can fall within scope, alongside machine learning and generative AI. 

This matters because a practice may already use relevant automation without describing it as artificial intelligence. 

For example, the OAIC’s fact sheet describes a health and aged care provider using a spreadsheet to score and rank people’s need for support. Staff use those rankings to decide whom to contact and schedule for services. The example falls within the transparency obligation. 

For a clinic, functions worth reviewing include: 

• scoring intake responses to prioritise access to appointments 

• recommending care pathways using patient information 

• ranking applicants for clinical or administrative roles 

• generating recommendations that materially influence access to services. 

These are indicators for assessment, rather than a conclusion that every use is covered. A routine appointment reminder may have a different role and impact from a system that determines who receives an urgent appointment. 

The focus is the connection between personal information, the software’s output and the resulting decision. 

3. Relying on human approval as a complete safeguard 

A common assumption is that automated decision-making rules apply only when a computer makes the final decision. The new requirements also cover programs that do something substantially and directly related to a significant decision. 

The OAIC explains this as a program being a key factor in facilitating the human decision, with a direct connection to it. An advisory output can therefore fall within scope. 

Consider a hypothetical clinic where software ranks referrals by urgency and a staff member approves the list. If the rankings materially drive appointment allocation, the human approval does not automatically remove the disclosure obligation. 

AI scribes also need a careful assessment. A tool’s role may range from recording information to generating summaries or recommendations that substantially influence treatment decisions. Practice owners should examine the actual workflow, including the extent of human oversight and control. 

The relevant question is how independently the clinician evaluates the information and how much the software contributes to the decision. The practice Privacy Policy should reflect that operational reality. 

4. Publishing a vague statement about AI 

Where the requirements apply, the Privacy Policy must describe three categories:  

1. the kinds of personal information used by the relevant programs,  

2. the kinds of significant decisions made solely by those programs, and  

3. the kinds of significant decisions to which the programs substantially and directly contribute. 

Simply saying “we use AI technology to improve our services” may not provide meaningful information. 

For a practice using software to prioritise care, relevant information might include symptoms, medical history and intake responses. The Privacy Policy should explain the kinds of decisions those inputs support, such as prioritising access to services, where that accurately reflects the practice’s processes. 

Health information should be clearly identified. Patients should be able to understand its role without needing technical knowledge. 

The OAIC allows information to be grouped into meaningful categories. Practices do not need to overwhelm patients with technical specifications or describe every background process individually. The explanation does need to be specific enough to show how personal information contributes to significant decisions. 

5. Assuming the software provider handles compliance 

Using an external platform does not automatically transfer the practice’s transparency obligations to its supplier. The OAIC generally expects responsibility to remain with the entity using personal information to make or inform the significant decision. 

Practice owners need enough information from providers of third-party software to explain their own use accurately. 

Useful questions include: 

• what personal information does the feature use? 

• what scores, rankings, recommendations or decisions does it produce? 

• which outputs depend on other integrated systems? 

• what oversight can our team exercise before acting on an output? 

A supplier’s general Privacy Policy may describe its business without explaining your clinic’s configuration or workflow. That distinction becomes particularly relevant where optional features are enabled or software integrates with other platforms. 

Before adopting a feature, consider whether the supplier can provide a clear explanation of how it operates. Uncertainty about a tool’s role makes accurate disclosure and effective oversight harder. 

6. Treating the Privacy Policy update as the whole compliance task 

These provisions introduce new requirements for greater transparency. Updating a Privacy Policy does not, by itself, establish that a particular use of personal information is lawful. 

Practices must still consider their existing obligations concerning collection, use, disclosure, security and other applicable privacy requirements. Consent, where required, needs separate attention. 

Preparation should begin with an inventory of relevant systems, including tools used by reception, recruitment teams and practitioners. Assess which processes meet the new test, document the reasoning and obtain missing supplier information. 

Then seek legal assistance to update the Privacy Policy to reflect the covered uses and make it available to the people who need it. Staff should understand the explanation and know how to respond to enquiries. 

Assigning responsibility for future reviews helps keep disclosures accurate when software features, settings or workflows change. 

Why periodic agreement reviews matter 

Privacy Policies should accurately reflect how a practice collects, uses, stores and discloses personal information. As software and workflows change, practice owners should review their policies to ensure they clearly explain how patient information is handled, including any use of computer programs to make or materially inform significant decisions about individuals. 

Periodic reviews help identify gaps between documentation and actual practice. For this update, that means checking whether agreements support appropriate information handling and whether your Privacy Policy explains the relevant decision-making processes before 10 December 2026. 

If you would like support assessing your practice’s use of AI and automated decision-making or you’d like to discuss reviewing your Privacy Policy and related documentation, click the button below to contact us and one of our team will get in touch very soon.

Privacy Policy

You Legal Fast Track Solution

If you’d like to learn more, take a look at the OAIC web page containing resources on transparency for use of AI and automated decision-making.