Decide the purpose and information first
Before introducing an AI tool, identify the work it is meant to help with and the minimum information it needs. Test the idea with synthetic records. A useful drafting tool does not automatically belong in a workflow involving sensitive participant information.
Review the whole data route
- Which organisation supplies the model and application?
- Where is information processed and retained?
- What do the provider’s terms say about training and access?
- Which staff can use the feature, and how is access removed?
- What consent, notice or other privacy steps does your practice need?
- What happens to recordings, transcripts and generated drafts?
Australian hosting for the practice system does not mean every AI subprocessor is in Australia. Read the specific boundaries rather than relying on a broad “secure AI” claim.
Put review into the workflow
Require the responsible person to check facts, sources and sensitive wording before a record or message is finalised. Define which actions require explicit approval. Keep incident reporting and escalation available if information is shared incorrectly.
Make the policy usable
Give staff concrete examples of allowed tasks and information that must stay out. Name the approved tools and the person to ask when unsure. Review the policy when a vendor or feature changes.
Read the OAIC’s guidance on commercially available AI and CordoCare’s security and subprocessor information. These questions support your assessment; they do not certify a practice or a product.