Every Australian clinic now fields the same question from staff: can we use an AI assistant to cut down the admin without breaking privacy rules? It is a fair question. Reception teams, practice managers and clinicians spend hours each week on referral letters, recalls and patient explanations, and tools like Claude can take a real bite out of that load. The catch is that a general practice or allied health clinic also sits close to My Health Record, one of the most tightly governed data sets in the country. Getting the boundary right is what separates a safe rollout from a reportable breach.
What My Health Record is, and why it raises the stakes
My Health Record is the national online summary of a patient's key health information, operated by the Australian Digital Health Agency. It can hold shared health summaries, discharge summaries, pathology and imaging reports, prescription records and immunisation history. Access is governed by the My Health Records Act 2012 and the Privacy Act 1988, and the rules are stricter than for ordinary clinical notes. Unauthorised access, use or disclosure can trigger civil and criminal penalties, and serious or repeated breaches under the Privacy Act now carry penalties of up to A$50 million for organisations. For a clinic, the reputational cost of a breach usually outweighs even that figure.
The point that matters for any AI conversation is that My Health Record data does not stop being regulated the moment it leaves the portal. If a staff member copies a shared health summary into a chat window, the obligations travel with the text. So the real design question is not whether AI is allowed near a clinic. It is which tasks AI can help with, and what data those tasks are ever allowed to see.
Where AI genuinely helps a clinic
Most of the value sits in admin and communication, not in touching the record itself. Claude is strong at turning a clinician's own dictated notes into a tidy referral letter, drafting plain-English explanations of a condition for a patient handout, summarising a long email thread with a specialist's rooms, or writing recall and reminder messages that match your clinic's tone. These are jobs where the source material is content the clinic already controls, and where a human reviews the output before it goes anywhere.
Drafting referral and specialist letters from a clinician's own dictation or point-form notes.
Writing patient-friendly explanations of procedures, medications or results in plain Australian English.
Summarising internal admin: policies, rosters, supplier emails and meeting notes.
Producing first-draft templates for consent forms, recall letters and new-patient onboarding.
Turning a messy spreadsheet of appointment data into a clean weekly report for the practice manager.
The line you do not cross
The failure mode is almost always the same: someone pastes identifiable health information into a consumer AI tool that stores prompts or uses them to train future models. That single act can breach both the My Health Records Act and the Australian Privacy Principles. The safe rule for staff is short and blunt: My Health Record content, and any identifiable patient data, never goes into a general AI tool.
Do not paste shared health summaries, pathology results or discharge summaries into any AI chat.
Do not upload documents that carry a patient's name, Medicare number or Individual Healthcare Identifier.
Do not use AI to make or influence a clinical decision without a clinician in the loop.
Do not assume a free tool keeps your data private. Read the data handling terms first.
How to run AI safely alongside My Health Record
A workable setup keeps two lanes apart. In the clinical lane, My Health Record stays inside your accredited clinical software and the approved access paths, with no AI in the middle. In the admin lane, AI helps with content the clinic authored, using de-identified or non-clinical material only. Claude fits the admin lane well because you can run it under business terms that keep your inputs out of model training, and because it works happily from templates and house style rather than needing raw patient records.
Three controls make the difference. First, a written AI use policy that names exactly what data is off limits, signed by every staff member. Second, de-identification as a habit: strip names, dates of birth and identifiers before any text goes near a tool. Third, human review on everything patient-facing, so a clinician or manager signs off before a letter or handout is sent. A clinic that puts these in place can give a practice manager back the better part of a day each week, worth roughly A$45,000 a year in reclaimed time across a mid-sized Sydney practice, without going anywhere near the record itself.
AI and My Health Record can coexist in an Australian clinic, but only when the boundary is deliberate rather than assumed. Sort out the two lanes, write the policy and train the team once, and the risk drops sharply while the admin savings stay real. If you want help mapping which clinic tasks are safe to hand to Claude and which must stay manual, we can walk through it with you. Book a short session on our contact page and we will map it to your practice.
