Private AI for Medical Practices Who Can't Afford a Patient Trust Breach
AHPRA's guidelines on AI keep individual practitioners responsible for how AI is used in their practice, including telling patients about it and, for AI scribes, generally getting informed consent. On 3 August 2026 the TGA also said its review of AI scribes has moved into compliance action against suppliers. Althorn runs on-premise AI entirely on hardware inside your practice, so consult audio and clinical notes never reach a third-party server.
Patients tell their doctor, psychologist or physio things they have not told their partner. They do it because they trust that it stays in the room. AI scribes and documentation tools are genuinely useful, and they are now widely used in Australian clinics. They are also the fastest way to quietly change where a patient's most private information ends up, without the patient or the practice ever making a deliberate decision. Althorn exists so your practice can keep the time savings without ever having to wonder where a consult recording went.
What AHPRA's AI guidance asks of practitioners
- You remain accountable. AHPRA's guidelines, Meeting your professional obligations when using Artificial Intelligence in healthcare, apply the existing National Board codes of conduct to AI. Practitioners stay responsible for the care they deliver, whatever tool helped produce the record.
- Understand the tool. Practitioners need to understand enough about an AI tool to use it safely, including its intended use and limits. AHPRA specifically says it is important to understand how data is used to retrain the AI, where data is located and how it is stored.
- Be open with patients and get informed consent. Practitioners should tell patients about their use of AI. For an AI scribe that uses generative AI, AHPRA says informed consent will generally be required, ideally noted in the health record, and the transcription software should include an explicit consent step before recording proceeds.
- Check the output. If you use an AI scribing tool, you are responsible for checking the accuracy and relevance of the records it creates. TGA approval does not change that.
The Australian Commission on Safety and Quality in Health Care has also published an AI Clinical Use Guide, and a separate AI Safety Scenario on ambient scribes (August 2025).
Two more developments worth knowing about
The TGA is moving from education to enforcement. At a conference on 3 August 2026, the TGA said its year-long review of digital scribes has moved into compliance action against suppliers whose scribes operate as medical devices without seeking registration. Its review flagged scope creep, AI functions that influence clinical decisions, and limited transparency about how products are managed once deployed. Not every scribe is a medical device, because it depends on the tool's intended purpose. This is a vendor obligation, not a new duty on your practice, but it is a fair question to put to any scribe supplier.
Privacy law is moving toward the same question. The exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, released for consultation on 31 August 2026, would define disclosure broadly: an entity discloses personal information if it makes that information accessible to another person or body. It would also create a controller and processor framework, under which a practice can still be held responsible for what a vendor does on its behalf. It is a draft that remains subject to further consideration by government, and it sets no commencement date. It points the same direction as everything above. Where patient information goes, and who can reach it, is becoming the central question.
How Althorn closes the gap
You don't need to stop using AI in your practice. You need it to never leave the building.
Althorn installs on-premise AI that runs on hardware inside your own practice, not a cloud subscription and not an overseas server. Your team keeps AI-assisted consult notes, letters and documentation. The difference is that a patient's recording and record never travel anywhere, so the honest answer to "where does my information go?" is "nowhere, it stays here."
If your practice already uses an Australian-hosted AI scribe, that is a real step up from a public chatbot. But the company running it is still a third party outside your practice, even when the tool sits inside your practice software. On-premise is a different answer to the question, not a more reassuring version of the same one.
What this looks like in practice
- A consent conversation you can finish in one sentence: "your consult notes are processed on our own equipment, in this practice, and never sent to an outside provider."
- No sub-processor chain to explain: no overseas hosting, retention terms or vendor staff access to research on behalf of your patients.
- The same time savings: consult notes, referral letters, summaries and admin drafting, without the patient's information leaving your premises.
- Your review still matters: AHPRA expects practitioners to check AI output, and that does not change. What changes is what you have to explain to a patient.
The reputation case, not just the compliance case
Patients choose a practice because they trust it, and they rarely ask where their information goes until something makes them wonder. Being able to say plainly that your AI never sends a consult outside the practice is a quiet but real reason for a patient to stay, and to refer their family.
Book a 20-minute confidentiality review
Of your practice's current AI use, no obligation.
Book a ConsultationCommon questions
Does AHPRA's guidance stop us using an AI scribe?
No. AHPRA supports safe use of AI and recognises it can reduce administrative burden. The guidance is about how it is used: practitioner accountability, transparency with patients, informed consent and checking the output.
Does the TGA action mean our current scribe is illegal?
Not necessarily. The TGA has said not all digital scribes are medical devices, and it depends on the product's intended purpose. Its compliance action targets suppliers whose products operate as devices without registration. Ask your vendor directly whether the product is a regulated device and, if so, whether it is on the ARTG.
Does the Privacy Act apply to a small practice?
Businesses that provide health services and hold health information are covered by the Privacy Act regardless of turnover, so the small business exemption generally does not help a clinic. A practice's own privacy obligations are separate from, and in addition to, its professional obligations to AHPRA.
What about AI features already built into our practice software?
AI functionality inside existing practice, email or document tools can process patient information without anyone deciding to "use AI." A short audit identifies where this is already happening in your setup.