Using AI to write health reports safely
AI can cut the time a clinic spends on reports. One report we worked on went from 113 minutes to 18. The catch is patient details. My short answer: take names and identifying details out before any text goes in, use a tool whose contract stops the provider keeping or training on what you type, and have a person check every report before it leaves. Below are the rules behind that advice, with every source linked. It is general information, not legal advice.
What the rules say
Health information has its own code. The Health Information Privacy Code 2020 covers health information about identifiable people held by health agencies in New Zealand, which includes clinics and other health providers. For them, it takes the place of the general privacy principles. Three of its rules matter most when AI is involved.
- Rule 5, security. Health information must be "protected, by such security safeguards as are reasonable in the circumstances". If it goes to a provider for storing or processing, the code expects you to do everything reasonably within your power to stop it being used or disclosed without authority.
- Rule 11, disclosure. You "must not disclose the information" unless you believe, on reasonable grounds, that an exception applies, for example that the patient has authorised it.
- Rule 12, overseas. Health information can go to "a foreign person or entity" only in some cases, for example when the patient authorises it after being "expressly informed" that the recipient may not be required to protect it as well as New Zealand law does, or when you believe on reasonable grounds that the recipient must protect it with "comparable safeguards".
The Privacy Commissioner's general AI guidance is written for the general privacy principles, not the health code, but its practical points still help, including what to check when a tool stores your data overseas and the privacy impact assessment it expects before you start. Both are set out in What is safe to paste into AI.
My advice is to go further than the minimum. Take identifying details out before any text goes in, and pick tools whose contract stops the provider from training on what you type.
What health bodies say
Health NZ's guidance on generative AI is written for its own employees and contractors. It does not bind a private clinic, but it is a useful benchmark. Its expert advisory group "recommends caution", and the guidance tells staff not to enter "personal, confidential or sensitive patient or organisational information into unapproved LLMs", and says users must "take full responsibility for checking the information generated". It also says that public AI tools "are unlikely to respect or appropriately address Māori Data Sovereignty." Māori Data Sovereignty is about the rights Māori have over data about Māori.
The Medical Council's guidance on AI in patient care is written for doctors. It covers AI used in patient care, not purely administrative tasks. It says that, as far as is reasonably practicable, doctors should "check the accuracy of any AI output and confirm it is appropriate for the individual patient" before using it for patient care or putting it in patient records. It expects informed consent when an AI tool records a consultation, such as an AI scribe that listens and writes the notes, and says: "Always document in the patient's records whether informed consent was obtained."
The habits I use with health teams
- Names and identifying details come out before any text goes into an AI tool.
- Check the tool's terms. Does the provider store what you type? Does it train on it?
- Do a privacy impact assessment before you start.
- Tell patients when AI helps with their reports. A patient can say no to AI and still be looked after the usual way. If a tool records the consultation, get consent first and note it in the record.
- A person on your team checks every report before it leaves. You stay responsible for every word.
- Write down which tools are used and where the data is stored, and keep that page.
- Check your funder's own rules on AI before you use it on a funded report.
What it looked like at one provider
We ran a three-hour AI training session for an occupational health provider and built a proof of concept for the reports their staff write.
We cut first. We replaced phone calls with messages and email, under a simple policy.
Then we brought in AI. A voice tool running locally turned speech into text, and a custom GPT drafted the report. Names and identifying details came out before any text went into an AI tool.
We tested it on five reports and checked each one against the version a person wrote. One of those reports took 113 minutes before and 18 after.
More on how I work with clinics: AI for health providers.
Where to start
Start with the scan. 15 to 20 minutes, one person. It does not ask for personal information about your patients. You get a one-page map of which task to fix first.