Dental clinical notes and patient privacy: what a consultation note gives away in ChatGPT or Claude.

Clinical notes are written between patients, in shorthand, and a dentist with a full day is tempted to paste them into ChatGPT or Claude to tidy them into proper sentences or a letter. They are also the most candid document in the practice. They record the medical history, the medications, what the patient said about their fear, their work and drinking, the options discussed and the dentist’s own impression. This page marks every item in a routine consultation note that the Privacy Act, NSW health records law and the Dental Board’s Code of conduct bear on, and shows how the same note is written up on Ermos inside the practice.

The clinical notes

Written at or soon after the appointment. Section 8.3 of the Code of conduct asks practitioners to make records at the time of events or as soon as possible afterwards, to keep them accurate, up to date, factual, objective and legible, and to hold them securely and free from unauthorised access.

An invented clinical note. The practice, dentist and patient are fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The patient

   A name and date of birth, enough to identify a person in a health record. Personal information under the Privacy Act and, as it is collected in providing a health service, health information. Patient data guide.

2. 2
   Medical history and medications

   A psychiatric medication, a sleep disorder and a body measurement. Health information is sensitive information under the Privacy Act, and these facts decide how sedation is done. Patient data guide.

3. 3
   Examination findings

   Clinical findings for named teeth. The core of the clinical record that section 8.3 of the Code of conduct expects to be accurate and held securely. Patient data guide.

4. 4
   A phobia and a panic attack

   Psychological history, including an episode at another practice. Health information, collected because it changes how the patient is treated, and the kind of detail a patient says to a dentist and to nobody else. Patient data guide.

5. 5
   Work, marital status and alcohol

   Occupation, shift pattern, alcohol intake and a spouse’s name. Recorded because alcohol and sleep affect sedation, and personal to him. The shift pattern also says when his home is empty. Privacy Act guide.

6. 6
   The options, the risks explained and the consent steps

   What the dentist discussed and what the patient chose. Section 4.2 of the Code asks practitioners to document consent appropriately and to consider written consent for higher-risk procedures. This is the practice’s evidence of what was said.

7. 7
   The fee discussion

   An estimate, the absence of private cover and a worry about cost. The financial consent conversation the Code expects, recorded in the file. Privacy Act guide.

8. 8
   A relative’s addiction

   Health information about someone who is not the patient, offered in confidence to explain his own wishes. Another person’s sensitive information in this note. Patient data guide.

9. 9
   The dentist’s impression

   A candid suspicion about the patient’s drinking and a reminder to self. Section 8.3 asks for records that are factual, objective and respectful, which is a reason to keep a note like this off anyone else’s servers.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in dental practices. See how this works in practice: Clinical notes on Ermos.

Common questions