Dental health history forms and AI privacy: what a new patient form gives away in ChatGPT or Claude.

Every new patient fills in a health history form, and it is one of the densest documents a dental practice holds. It asks for identity, contact details, Medicare and health fund numbers, medical conditions, medications, allergies, pregnancy, mental health and smoking, all on one page. Reception staff paste it into ChatGPT or Claude to turn it into a summary for the dentist or to enter it into the practice software. This page marks every item on a standard form that the Privacy Act and NSW health records law bear on, and shows how the same form is read on Ermos inside the practice.

The new patient health history form

Completed by a new patient before the first appointment, then updated at later visits. It is the first health information the practice collects, so it is also where the practice’s privacy collection notice and the patient’s consent to contact sit.

An invented form. The patient is fictional; the Medicare number, health fund number, phone numbers and email address are obvious placeholders. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   Full name, date of birth and home address

   The identity of a new patient, with the address the practice will mail to. Personal information under the Privacy Act, and health information once it is collected on a health history form. Patient data guide.

2. 2
   Contact details and an emergency contact

   A mobile, an email and a named partner with a number. A third party’s details, given so the practice can reach him in an emergency. Privacy Act guide.

3. 3
   Medicare and health fund numbers

   Government and fund identifiers that unlock claims. Personal information with a real fraud use, collected by practices for claiming. Privacy Act guide.

4. 4
   Occupation and shift pattern

   An employer type and a night roster. Personal information, and it says when the patient is away from home. Privacy Act guide.

5. 5
   Pregnancy and asthma

   A pregnancy, a due date and a hospital admission. Health information is sensitive information under the Privacy Act, and pregnancy changes what the dentist does. Patient data guide.

6. 6
   Medications and an allergy

   Named medicines and a reaction to a class of antibiotics. Health information, recorded for patient safety, with a serious consequence if wrong. Patient data guide.

7. 7
   Mental health and dental avoidance

   Anxiety, psychological treatment and four years away from the dentist. Health information the patient chose to share so she could be treated kindly. Patient data guide.

8. 8
   Smoking, vaping and alcohol

   Lifestyle answers that bear on gum disease and healing. Health information, volunteered to the practice. Patient data guide.

9. 9
   The tick-box conditions

   The practice’s own list of conditions, with no answers in it. Template wording that says nothing about any patient.

10. 10
    The declaration and consent to contact

    The patient’s signed acknowledgement of the privacy notice and consent to SMS and email. The practice’s record of what she agreed to, and a record that does not mention any AI company. Privacy Act guide.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in dental practices.

Common questions