Dental radiology reports and patient privacy: what a CBCT or X-ray report gives away in ChatGPT or Claude.

A dental radiology report comes back from the imaging centre in technical language, and the dentist or a nurse wants it in plain English, either to explain to the patient or to paste into the chart. That is a common task for ChatGPT or Claude. The report carries the patient’s identity, the clinical question, findings about nerves and bone, often an incidental finding unrelated to teeth, and a reference to the images themselves. This page marks every item in a routine CBCT report that the Privacy Act and the Dental Board’s Code of conduct bear on, and shows how the same report is summarised on Ermos inside the practice.

The dental radiology report

Returned by an imaging centre after a scan requested by the dentist. Section 8.3 of the Code of conduct lists investigations among the things a health record should cover, and asks that the record be held securely.

An invented radiology report. The imaging centre, radiologist, dentists and patient are fictional; the accession number is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The patient and the referrer

   A name and date of birth beside a named referring dentist. Personal information under the Privacy Act and health information as it is collected in providing a health service. Patient data guide.

2. 2
   The clinical question

   Why the scan was requested: a recurring infection and an upcoming surgery under sedation. Health information, and a record of the dentist’s reasoning. Patient data guide.

3. 3
   Technique

   Scan parameters and the reconstructions viewed. Generic technical wording, with no information about the patient other than a date.

4. 4
   Findings about the teeth and the nerve

   Anatomical relationships for named teeth, including contact with the nerve canal. Clinical content the Code of conduct (section 8.3) expects the record to hold, and health information under the Privacy Act. Patient data guide.

5. 5
   An incidental finding in the neck

   A possible vascular calcification unrelated to teeth, with a recommendation for medical review. Sensitive information the patient may not yet have been told, and a result that a person must read carefully rather than a summary. Patient data guide.

6. 6
   A sinus finding

   A small mucosal thickening noted in passing. Health information, usually minor, but still about a named patient. Patient data guide.

7. 7
   The impression and recommendations

   The radiologist’s conclusion and what to do next, including a risk discussion with the patient. The summary the dentist will rely on, and the patient’s consent conversation depends on it (Code, section 4.2).

8. 8
   The imaging centre and radiologist

   A named radiologist and practice. Public details of a registered practitioner, tied to the scan.

9. 9
   The accession number and image access

   The reference that unlocks the images for 90 days. An identifier for the scan; anyone with access to the viewer could use it. Privacy Act guide.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in dental practices.

Common questions