Dental recall lists and patient data leakage: what a recall spreadsheet gives away in ChatGPT or Claude.

The recall list is the spreadsheet a dental practice uses to chase overdue check-ups and unfinished treatment. It is easy to export from the practice software, and a manager who wants to write reminder messages, sort the list or find the patients who owe the most is tempted to upload it to ChatGPT or Claude. A recall list holds a column of named patients with their phone numbers and what treatment they still need, which is a health record in table form. This page marks every cell type in a routine recall list that the Privacy Act and NSW health records law bear on, and shows how the same list is worked on Ermos inside the practice.

The recall list

Exported from the practice software at the start of each month or quarter and worked through by reception, who add notes as they ring. It often sits in a shared drive long after the calls are made.

An invented spreadsheet. The practice and every patient are fictional; the phone numbers are placeholders. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   Patient names

   A column of named patients of one practice. Each name on a recall list is a statement that the person is a patient, which is itself health information, and it is the key to every cell beside it. Patient data guide.

2. 2
   Visit and recall dates

   When each patient last attended and when they are due. Low risk on its own, but beside a name it shows who attends rarely and who is overdue. Privacy Act guide.

3. 3
   Treatment pending

   The next procedure for each named patient: a biopsy review, an implant, a sedation, an orthodontic assessment. Health information, and the column that makes a recall list a clinical document. Patient data guide.

4. 4
   Phone numbers

   Mobile numbers, some of them a parent’s or a daughter’s. Personal information of the patients and of the relatives named beside them. Privacy Act guide.

5. 5
   The notes column

   Free-text remarks added during calls: a pending biopsy result, anticoagulant treatment, pregnancy, dementia, a court order. Sensitive information under the Privacy Act, and the most dangerous column in the sheet. Patient data guide.

6. 6
   Children and a person under 18

   Two patients who are minors, listed with a parent’s number. The Code of conduct (section 4.3, on children, young people and other patients who may have additional needs) asks practitioners to place the interests and wellbeing of the patient first, and a custody note is exactly what should stay inside. Privacy Act guide.

7. 7
   The formula

   A formula that flags overdue recalls. It contains no patient data and says nothing about any person, though a spreadsheet file can also hold formulas that pull from other sheets or files.

8. 8
   Other tabs

   A tab name that tells the reader there is a separate list of domiciliary patients. An uploaded file carries every tab, hidden columns and cell comments, and the file properties such as the author, which is more than what is on screen. Privacy Act guide.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in dental practices. See how this works in practice: Recalls on Ermos.

Common questions