Health assessments and AI privacy: what an older person’s health assessment gives away in ChatGPT or Claude.

A health assessment for a patient aged 75 and over covers the whole of their life at home: memory, mood, continence, falls, medicines, driving, money and who looks after them. The practice nurse usually collects it on a form and the GP completes it, and the write-up is long enough that it is often pasted into ChatGPT or Claude to turn into a summary. This page marks a completed assessment and shows how the same summary is drafted on Ermos inside the practice.

The health assessment for an older person

Completed by the practice nurse and GP for an older patient, often at home, and used to plan care and referrals. A summary goes to the patient and the GP’s record.

An invented health assessment. The patient and carer are fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   Name, age and home address

   Identifies an older man living alone and where he lives. Privacy Act guide.

2. 2
   A memory score and a referral

   A cognitive screening result and a referral for memory assessment. Health information is sensitive information under the Privacy Act. Patient data guide.

3. 3
   Loneliness and a depression score

   Mood, a bereavement and a screening result. Patient data guide.

4. 4
   Continence

   A symptom most patients find embarrassing to discuss, and which he discussed only with the nurse. Patient data guide.

5. 5
   Home hazards and a key under the mat

   Falls risk, and a note that tells any reader how to get into the house of a man with memory problems who lives alone. Privacy Act guide.

6. 6
   Driving concerns

   A family worry about his safety on the road, which nobody has yet raised formally with him.

7. 7
   Finances and a carer under strain

   Who controls his money, a carer’s exhaustion and her question about residential care asked without him present. Confidences from two people. Patient data guide.

8. 8
   Medicines and missed doses

   The number of regular medicines and evidence he is not taking them reliably. Patient data guide.

9. 9
   The consent line

   Records consent to the assessment. It does not cover sending the assessment to an AI provider.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in general practitioner (GP) practices. See how this works in practice: Care plans on Ermos.

Common questions