Solicitor records requests and AI privacy: what a request for GP records gives away in ChatGPT or Claude.

Solicitors write to GPs every week asking for a patient’s records for a personal injury or compensation claim, usually with a signed authority. The practice has to work out what the authority covers, what is relevant and what to leave out, and the reply is often drafted in ChatGPT or Claude with the record pasted in to summarise. This page marks a routine request and the draft reply, and shows how the same reply is prepared on Ermos inside the practice.

The solicitor’s request for records

Received from a solicitor acting for a patient, or for another party with the patient’s authority. The GP reviews the record and the practice sends the relevant parts with a covering letter.

An invented request and reply. The law practice, the patient and the claim are fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The patient, the accident and the claim

   Identifies the patient and an active legal claim. Privacy Act guide.

2. 2
   The request and the authority

   What the solicitor asked for and the period it covers. The authority is the patient’s consent to disclosure to that solicitor, which APP 6.1(a) allows; it does not extend to other recipients. Privacy Act guide.

3. 3
   The accident injuries

   The part of the record the claim is about. Health information, which is sensitive information under the Privacy Act. Patient data guide.

4. 4
   A psychiatric admission and a suicide attempt

   Mental health history from years before the accident, with a medicine that identifies the condition. The most damaging item on the page if it travels further than the patient intends. Patient data guide.

5. 5
   Sexual and reproductive health

   Screening and a termination referral, unrelated to the claim. Health information the patient would not expect to leave the practice. Patient data guide.

6. 6
   The patient’s instructions

   A recorded conversation about what she wants withheld. The practice has to follow it, which needs control of every copy. Patient data guide.

7. 7
   The draft reply

   Practice wording limiting the disclosure to the accident. Written to be sent to the solicitor, and it gives away little.

8. 8
   The practice signatories

   Staff names, linked here to this patient’s claim.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in general practitioner (GP) practices. See how this works in practice: Certificates and reports on Ermos.

Common questions