AI scribe transcripts and patient privacy: what a consultation transcript gives away in ChatGPT or Claude.

An AI scribe turns a consultation into a transcript and a draft note. Doctors then copy the transcript into ChatGPT or Claude to reshape the note, write a letter or check what they missed. A transcript holds every word as it was spoken: the symptoms, the asides, the confidences and anything said in the room by a third person, including another patient’s name. This page marks every item in a routine GP consultation transcript that the Privacy Act, Good medical practice and the NSW health records law bear on, and shows how the same transcript is worked on Ermos inside the practice.

The AI scribe consultation transcript

Produced during a consultation when a GP uses an AI scribe and the patient has agreed. The RACGP asks practices to obtain consent to use a scribe at the beginning of each consultation, and Ahpra asks practitioners to check the accuracy of records created with generative AI.

An invented transcript. No vendor is named. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The consent exchange

   The patient agrees to the scribe. The RACGP asks for consent at the start of each consultation using a scribe, and Ahpra asks practitioners to obtain informed consent and ideally note the patient’s response in the health record. Agreement to a scribe does not obviously cover pasting the transcript into a different tool. Patient data guide.

2. 2
   The symptoms, with a local landmark

   Health information is sensitive information under the Privacy Act. The station and street tell a reader where the patient lives and walks. Patient data guide.

3. 3
   A bereavement, insomnia and drinking

   A husband’s death, a sleep problem and alcohol use, said aloud in confidence. Held in confidence under Good medical practice 4.4. Patient data guide.

4. 4
   A family dispute with named relatives

   A daughter and her husband named in a disagreement about the patient’s home. Third-party personal information, in the patient’s voice. Privacy Act guide.

5. 5
   Results and clinical advice as spoken

   Numbers and a treatment decision said aloud. Clinical judgement and a record the doctor has to be able to stand behind. Patient data guide.

6. 6
   A request not to record something

   The patient asks for drinking to be left out of the notes, which the transcript has already captured. An aside that would not reach the written record. Patient data guide.

7. 7
   Another patient’s name and a call about his symptoms

   A receptionist interrupts and names a second patient, his wife and his symptoms. A stranger’s health information caught by a recorder in the room. Patient data guide.

8. 8
   The header: tool, doctor, room, date and time

   Identifies the doctor, the clinic and the exact consultation. It lets a reader link the transcript to the patient from other records.

9. 9
   The review notice

   A line saying the draft needs clinician review before it is saved. Process wording with no patient detail.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in healthcare practices. See how this works in practice: Clinical documentation on Ermos.

Common questions