Insurer medical reports and AI patient privacy: what a GP report to an insurer gives away in ChatGPT or Claude.

A GP report to an insurer is the most detailed account of a patient the practice writes for anyone outside it. An income protection insurer asks for the diagnosis, the treatment, the prior history, the lifestyle and the doctor’s opinion about work capacity, and the patient has signed an authority for exactly that. The report is long and repetitive, so it is pasted into ChatGPT or Claude to draft or shorten. This page marks every item in a routine insurer report that the Privacy Act, Good medical practice and the NSW health records law bear on, and shows how the same report is drafted on Ermos inside the practice.

The medical report to an insurer

Written when a patient claims on an income protection or life policy and signs an authority for the insurer to obtain the GP’s report. The authority sets how much the doctor may say.

An invented report. The insurer and claim number are fictional and the registration number is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The patient and the claim reference

   Name, date of birth and an insurer’s claim number. A live claim, tied to a person. Privacy Act guide.

2. 2
   Occupation and the physical demands of the work

   A named business and what the work involves. Employment information, and the factual base for the opinion on capacity. Privacy Act guide.

3. 3
   Diagnosis, imaging and the cause

   A diagnosis, the scan and where it was done, and how the injury happened. Health information is sensitive information under the Privacy Act. Patient data guide.

4. 4
   Treatment, medication and the specialist

   Named physiotherapist and surgeon, medications and a date. Health information and a map of everyone involved in the patient’s care. Patient data guide.

5. 5
   Prior back history and past depression

   Earlier episodes the insurer asked about, including a mental health history from 2023. Disclosed to an insurer under authority, and a different matter in a chat tool. Sensitive health information. Patient data guide.

6. 6
   Smoking, alcohol and BMI

   Lifestyle facts that an insurer weighs. Health information given to the doctor in confidence. Patient data guide.

7. 7
   The doctor’s opinion on capacity

   The GP’s view on fitness for work and the expected return date. Clinical and professional judgement that a doctor must form and own.

8. 8
   Income, mortgage and fear of losing the house

   Financial detail the patient shared to explain his situation. Personal information, and context the insurer did not ask for. Privacy Act guide.

9. 9
   The scope of the patient’s authority

   The authority sets what the doctor may disclose to the insurer. APP 6 turns on consent and on what a patient would reasonably expect, and it names the insurer only, leaving an AI tool out of it. Privacy Act guide.

10. 10
    The doctor and registration number

    Ties the report to a named doctor bound by Good medical practice. Registration details are public, but they identify the source.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in healthcare practices. See how this works in practice: Correspondence summaries on Ermos.

Common questions