Mental health treatment plans and AI privacy: what a GP mental health plan gives away in ChatGPT or Claude.

A GP mental health treatment plan is among the most personal documents a practice produces. It records symptoms, scores, a provisional diagnosis, an assessment of risk, substance use, goals and who the patient does and does not want told. It is long, structured and repetitive to write, which is why doctors paste their notes into ChatGPT or Claude to fill the template. This page marks every item in a routine plan that the Privacy Act, Good medical practice and the NSW health records law bear on, and shows how the same plan is drafted on Ermos from the consultation inside the practice.

The GP mental health treatment plan

Prepared by a GP after assessing a patient with a mental disorder, and used to refer the patient to a psychologist or other allied health provider. Medicare item numbers 2715 and 2717 are the plan items for GPs with mental health skills training.

An invented treatment plan. The Medicare number is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   Name, date of birth and Medicare number

   The identifiers that tie the plan to one person. APP 9.2 limits when an organisation may use or disclose a government related identifier such as a Medicare number. Privacy Act guide.

2. 2
   The presentation

   Symptoms and their link to a workplace event. Health information is sensitive information under the Privacy Act. Patient data guide.

3. 3
   Screening scores and a provisional diagnosis

   K10, PHQ-9 and GAD-7 results and a working diagnosis. The core clinical content, and the part an insurer or employer would most like to see. Patient data guide.

4. 4
   The risk assessment

   Self-harm thoughts, protective factors and a safety plan. The most sensitive paragraph in the record, held in confidence under Good medical practice 4.4. Patient data guide.

5. 5
   Alcohol, cannabis and tests ordered

   Substance use and the investigations the doctor ordered. Health information, and detail the patient told the doctor in confidence. Patient data guide.

6. 6
   Goals, treatment and the referral

   The plan agreed with the patient, a named psychologist and a medication change. Clinical judgement that a doctor must check, and information a psychologist will also hold. Patient data guide.

7. 7
   Employer and family circumstances

   A named employer, a plan to resign and who has not been told. The sort of detail that would hurt if it travelled. Privacy Act guide.

8. 8
   Consent and limits on sharing

   Who may receive the plan, who may not, and a refusal of AI scribing. The patient’s expressed wishes, which the practice must follow. HPP 11 of the NSW health records law limits disclosure of health information. Patient data guide.

9. 9
   The billing item and the follow-up date

   Item 2715 identifies the service as a GP mental health treatment plan, and the date shows when the patient returns.

10. 10
    The GP

    Ties the plan to a named doctor bound by Good medical practice.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in healthcare practices. See how this works in practice: Clinical documentation on Ermos.

Common questions