Claims chronologies and AI data leakage: what a claim file gives away in ChatGPT or Claude.

Claims handling became a financial service under the Corporations Act on 1 January 2021, with licensing applying in full from 1 January 2022, and a claim file is the most sensitive thing a brokerage holds: an injured person, what happened to them, what the witnesses said, what the doctors found, and what the insurer thinks it will cost. Chronologies are also exactly the task staff give ChatGPT or Claude, because assembling one from a folder of emails is slow. This page marks every item in a liability claim chronology that the Privacy Act and the Code of Practice bear on, and shows how the same chronology is built on Ermos inside the brokerage.

The claims chronology

Assembled by the claims team from the client’s notifications, the insurer’s correspondence and the evidence, to manage the claim and brief the client.

An invented chronology. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the brokerage

1. 1
   The insured and the claim

   A named client and the insurer’s claim number. A live claim, identified. Privacy Act guide.

2. 2
   The injured person and the injury

   A named man, his age, his employer and a serious injury. Health information about a third party, which is sensitive information under the Privacy Act, and the most personal item in the file. Patient data guide.

3. 3
   Witness statements, including an admission

   What two named people said, including a statement that a safety guard was removed. Evidence in a liability claim and a regulator’s investigation, attributed by name. Privacy Act guide.

4. 4
   The reserve

   The insurer’s estimate of what the claim will cost. Confidential to the insurer and the client, and decisive in any negotiation.

5. 5
   The medical report

   A surgeon’s findings, a permanent impairment, and a psychological referral, about someone who is not the client. The strictest category of information the Privacy Act recognises. Patient data guide.

6. 6
   The letter of demand

   The claimant’s lawyers, the amount claimed and the allegation. The other side’s position in a dispute. Privacy Act guide.

7. 7
   The indemnity problem and the lapsed policy

   The insurer’s possible exclusion argument and a lapse in the client’s workers compensation cover. The two facts most damaging to the client, and to the brokerage if the lapse was its oversight.

8. 8
   The broker’s assessment

   That indemnity is at risk, that the director may be personally exposed, and that the client does not yet know. The brokerage’s judgement, and a note that it has not yet been shared.

9. 9
   The claims handler

   Ties the file to a named staff member, in a service that has been regulated as a financial service since 2021, with a licence required from 1 January 2022.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the brokerage no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in insurance brokerages. See how this works in practice: Claims chronologies on Ermos.

Common questions