Family emails and AI confidentiality: what an update after an NDIS incident gives away in ChatGPT or Claude.

Writing to a participant’s family after an incident is the hardest writing a service manager does. It has to be accurate, kind and careful about what can be said. That is why managers ask ChatGPT or Claude to help. The email carries the participant’s injury, the hospital, the worker involved, whatever the service has to admit and something the participant asked to keep from his own daughter. This page marks every item in an email to a nominee after a fall that the Practice Standards, the Complaints Rules and the Privacy Act bear on, and shows how the same email is drafted on Ermos inside the service.

The email to a participant’s family

Sent by the service manager to the participant’s nominee or family contact, with the participant’s consent where he can give it, after an incident. The Information Management standard expects consent to cover the purpose of a disclosure and when information may be disclosed.

An invented email. The email address is a reserved example address. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the service

1. 1
   The recipient and the participant

   A named nominee at an email address, and the man the email is about. Personal information, and the link between a family and a service. Privacy Act guide.

2. 2
   The injury

   What happened, which bone was broken and that he was conscious. Health information, which is sensitive information under the Privacy Act. Patient data guide.

3. 3
   The hospital and the discharge plan

   Where he is, what treatment is planned and when he is expected home. Health information, and a statement of when he will be alone. Patient data guide.

4. 4
   The worker and the notification

   That a worker has been taken off the roster and that the Commission has been told. An allegation that is not a finding. The Rules treat alleged incidents as reportable, and the Complaints Rules require procedural fairness when a complaint is dealt with. Privacy Act guide.

5. 5
   An admission

   A written admission that a safeguard was recommended and not put in place. The manager’s decision, and the sentence that matters most if the matter is later disputed.

6. 6
   A request about his daughter

   What Graham has asked that his daughter not be told and why. A confidence given by a participant about his own family, which the Code of Conduct requires workers to respect. Privacy Act guide.

7. 7
   How to complain

   The complaint avenues. The Complaints Rules require reasonable steps to ensure a complainant and each affected person with disability are advised how a complaint can be raised with the Commissioner. Wording the service uses in every response.

8. 8
   The changes and the meeting

   A change in how Graham is supported, from a named day, and an appointment at his home. Operational detail that shows when and where.

9. 9
   The sender

   Ties the email and its admissions to the responsible manager.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the service no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in NDIS services.

Common questions