RACGP accreditation and AI documentation

One tool produces evidence across records, information security, privacy, patient rights, training and governance. One owner, one location, every item dated.

• The approved AI documentation policy, naming the tools in use, with a named owner, approval and review dates, and names that match what clinicians run today.
• The patient notice and where it appears: waiting room, practice information sheet, the privacy policy at the desk, and the published version on the website.
• Vendor due diligence in writing. Where data is stored, retention and deletion for audio and transcripts, whether recordings or notes train the vendor's models, which subcontractors touch it, breach commitments, and the contract.
• Training records. Who was trained, on what, against which version of the policy, and when, including new starters, locums and registrars.
• An incident log, including any privacy incident assessed under the Notifiable Data Breaches scheme and the outcome.
• Note audit results: dates, sample sizes, what was found, what changed.
• A register of who can use the tool, tied to onboarding and offboarding, and the decision record showing who approved it.

• Which AI tools are in use here, who approved them, and how would you know if a clinician had signed up to something else on a personal account?
• Where is the audio and the transcript held, for how long, and who can retrieve it?
• Show me the consent for this patient.
• Show me a note this tool drafted, and what you changed before you signed it.
• The vendor tells you it has had a breach. Who do you notify, and in what timeframe?
• A vendor update changes how the tool writes. How would the practice notice?
• What do you say to a patient who says no, and what happens on a day the tool is unavailable?

General practice accreditation runs against the RACGP Standards for general practices, assessed by an agency approved under the National General Practice Accreditation Scheme, administered by the Australian Commission on Safety and Quality in Health Care. It is voluntary in law, a condition of Practice Incentives Program payments, and runs on a three year cycle, so evidence has to accumulate across it.

Hospitals and day procedure services are assessed against the NSQHS Standards, where Clinical Governance and Communicating for Safety carry most of the weight for a documentation tool, on short notice since July 2023. Other primary and community healthcare services can be assessed against the Primary and Community Healthcare Standards.

No criterion in the fifth edition carries the words artificial intelligence, so a surveyor reaches the tool through the ordinary criteria: each encounter recorded accurately and identifiable to the person who made the entry, access control and where the data sits, patients told what happens to information about them, a patient who declines getting the same consultation, training for clinical and non-clinical staff, and governance covering which tools are approved and what happens when one fails.

The Australian Privacy Principles require notice at or before the time information is collected, covering who is collecting it, why and who it may be disclosed to, and a privacy policy that is clearly expressed, up to date and available free of charge. Every private health service provider is covered regardless of turnover, because the small business exemption does not reach a business that provides a health service and holds health information.

The privacy policy carries the detail: the categories of information involved, that a service provider processes the content of consultations, where it is held, and how long the audio is kept. Practices update the printed copy at the desk and leave the website version, which is the one patients and surveyors read.

RACGP guidance on AI scribes states that GPs must obtain consent before using a scribe in a consultation, and that where written consent is not required by the practice's medical defence organisation, consent can be taken verbally and recorded in the consultation notes. A patient who declines is documented the old way, which reception has to be able to arrange without finding the clinician.

Training covers what staff say to a patient who asks, how a refusal is recorded, what a clinician does when a draft carries content from the previous patient or from before consent was taken, and who to tell when the tool behaves oddly. The record is name, date, topic, policy version and signature. RACGP guidance says GPs in training should be encouraged to develop documentation skills before using a scribe.

Authorship timestamps and the scribe's own audit trail show when a draft was created and accepted, not whether judgement was applied. Only an audit comparing drafted content with signed content shows that, sampled per clinician, because a practice level average hides the person. Read for a symptom that was never asked about, an examination line in the patient's own words, an empty heading, a dose that does not match the chart. Monthly while the tool is new, then quarterly, recording what was found and what changed, and it counts as continuous quality improvement. Ahpra and the National Boards hold the practitioner responsible for what a tool produces under their name.

The sixth edition of the Standards for general practices, released in August 2026, names artificial intelligence directly and restructures the Standards into four, with indicators becoming criteria. Transition timing will be communicated by the Australian Commission on Safety and Quality in Health Care, so ask your accrediting agency which edition your next assessment runs against. The artificial intelligence criteria ask a practice to:

• Facilitate processes for the clinical team to obtain and document informed consent when aspects of care will be delivered using AI.
• Clearly define that clinicians are accountable for care decisions supported by AI tools, and document the processes supporting their clinical oversight.
• Facilitate deidentification or anonymisation of data when using AI tools that process patient data.
• Discuss the implementation and use of AI with the practice team to identify practical implications and training needs.
• Hold a process to assess and evaluate the use of AI, including risk mitigation.