‘A decision that affects the individual’s access to a significant service or support.’
From 10 December 2026, a practice that uses software to make — or to substantially help make — a decision affecting a patient will have to describe that use in its privacy policy.
The obligation was inserted into the Privacy Act 1988 by the Privacy and Other Legislation Amendment Act 2024 and sits in Australian Privacy Principle 1. It applies to APP entities, which includes private medical practices. The Office of the Australian Information Commissioner ran a consultation on its guidance between 18 May and 15 June 2026 and expected to publish final guidance before the obligation starts.
It is a transparency measure. Nothing in it restricts what software a practice may use or requires a decision to be made differently. What it requires is that the privacy policy says what is happening.
The three-part test
APP 1.7 reads:
‘Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if:
Privacy Act 1988 (Cth), Schedule 1
(a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
(b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
(c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.’
All three limbs must be met. The OAIC adds that making a decision includes refusing or failing to make one, and that a decision counts whether the individual is ‘adversely or beneficially affected’.
On the first limb, the regulator’s reading is wide. Its issues paper cites the Explanatory Memorandum: the term computer program ‘is intended to take its ordinary meaning and encompass a broad range of matters, including pre-programmed rule-based processes, artificial intelligence and machine learning processes’. The OAIC goes on to say that ‘a wide range of technologies are likely to fall within the definition of computer program, including commonly-used software, apps, or word-processing tools’, and that generative AI tools including chatbots are within scope.
What narrows it is the phrase ‘substantially and directly related’. The Explanatory Memorandum defines both words: substantially means ‘where it is a key factor in facilitating the human’s decision making’, and directly means ‘where the thing has a direct connection with making the decision’.
The OAIC’s own worked example is deliberately mundane. A pre-programmed formula in a spreadsheet used to score and triage callers to a crisis hotline, where the score is a key factor in a human’s decision about what order to return calls, is both substantially and directly related to making that decision.
Why this lands on general practice
The second limb asks whether the decision could reasonably be expected to significantly affect a person’s rights or interests. APP 1.9(d) gives three examples, the third of which is ‘a decision that affects the individual’s access to a significant service or support’.
The OAIC’s issues paper is more direct still. Among the examples it lists of decisions that may affect rights or interests are the granting of a housing benefit, a life insurance contract, and ‘access to healthcare services’.
That puts a range of ordinary practice software in the frame. The question for any given tool is not whether it is artificial intelligence. It is whether a computer program is doing something that is a key factor in a decision about a patient’s access to care, using that patient’s personal information.
Which tools are likely caught
What follows is reasoning from the statutory test, not settled law, and the OAIC’s final guidance had not been published when this was written. Practices should read that guidance when it lands and take their own advice.
Tools that rank, score or triage patients look closest to the OAIC’s own example. A recall system that decides which patients are contacted first, a risk stratification tool that flags patients for intervention, or an eligibility engine that determines whether a patient is offered a service all appear to involve a program doing something substantially and directly related to a decision about access to care.
Booking and triage software would turn on how much it decides. A system that allocates appointment type or urgency on the basis of what a patient enters is doing more than scheduling. One that simply presents available times is arguably not.
Ambient AI scribes are the hardest case, and they are the tools most practices are actually deploying. A scribe that produces a transcript or a draft note, which the clinician then reads, edits and signs, is not obviously making a decision or doing a thing that is a key factor in one — the clinical reasoning sits with the clinician. A tool that drafts an assessment, suggests a diagnosis, or surfaces a risk flag is closer to the line. The distinction the statute draws is about the role the output plays in the decision, not about how the output was generated.
Practices that are unsure have a reasonable fallback. The obligation is to describe categories in a privacy policy, not to justify each tool, and the policy is easier to write broadly than to litigate narrowly.
What the policy has to say
APP 1.8 sets out three things:
- ‘the kinds of personal information used in the operation of such computer programs’;
- ‘the kinds of such decisions made solely by the operation of such computer programs’; and
- ‘the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs’.
The obligation is stated in kinds, not instances. A policy describes categories of information and categories of decision, rather than naming every product in use, which also means it does not have to be rewritten each time a vendor is changed.
The OAIC frames the point of it as public expectation rather than paperwork. Its research found 89% of Australians believe they should have the right to know when their personal information is used in automated decision-making that could affect them.
About Conference.care
Conference.care is an Australian platform for running Medicare-funded case conferences. Conferences on the platform are not recorded or transcribed: clinical information is shared verbally or by screen share during the conference, so no automated system processes what is discussed. More on how the platform works is on the case conferencing page, and its handling of personal information is set out in the privacy policy.
Sources
- Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principles 1.7, 1.8 and 1.9, as inserted by the Privacy and Other Legislation Amendment Act 2024. Commencing 10 December 2026. legislation.gov.au.
- Office of the Australian Information Commissioner. Automated Decision-Making Transparency Obligation (APP 1), issues paper, 18 May 2026. Carries the statutory text, the Explanatory Memorandum extracts and the OAIC’s worked examples. oaic.gov.au.
- Office of the Australian Information Commissioner. Consultation on guidance for transparency in automated decision making, open 18 May to 15 June 2026. oaic.gov.au.
General information for clinicians and practice managers, current at the date of publication. It is not legal, clinical or financial advice, and the analysis of which tools fall within the obligation is reasoning from the statutory text rather than a statement of settled law. The OAIC’s final guidance had not been published when this was written; practices should read it when available and obtain their own advice before amending a privacy policy.