Privacy Systems, Records Requests and Responsible AI Use
The privacy problems a general practice actually has: a solicitor’s letter, a patient who wants their record, a shared reception login, a phishing email from another practice, an AI scribe in the consulting room. The rule for each, and what to do on Monday.
Already completed this training? Quick refresher
A quick reminder for experienced staff. Revisit only what you need.
- Check identity, authority, purpose and scope before releasing information.
- Contain suspected breaches promptly; preserve necessary evidence and let the privacy lead assess notification.
- Use approved systems and individual access; patient consent and a tested human check matter for AI.
Open the lessons and tools. Use current local procedures and sources.
This optional refresher does not record a new completion. Certificates require the full course and its assessments.
For you if…
Practice managers and receptionists who handle records requests. The certificate needs all seven lessons and both quizzes. Lessons 2, 3 and 4 are written for the reception desk; lessons 1, 5, 6 and 7 explain the systems the practice manager runs, with a reception panel in lesson 5.
What you’ll practise
- Follow one piece of patient information through the practice and fix the patient email field.
- Use individual accounts on shared front-desk computers, keep HPOS and PRODA access tidy, and meet the My Health Record security and access policy requirement.
- Handle a patient’s own access request (generally respond within 30 days; no fee for asking), a relative, a provider transfer, and a solicitor’s or court request, and send records safely.
- Do the first ten minutes of a misdirected email, a phishing email from a compromised practice, a fake “new bank details” email and an internet outage.
- Set up an AI scribe with real, recorded consent; keep patient details out of public AI tools; test an AI phone service before it goes live.
How it works
Seven short, case-based lessons and two automatically scored quizzes. Try each decision before opening the worked example. Allow about 45 minutes, including the assessments.
Pass the knowledge assessment with at least 80% and the safety decisions assessment with 100%; read the feedback and retry as needed. The final case in lesson 7 is practice and does not affect your result.
The people and practice in this course are made up. This course is professional development, not accredited CPD. Follow your practice’s current procedures and your role boundaries.
Explore the lessons
- Map the information before writing the policy
- Turn privacy into everyday controls
- Manage a request without over-disclosing or obstructing
- Retention and incidents need different decisions
- Ask the AI supplier questions that change the decision
- Implement a small change and test the hard case
- Final practice activity — A new phone service and a complex request
Sources (checked September 2026)
- OAIC Guide to health privacy
- OAIC Chapter 4: Giving access to health information
- OAIC APP 12 guidelines
- OAIC Quick reference guide: Data breaches
- OAIC My Health Record Rule 42 guidance
- OAIC Commercially available AI guidance
- OAIC statutory tort for serious invasions of privacy
- OAIC transparency in automated decision-making
- Ahpra AI in healthcare
- RACGP Standards 6th edition, F11
- ACSC account guidance
- NSW IPC retention for private health providers