---
title: "Health & Medical Law"
url: "https://ailawframework.com/practice/health-and-medical-law"
type: "practice_area"
site: "AI Law Framework"
id: "A32"
task_count: 24
last_reviewed: "2026-10-10"
---

# Health & Medical Law

> Keep legal analysis, clinical evidence and expert opinion distinct. Protect sensitive health information and verify the full records, applicable regulatory requirements and limits of any medical summary.

Canonical page: https://ailawframework.com/practice/health-and-medical-law  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Also covers: Medical law, health regulation, clinical negligence, medical malpractice, health privacy, bioethics law, AHPRA law, aged care law, mental health law, therapeutic goods law, health technology law, medico-legal

## Key facts

- Tasks: 24
- Green: 2, Yellow: 18, Red: 4
- Levels: Green is AI drafts and the lawyer checks; Yellow is lawyer and AI draft together; Red is the lawyer writes and AI may only check, clarify or collect data.

## Principles

- **Define the matter**: Confirm the client’s instructions, jurisdiction, intended output and the information available before dividing the work.
- **Verify the authorities**: Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- **Preserve the witness’s evidence**: Confirm each factual assertion with the witness and original record. Preserve the witness’s own knowledge and words, and check the court’s rules for this document.

## Checklist

- Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- Confirm each factual assertion with the witness and original record. Preserve the witness’s own knowledge and words, and check the court’s rules for this document.
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Check the specialist’s assumptions, qualifications and limits. Obtain the relevant expert or specialist review before relying on a technical conclusion.
- Verify dates, people and sequence against contemporaneous records. Preserve uncertainty and identify gaps or conflicting accounts.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Restrictions

- Confirm firm, client and applicable court or professional restrictions before using any AI feature.

## Jurisdiction note

Apply this guidance to the actual matter and jurisdiction. Confirm current requirements before relying on an example.

## Basis

Practice guidance supports planning; the responsible lawyer confirms the scope, evidence and review requirements for the matter.

Also covers: Medical law, health regulation, clinical negligence, medical malpractice, health privacy, bioethics law, AHPRA law, aged care law, mental health law, therapeutic goods law, health technology law, medico-legal

Health and medical law spans regulatory compliance (AHPRA/TGA), clinical negligence litigation, privacy and data governance under layered Commonwealth and state regimes, coronial and disciplinary proceedings, aged care regulation, and complex commercial structures including hospital contracting and health technology procurement. The AI risk profile is the most acute of any practice area: client data is inherently sensitive health information attracting the highest privacy protections under Australian law; hallucinated clinical standards, wrong limitation dates, or fabricated regulatory citations can directly cause patient harm or destroy a practitioner's registration; and the pace of regulatory change (TGA AI/SaMD guidance February 2026, Aged Care Act 2024 Quality Standards November 2025, Federal Court GPN-AI April 2026) means AI training data is structurally stale on the most consequential provisions.

## Limits on AI assistance

Red lines — never in this area

## Limits on AI assistance

AI must never autonomously assess or recommend a clinical standard of care without a qualified expert independently reaching that conclusion — the standard-of-care determination is the expert witness's function, and an AI-generated characterisation adopted without independent expert confirmation is inadmissible and professionally dangerous. AI must never determine or advise on whether a patient has decision-making capacity for the purposes of consent or involuntary treatment — capacity is a legal and clinical determination with liberty consequences; no AI output on capacity should leave the firm. AI must never be used to draft the substantive contents of an expert medical report for court or tribunal use without prior leave of the relevant court or tribunal — NSW SC Gen 23 (3 February 2025) is express; Federal Court GPN-AI (16 April 2026) imposes analogous restrictions; Queensland Supreme Court Practice Direction 5 of 2025 requires leave; check the current AI practice direction for every jurisdiction before using AI to assist with any expert report or witness statement. AI must never receive identifiable patient health information, practitioner registration details, or clinical records via a non-enterprise AI system — health information is sensitive information under the Privacy Act 1988 (Cth) and state health records Acts; breach attracts civil penalty proceedings (Australian Clinical Labs ordered to pay $5.8 million, FCA October 2025; Medibank proceedings on foot). AI must never generate, verify, or confirm TGA ARTG registration status for any product — the ARTG is a live database; AI training data is stale and fabricated ARTG entries are a known failure mode that can cause a practitioner to deploy an unregistered medical device. AI must never calculate limitation periods for clinical negligence or personal injury claims and have the result used without independent lawyer verification — the 'date of discoverability' trigger, long-stop periods, and child tolling rules differ across all eight state and territory jurisdictions; a wrong date loses the claim. AI must never produce a final Privacy Impact Assessment for a health AI deployment without full lawyer review and sign-off — the automated decision-making transparency obligations under amended APP 1 commence 10 December 2026 and are an evolving area where AI training data is structurally insufficient. AI must never be used as the sole source for identifying applicable state health legislation — at least 12 separate Acts across the 8 states and territories govern mental health, guardianship, health records, and practitioner regulation; AI routinely conflates provisions across jurisdictions and cites repealed versions (notably the Mental Health Act 2014 (Vic), replaced by the Mental Health and Wellbeing Act 2022 (Vic)). AI-generated clinical documentation produced by an AI scribe or ambient documentation tool must never enter a patient's clinical record without the treating practitioner personally reviewing and approving every entry — unreviewd AI entries in clinical records create direct negligence exposure and breach AHPRA August 2024 accountability obligations. AI must never autonomously classify an incident for SIRS reporting purposes or determine that a clinical incident does not require mandatory reporting — the determination of Priority 1 vs Priority 2 classification, and the assessment of whether a reporting obligation has been triggered, must be made by the lawyer on the facts.

- AI must never autonomously assess or recommend a clinical standard of care without a qualified expert independently reaching that conclusion — the standard-of-care determination is the expert witness's function, and an AI-generated characterisation adopted without independent expert confirmation is inadmissible and professionally dangerous.
- AI must never determine or advise on whether a patient has decision-making capacity for the purposes of consent or involuntary treatment — capacity is a legal and clinical determination with liberty consequences; no AI output on capacity should leave the firm.
- AI must never be used to draft the substantive contents of an expert medical report for court or tribunal use without prior leave of the relevant court or tribunal — NSW SC Gen 23 (3 February 2025) is express; Federal Court GPN-AI (16 April 2026) imposes analogous restrictions; Queensland Supreme Court Practice Direction 5 of 2025 requires leave; check the current AI practice direction for every jurisdiction before using AI to assist with any expert report or witness statement.
- AI must never receive identifiable patient health information, practitioner registration details, or clinical records via a non-enterprise AI system — health information is sensitive information under the Privacy Act 1988 (Cth) and state health records Acts; breach attracts civil penalty proceedings (Australian Clinical Labs ordered to pay $5.8 million, FCA October 2025; Medibank proceedings on foot).
- AI must never generate, verify, or confirm TGA ARTG registration status for any product — the ARTG is a live database; AI training data is stale and fabricated ARTG entries are a known failure mode that can cause a practitioner to deploy an unregistered medical device.
- AI must never calculate limitation periods for clinical negligence or personal injury claims and have the result used without independent lawyer verification — the 'date of discoverability' trigger, long-stop periods, and child tolling rules differ across all eight state and territory jurisdictions; a wrong date loses the claim.
- AI must never produce a final Privacy Impact Assessment for a health AI deployment without full lawyer review and sign-off — the automated decision-making transparency obligations under amended APP 1 commence 10 December 2026 and are an evolving area where AI training data is structurally insufficient.
- AI must never be used as the sole source for identifying applicable state health legislation — at least 12 separate Acts across the 8 states and territories govern mental health, guardianship, health records, and practitioner regulation; AI routinely conflates provisions across jurisdictions and cites repealed versions (notably the Mental Health Act 2014 (Vic), replaced by the Mental Health and Wellbeing Act 2022 (Vic)).
- AI-generated clinical documentation produced by an AI scribe or ambient documentation tool must never enter a patient's clinical record without the treating practitioner personally reviewing and approving every entry — unreviewd AI entries in clinical records create direct negligence exposure and breach AHPRA August 2024 accountability obligations.
- AI must never autonomously classify an incident for SIRS reporting purposes or determine that a clinical incident does not require mandatory reporting — the determination of Priority 1 vs Priority 2 classification, and the assessment of whether a reporting obligation has been triggered, must be made by the lawyer on the facts.

## Jurisdiction-specific considerations

Australian traps

## Jurisdiction-specific considerations

LIMITATION PERIODS — STATE-BY-STATE VARIATION: Clinical negligence limitation periods differ across all jurisdictions. NSW, Qld, SA, WA: 3 years from date of discoverability with a long-stop. Vic: the longer of 3 years from discoverability or 6 years from accrual (Limitation of Actions Act 1958 (Vic) s 27K). NT: 3 years. Child plaintiffs: limitation suspended until age 18 in most states but with jurisdiction-specific exceptions and long-stops. AI-generated limitation dates must be independently verified in every matter before any advice or filing. VICTORIA IS NOT A 'CIVIL LIABILITY ACT' JURISDICTION FOR PROFESSIONALS: Victoria's equivalent legislation is the Wrongs Act 1958 (Vic), not a Civil Liability Act. The peer professional opinion defence is Wrongs Act 1958 (Vic) s 59; the duty to disclose is s 60; contributory negligence is Part V. AI trained primarily on NSW and Qld materials systematically mislabels Victorian provisions as 'Civil Liability Act' provisions — this is a material drafting error in submissions, advices, and pleadings. AGED CARE ACT 2024 — COMMENCEMENT IN STAGES AND WRONG STANDARD COUNT: The Aged Care Act 2024 (Cth) commenced provider registration provisions on 1 July 2024 but the Strengthened Aged Care Quality Standards commenced 1 November 2025. There are SEVEN strengthened Quality Standards (not eight). The superseded Aged Care Act 1997 Quality Standards (also seven, different content) applied until 31 October 2025. AI output referencing 'eight Quality Standards from 1 July 2024' is wrong on both counts — verify all aged care compliance advice against the 2024 Act and subordinate Rules as in force from 1 November 2025. AHPRA AUGUST 2024 AI GUIDANCE — BINDING PROFESSIONAL CONDUCT MATERIAL: AHPRA's 'Meeting your professional obligations when using Artificial Intelligence in healthcare' (August 2024) is not aspirational guidance — it is binding professional conduct material enforceable in disciplinary proceedings. Five obligations: accountability (human judgment applied to every AI output); understanding (know how the tool was trained and its limitations); transparency (disclose AI use to patients); informed consent (obtain consent before inputting patient data into AI tools); ethical and legal compliance (privacy, bias, safety). Telehealth AI scribe use requires consent before every consultation. HEALTH PRACTITIONER REGULATION NATIONAL LAW — 2025 AMENDMENT: The Health Practitioner Regulation National Law and Other Legislation Amendment Act 2025 (Qld) passed 9 April 2025. Key changes: AHPRA acquires power to take immediate action without Board consideration first; settlement agreement restrictions on non-disclosure of sexual misconduct findings; mandatory reporting of charges and convictions relating to regulated medicines. AI will cite the pre-2025 National Law structure for immediate action powers — verify current s 156 and related provisions against the amended text. PRIVACY ACT 2024 AMENDMENT — AUTOMATED DECISION-MAKING FROM DECEMBER 2026: The Privacy and Other Legislation Amendment Act 2024 (Cth) amended APP 1 to require APP entities to disclose in their privacy policy when they use substantially automated systems to make decisions that could reasonably be expected to significantly affect the rights or interests of individuals. This obligation commences 10 December 2026 and applies prospectively to all decisions made from that date, irrespective of when the AI system was deployed. Health sector entities using AI for clinical triage, diagnosis support, or treatment recommendation must act now to achieve compliance. TGA AI/SAMD GUIDANCE — FEBRUARY 2026 AND DIGITAL SCRIBES: The TGA released final guidance on AI-enabled medical device software on 5 February 2026. A digital scribe that only records and summarises clinical consultations is NOT a medical device. A digital scribe that suggests diagnoses or treatments IS a medical device requiring ARTG registration. The TGA's 2026–2027 compliance priorities expressly target unregistered SaMD supply. AI training data predating February 2026 will not reflect this guidance — check tga.gov.au directly. MY HEALTH RECORDS ACT — SHARING BY DEFAULT FROM 2025: The Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 (Cth) passed 12 February 2025, shifting My Health Record from opt-in sharing to sharing by default for pathology and diagnostic imaging results. Registered participants (healthcare providers and third-party operators) face expanded mandatory uploading obligations and separate breach reporting obligations to the Australian Digital Health Agency. Penalties for unauthorised use or disclosure of My Health Record data are separate from, and can be cumulative with, Privacy Act penalties. COURT AI PRACTICE RULES — MULTI-JURISDICTIONAL, RAPIDLY EVOLVING: As of June 2026, AI practice rules apply in: NSW Supreme Court (SC Gen 23, 3 February 2025) — AI must not draft expert report contents without court leave; Federal Court (GPN-AI, 16 April 2026) — AI prohibited in evidence including expert reports, disclosure required for submissions; Qld Supreme Court (Practice Direction 5 of 2025) — leave required for AI in expert reports, responsible lawyer must be named in submissions; WA Supreme Court (draft practice direction in consultation). Victoria has issued guidelines urging particular caution with witness statements and affidavits. The Coroners Court of each state has not yet issued specific AI practice directions — apply the general court practice rules of that jurisdiction and check the specific court's website before each matter. HEALTH SECTOR PRIVACY ENFORCEMENT — CURRENT, NOT THEORETICAL: Australian Clinical Labs was ordered to pay $5.8 million in civil penalties on 8 October 2025 in Australian Information Commissioner v Australian Clinical Labs Limited [2025] FCA 1224 — the first civil penalty ever imposed under the Privacy Act 1988 (Cth). This involved 223,000 individuals' health data. Medibank Private civil penalty proceedings (affecting approximately 9.5 million individuals) remain on foot. OAIC commenced a privacy policy compliance sweep of approximately 60 entities across six sectors (including health) in January 2026. The health sector consistently leads all NDB notifications (18% for January–June 2025, OAIC data). Treat health data breach risk as an active enforcement environment, not a theoretical future risk. QUALITY ASSURANCE PRIVILEGE IN CLINICAL INCIDENT INVESTIGATIONS: Most Australian states have statutory quality assurance privilege protecting QA committee deliberations and documents from disclosure in litigation — NSW Health Administration Act 1982 (NSW) Part 7, Health Services Act 1988 (Vic) s 139EB, and equivalents. This privilege is easily lost (it does not attach to underlying clinical records, only to QA-created analysis) and must be positively established. AI-generated summaries of documents that began as privileged QA material can sever the privilege if shared outside the protected purpose. Lawyers advising on clinical incident investigations must assess QA privilege before permitting any AI tool to process those documents.

- LIMITATION PERIODS — STATE-BY-STATE VARIATION: Clinical negligence limitation periods differ across all jurisdictions. NSW, Qld, SA, WA: 3 years from date of discoverability with a long-stop. Vic: the longer of 3 years from discoverability or 6 years from accrual (Limitation of Actions Act 1958 (Vic) s 27K). NT: 3 years. Child plaintiffs: limitation suspended until age 18 in most states but with jurisdiction-specific exceptions and long-stops. AI-generated limitation dates must be independently verified in every matter before any advice or filing.
- VICTORIA IS NOT A 'CIVIL LIABILITY ACT' JURISDICTION FOR PROFESSIONALS: Victoria's equivalent legislation is the Wrongs Act 1958 (Vic), not a Civil Liability Act. The peer professional opinion defence is Wrongs Act 1958 (Vic) s 59; the duty to disclose is s 60; contributory negligence is Part V. AI trained primarily on NSW and Qld materials systematically mislabels Victorian provisions as 'Civil Liability Act' provisions — this is a material drafting error in submissions, advices, and pleadings.
- AGED CARE ACT 2024 — COMMENCEMENT IN STAGES AND WRONG STANDARD COUNT: The Aged Care Act 2024 (Cth) commenced provider registration provisions on 1 July 2024 but the Strengthened Aged Care Quality Standards commenced 1 November 2025. There are SEVEN strengthened Quality Standards (not eight). The superseded Aged Care Act 1997 Quality Standards (also seven, different content) applied until 31 October 2025. AI output referencing 'eight Quality Standards from 1 July 2024' is wrong on both counts — verify all aged care compliance advice against the 2024 Act and subordinate Rules as in force from 1 November 2025.
- AHPRA AUGUST 2024 AI GUIDANCE — BINDING PROFESSIONAL CONDUCT MATERIAL: AHPRA's 'Meeting your professional obligations when using Artificial Intelligence in healthcare' (August 2024) is not aspirational guidance — it is binding professional conduct material enforceable in disciplinary proceedings. Five obligations: accountability (human judgment applied to every AI output); understanding (know how the tool was trained and its limitations); transparency (disclose AI use to patients); informed consent (obtain consent before inputting patient data into AI tools); ethical and legal compliance (privacy, bias, safety). Telehealth AI scribe use requires consent before every consultation.
- HEALTH PRACTITIONER REGULATION NATIONAL LAW — 2025 AMENDMENT: The Health Practitioner Regulation National Law and Other Legislation Amendment Act 2025 (Qld) passed 9 April 2025. Key changes: AHPRA acquires power to take immediate action without Board consideration first; settlement agreement restrictions on non-disclosure of sexual misconduct findings; mandatory reporting of charges and convictions relating to regulated medicines. AI will cite the pre-2025 National Law structure for immediate action powers — verify current s 156 and related provisions against the amended text.
- PRIVACY ACT 2024 AMENDMENT — AUTOMATED DECISION-MAKING FROM DECEMBER 2026: The Privacy and Other Legislation Amendment Act 2024 (Cth) amended APP 1 to require APP entities to disclose in their privacy policy when they use substantially automated systems to make decisions that could reasonably be expected to significantly affect the rights or interests of individuals. This obligation commences 10 December 2026 and applies prospectively to all decisions made from that date, irrespective of when the AI system was deployed. Health sector entities using AI for clinical triage, diagnosis support, or treatment recommendation must act now to achieve compliance.
- TGA AI/SAMD GUIDANCE — FEBRUARY 2026 AND DIGITAL SCRIBES: The TGA released final guidance on AI-enabled medical device software on 5 February 2026. A digital scribe that only records and summarises clinical consultations is NOT a medical device. A digital scribe that suggests diagnoses or treatments IS a medical device requiring ARTG registration. The TGA's 2026–2027 compliance priorities expressly target unregistered SaMD supply. AI training data predating February 2026 will not reflect this guidance — check tga.gov.au directly.
- MY HEALTH RECORDS ACT — SHARING BY DEFAULT FROM 2025: The Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 (Cth) passed 12 February 2025, shifting My Health Record from opt-in sharing to sharing by default for pathology and diagnostic imaging results. Registered participants (healthcare providers and third-party operators) face expanded mandatory uploading obligations and separate breach reporting obligations to the Australian Digital Health Agency. Penalties for unauthorised use or disclosure of My Health Record data are separate from, and can be cumulative with, Privacy Act penalties.
- COURT AI PRACTICE RULES — MULTI-JURISDICTIONAL, RAPIDLY EVOLVING: As of June 2026, AI practice rules apply in: NSW Supreme Court (SC Gen 23, 3 February 2025) — AI must not draft expert report contents without court leave; Federal Court (GPN-AI, 16 April 2026) — AI prohibited in evidence including expert reports, disclosure required for submissions; Qld Supreme Court (Practice Direction 5 of 2025) — leave required for AI in expert reports, responsible lawyer must be named in submissions; WA Supreme Court (draft practice direction in consultation). Victoria has issued guidelines urging particular caution with witness statements and affidavits. The Coroners Court of each state has not yet issued specific AI practice directions — apply the general court practice rules of that jurisdiction and check the specific court's website before each matter.
- HEALTH SECTOR PRIVACY ENFORCEMENT — CURRENT, NOT THEORETICAL: Australian Clinical Labs was ordered to pay $5.8 million in civil penalties on 8 October 2025 in Australian Information Commissioner v Australian Clinical Labs Limited [2025] FCA 1224 — the first civil penalty ever imposed under the Privacy Act 1988 (Cth). This involved 223,000 individuals' health data. Medibank Private civil penalty proceedings (affecting approximately 9.5 million individuals) remain on foot. OAIC commenced a privacy policy compliance sweep of approximately 60 entities across six sectors (including health) in January 2026. The health sector consistently leads all NDB notifications (18% for January–June 2025, OAIC data). Treat health data breach risk as an active enforcement environment, not a theoretical future risk.
- QUALITY ASSURANCE PRIVILEGE IN CLINICAL INCIDENT INVESTIGATIONS: Most Australian states have statutory quality assurance privilege protecting QA committee deliberations and documents from disclosure in litigation — NSW Health Administration Act 1982 (NSW) Part 7, Health Services Act 1988 (Vic) s 139EB, and equivalents. This privilege is easily lost (it does not attach to underlying clinical records, only to QA-created analysis) and must be positively established. AI-generated summaries of documents that began as privileged QA material can sever the privilege if shared outside the protected purpose. Lawyers advising on clinical incident investigations must assess QA privilege before permitting any AI tool to process those documents.

## Risks to address

How it goes wrong

## Risks to address

Hallucinated clinical authority: AI cites a non-existent AHPRA position statement, NHMRC guideline, or specialty college standard as the basis for a standard-of-care opinion — the solicitor adopts it, the expert brief is built on a false premise, and the client's claim fails or the practitioner defence collapses at hearing. Victorian legislation mislabelling: AI refers to the 'Civil Liability Act (Vic)' and cites section numbers from NSW or Qld equivalents — submissions, advices, and pleadings contain wrong Act name and wrong section numbers; the error passes undetected until an opponent or judge identifies it, creating professional conduct exposure. Aged Care Act vintage error — wrong count and wrong date: AI advises on the 'Aged Care Act 1997' and 'eight Quality Standards from 1 July 2024' — the correct position is the Aged Care Act 2024, seven Strengthened Quality Standards commencing 1 November 2025; the compliance gap analysis is entirely wrong, and the client fails an ACQSC assessment against criteria they were never advised to meet. Wrong limitation date: AI applies a generic 3-year period without the correct state discoverability trigger, long-stop, or child tolling rule — the claim is filed out of time and is permanently statute-barred; no professional indemnity policy easily covers a missed limitation date. Stale TGA classification — scribe or SaMD: AI states that a client's AI diagnostic software or AI scribe (with added diagnostic features) is exempt from TGA registration based on pre-February 2026 guidance — the TGA's February 2026 guidance reclassified the software type; the client is supplying an unregistered medical device, attracting criminal liability under the Therapeutic Goods Act 1989 (Cth) s 19. False ARTG entry confirmation: AI confirms that a vendor's AI clinical product is registered in the ARTG when it is not — the client procures and deploys it; a patient harm event occurs without the operator having a TGA-approved product as a defence; the operator faces both product liability and regulatory prosecution.

- Hallucinated clinical authority: AI cites a non-existent AHPRA position statement, NHMRC guideline, or specialty college standard as the basis for a standard-of-care opinion — the solicitor adopts it, the expert brief is built on a false premise, and the client's claim fails or the practitioner defence collapses at hearing.
- Victorian legislation mislabelling: AI refers to the 'Civil Liability Act (Vic)' and cites section numbers from NSW or Qld equivalents — submissions, advices, and pleadings contain wrong Act name and wrong section numbers; the error passes undetected until an opponent or judge identifies it, creating professional conduct exposure.
- Aged Care Act vintage error — wrong count and wrong date: AI advises on the 'Aged Care Act 1997' and 'eight Quality Standards from 1 July 2024' — the correct position is the Aged Care Act 2024, seven Strengthened Quality Standards commencing 1 November 2025; the compliance gap analysis is entirely wrong, and the client fails an ACQSC assessment against criteria they were never advised to meet.
- Wrong limitation date: AI applies a generic 3-year period without the correct state discoverability trigger, long-stop, or child tolling rule — the claim is filed out of time and is permanently statute-barred; no professional indemnity policy easily covers a missed limitation date.
- Stale TGA classification — scribe or SaMD: AI states that a client's AI diagnostic software or AI scribe (with added diagnostic features) is exempt from TGA registration based on pre-February 2026 guidance — the TGA's February 2026 guidance reclassified the software type; the client is supplying an unregistered medical device, attracting criminal liability under the Therapeutic Goods Act 1989 (Cth) s 19.
- False ARTG entry confirmation: AI confirms that a vendor's AI clinical product is registered in the ARTG when it is not — the client procures and deploys it; a patient harm event occurs without the operator having a TGA-approved product as a defence; the operator faces both product liability and regulatory prosecution.

## Review checklist

The lawyer's review checklist

## Review checklist

JURISDICTION AND CURRENCY OF EVERY CITED PROVISION: Confirm each Act, section, and standard cited by AI is the correct state or territory version and the current in-force version — check specifically for: (a) Vic Wrongs Act 1958, not a 'Civil Liability Act'; (b) Aged Care Act 2024, not the 1997 Act; (c) Mental Health and Wellbeing Act 2022 (Vic), not the repealed 2014 Act; (d) Health Practitioner Regulation National Law as amended by the 2025 Amendment Act. CLINICAL AUTHORITY AND GUIDELINE VERIFICATION: Any clinical standard, AHPRA position statement, NHMRC guideline, or specialty college standard cited by AI must be verified as current and not hallucinated — check the issuing body's website by name; clinical guidelines are updated frequently and AI training data is structurally stale on guideline currency. INDEPENDENT LIMITATION PERIOD CALCULATION: Calculate all limitation periods independently using state-specific discoverability provisions, long-stop periods, and child tolling rules; do not use AI-calculated dates for any clinical negligence, personal injury, or health regulatory matter — an unchecked AI date can lose the claim. PATIENT DATA SANITISATION BEFORE AND AFTER AI USE: Confirm no identifiable patient health information, practitioner registration details, or clinical records were input into any non-enterprise AI system at any stage; if they were, immediately assess NDB notification obligations, applicable state health records Act obligations, and My Health Records Act obligations as separate concurrent regimes. COURT AI PRACTICE NOTE COMPLIANCE: Before using AI to assist with any expert report, witness statement, affidavit, submission, or pleading in health litigation, confirm the applicable court's current AI practice note: NSW SC Gen 23 (expert reports require court leave); Federal Court GPN-AI (AI prohibited in evidence; disclosure required for submissions); Qld SC PD 5/2025 (leave for expert reports, named responsible lawyer); check current WA, Vic, and coronial court rules for the specific proceeding. TGA/ARTG STATUS — DIRECT VERIFICATION ONLY: For any matter involving an AI-enabled health technology product, verify current ARTG registration status directly at tga.gov.au — do not accept AI confirmation of registration status; verify whether the February 2026 TGA AI/SaMD guidance changes the classification of the specific product based on its current feature set. AHPRA 2024 AI OBLIGATIONS — PRACTITIONER-FACING MATTERS: Where the matter involves a health practitioner's use of AI in clinical practice (including AI scribes), confirm the advice reflects all five obligations in AHPRA's August 2024 guidance — accountability, understanding, transparency, informed consent before inputting patient data, and ethical/legal compliance including state surveillance legislation for audio recording; this is live disciplinary enforcement material. AGED CARE STANDARDS VINTAGE CHECK: For any aged care compliance advice, confirm the Quality Standards referenced are the seven Strengthened Standards commencing 1 November 2025 under the Aged Care Act 2024, not the superseded seven standards under the 1997 Act or any transitional version; confirm SIRS reporting timeline is 24 hours for Priority 1 incidents under the 2024 Act.

- JURISDICTION AND CURRENCY OF EVERY CITED PROVISION: Confirm each Act, section, and standard cited by AI is the correct state or territory version and the current in-force version — check specifically for: (a) Vic Wrongs Act 1958, not a 'Civil Liability Act'; (b) Aged Care Act 2024, not the 1997 Act; (c) Mental Health and Wellbeing Act 2022 (Vic), not the repealed 2014 Act; (d) Health Practitioner Regulation National Law as amended by the 2025 Amendment Act.
- CLINICAL AUTHORITY AND GUIDELINE VERIFICATION: Any clinical standard, AHPRA position statement, NHMRC guideline, or specialty college standard cited by AI must be verified as current and not hallucinated — check the issuing body's website by name; clinical guidelines are updated frequently and AI training data is structurally stale on guideline currency.
- INDEPENDENT LIMITATION PERIOD CALCULATION: Calculate all limitation periods independently using state-specific discoverability provisions, long-stop periods, and child tolling rules; do not use AI-calculated dates for any clinical negligence, personal injury, or health regulatory matter — an unchecked AI date can lose the claim.
- PATIENT DATA SANITISATION BEFORE AND AFTER AI USE: Confirm no identifiable patient health information, practitioner registration details, or clinical records were input into any non-enterprise AI system at any stage; if they were, immediately assess NDB notification obligations, applicable state health records Act obligations, and My Health Records Act obligations as separate concurrent regimes.
- COURT AI PRACTICE NOTE COMPLIANCE: Before using AI to assist with any expert report, witness statement, affidavit, submission, or pleading in health litigation, confirm the applicable court's current AI practice note: NSW SC Gen 23 (expert reports require court leave); Federal Court GPN-AI (AI prohibited in evidence; disclosure required for submissions); Qld SC PD 5/2025 (leave for expert reports, named responsible lawyer); check current WA, Vic, and coronial court rules for the specific proceeding.
- TGA/ARTG STATUS — DIRECT VERIFICATION ONLY: For any matter involving an AI-enabled health technology product, verify current ARTG registration status directly at tga.gov.au — do not accept AI confirmation of registration status; verify whether the February 2026 TGA AI/SaMD guidance changes the classification of the specific product based on its current feature set.
- AHPRA 2024 AI OBLIGATIONS — PRACTITIONER-FACING MATTERS: Where the matter involves a health practitioner's use of AI in clinical practice (including AI scribes), confirm the advice reflects all five obligations in AHPRA's August 2024 guidance — accountability, understanding, transparency, informed consent before inputting patient data, and ethical/legal compliance including state surveillance legislation for audio recording; this is live disciplinary enforcement material.
- AGED CARE STANDARDS VINTAGE CHECK: For any aged care compliance advice, confirm the Quality Standards referenced are the seven Strengthened Standards commencing 1 November 2025 under the Aged Care Act 2024, not the superseded seven standards under the 1997 Act or any transitional version; confirm SIRS reporting timeline is 24 hours for Priority 1 incidents under the 2024 Act.

## Tasks (24)

| Task | Level | How AI is used | What the lawyer must review |
| --- | --- | --- | --- |
| Build a clinical chronology and liability issues table from the records | Yellow | Extract treatment events, results and correspondence from the clinical records into a chronology, and list candidate departures from the standard the lawyer… | Read the records, not the summary Decide standard of care and causation with the expert under the civil-liability statute that applies |
| Draft a response to a health-practitioner regulator notice | Red | Extract each concern and particular from the notice into a table in the notice's own words, with the clinical-file entries and dates that bear on each one and… | The lawyer writes the submission and owns every admission, every clinical explanation and every expression of reflection and insight in it.… |
| Draft a patient-information and consent form from the procedure description | Yellow | Produce a first-draft information sheet and consent form covering the material risks the brief lists, with a note of risks not in the source papers. | Apply the local material-risk duty; it differs by place Do not publish a form until a clinician has settled the risks |
| Build a compliance checklist for an ambient clinical-scribe product | Yellow | From the vendor papers, list device-regulation, consent, privacy and record-keeping issues, and draft patient-disclosure language. | Confirm whether the product is a regulated device Do not accept a vendor's 'not a medical device' claim as the answer |
| Map a software-as-medical-device classification and registration path | Yellow | From the product description, list candidate device classes, registration or exemption paths and evidence still required against the rules the lawyer has named. | Decide with the regulatory adviser whether the product is a medical device Do not file from a generated pathway |
| Build a coronial or inquest brief from the records | Yellow | Summarise the coronial brief, extract issues from the autopsy and clinical records, and draft a first-pass submissions outline on the questions the lawyer has… | Use the coroners statute that applies Check family and privilege issues a summary can miss |
| [Map health-privacy duties across the records systems](https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems.md) | Yellow | From the data-flow description, list the health-privacy, general-privacy and e-health-record rules the lawyer named that appear to apply, with notice and… | Check every statute that covers the health records Do not stop at the general privacy principles |
| Review a hospital or health-services agreement | Yellow | Compare the agreement to the playbook and flag indemnity, clinical-responsibility, data, insurance and termination clauses, with clause references. | Read any indemnity that shifts product or AI-scribe risk onto the operator Check it against the insurance |
| Build a mental-health order and capacity-procedure table | Red | From the papers, list the order type, time limits, hearing rights and review paths under the statute the lawyer has named. | Do not use a tool to decide capacity or an involuntary order Use the table as a procedure index only |
| Log medical records against a subpoena or discovery category | Yellow | Categorise the records, list items responsive to each category, and flag candidate privilege or statutory-protection claims. | Check for extra protection over psychiatric and sexual-assault records Do not treat a generated 'responsive' tag as a production decision |
| Build an aged-care quality and reporting gap table | Yellow | Map the provider's described practices to the quality standards and reporting duties the lawyer has listed, and mark gaps. | Confirm the current aged-care statute Check the draft has not used the replaced Act |
| Map mandatory clinical-incident reporting duties | Yellow | From the incident description, list the reporting streams the lawyer has named (sentinel events, serious-incident, professional-board) with clocks and forms. | Choose the stream by setting and jurisdiction Do not treat a generated serious-incident label as a report |
| Draft an expert brief from the records and the issues list | Yellow | Produce a first-draft letter of instruction to the expert from the chronology, the issues list and the questions the lawyer has settled. | Check the brief does not lead Check that inconvenient records are in the bundle |
| Prepare a coronial exhibit list from the brief of evidence | Green | Number the coronial papers into an exhibit list with dates, authors and missing items flagged. | Check against the actual brief, including images and recordings Keep family-sensitive material out of a public tool |
| Build a credentials and scope-of-practice file for a practitioner | Yellow | Extract registrations, conditions, insurance and credentialling papers into a table with expiry dates and apparent gaps. | Confirm registration on the live register Do not treat a generated 'in good standing' line as a credentialling decision |
| Draft a serious-incident or sentinel-event notification from the file | Red | Index the incident report, the clinical notes and the service's incident-management policy into a dated event sequence mapped to the fields the sentinel-event… | The lawyer writes the notification, and before lodging confirms that every fact and characterisation in it is traceable to a named record, that it asserts no… |
| Advise a health practitioner on professional obligations when using AI scribes | Yellow | Summarise Ahpra obligations on consent, accuracy and records for the client. | Lawyer applies to the practitioner's facts. |
| Review an AI clinical-tool vendor contract for privacy and TGA issues | Yellow | Extract data, liability and regulatory-status terms into a table. | Lawyer checks TGA status and Privacy Act duties. |
| Summarise medical records into a chronology for a negligence claim | Yellow | Build a dated clinical chronology from the records. | Verify against records; keep data in an approved tool. |
| Draft a patient-consent clause for AI use in a clinic | Yellow | Draft consent wording on AI-assisted care and recordings. | Lawyer settles wording to Ahpra guidance. |
| Respond to a notification involving AI use by a practitioner | Red | Draft a response outline mapping facts to Ahpra AI expectations. | Lawyer settles response. |
| Advise a GP practice on medicolegal risk of AI scribes | Yellow | Summarise risks and safeguards. | Lawyer advises. |
| Draft a patient information sheet on AI use | Green | Draft. | Lawyer approves. |
| Review a practice AI tool against Ahpra expectations | Yellow | Gap-analyse. | Lawyer advises. |

## Jurisdiction notes

### Australia

#### Scope

AHPRA and TGA compliance, clinical negligence, privacy and data governance, coronial and disciplinary proceedings, aged care, and hospital and health-technology contracts.

#### Sensitive data

Client data is health information with the highest privacy protection under Australian law, across layered Commonwealth and state regimes.

#### Where it goes wrong

An invented clinical standard, wrong limitation date or fabricated regulatory citation can harm patients or end a practitioner's registration.

#### Recent change

TGA AI/SaMD guidance (February 2026), Aged Care Act 2024 Quality Standards (November 2025) and Federal Court GPN-AI (April 2026).

### New Zealand

#### Treatment injury

Covered by ACC. Most compensatory medical-negligence claims for covered injuries are barred; check ss 317 and 319 first.

#### Health privacy

Privacy Act 2020, not the My Health Records Act or a state health-records statute.

#### Coroners

The Coroners Court is listed in the Courts of New Zealand GenAI guidelines.

#### Regulators

No AHPRA or TGA. Open the current New Zealand medicines or practitioner statute.

- Do not tell a client they can sue for compensatory damages for an injury with ACC cover until you have checked ss 317 and 319 and any exemplary-damages path.

Sources:

- [Accident Compensation Act 2001](https://www.legislation.govt.nz/act/public/2001/49/en/latest/) (checked 2026-09-23)
- [Community Law: Overview of the ACC scheme](https://communitylaw.org.nz/community-law-manual/chapter-19-accident-compensation-acc/overview-of-the-acc-scheme/) (checked 2026-09-23)
- [OPC: Privacy Act 2020 information privacy principles](https://www.privacy.org.nz/privacy-principles/) (checked 2026-09-23)
- [Courts of New Zealand: GenAI guidelines — Lawyers (7 December 2023)](https://www.courtsofnz.govt.nz/assets/6-Going-to-Court/practice-directions/practice-guidelines/all-benches/20231207-GenAI-Guidelines-Lawyers.pdf) (checked 2026-09-23)

### United States

Local name: Health and medical law

#### HIPAA

Applies to covered entities and business associates. A firm handling PHI for a covered-entity client may need a BAA; business associates are directly liable for some rules.

#### Other regulators

Medical-device and clinical-AI products can engage the FDA. Medical-board and malpractice law is state law.

- Do not input protected health information into a public or self-learning generative tool.

Sources:

- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-09-23)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*