The simplest AI safety rule is also the most useful: pause before pasting. Many AI risks begin when someone copies information into a tool without thinking through privacy, consent, professional obligations, workplace policy, or client expectations.
This does not mean allied health professionals should avoid AI. It means the first habit should be deciding what information should never be entered into an unapproved AI tool.
Do not paste identifiable client information
Avoid entering identifiable client information into general AI tools unless the workflow has been properly assessed and approved.
That includes:
- names
- dates of birth
- addresses
- phone numbers
- email addresses
- Medicare numbers
- NDIS numbers
- record numbers
- appointment details
- referral letters
- assessment forms
- clinical notes
- reports
- photos
- audio recordings
- consultation transcripts
If the tool is not approved for personal and health information, do not put personal or health information into it.
Do not assume removing the name is enough
De-identification is more than deleting a name from the top of a note. A person may still be recognisable from context.
Be cautious with:
- rare diagnoses, injuries, or presentations
- small towns, suburbs, workplaces, schools, or sporting clubs
- dates of incidents, appointments, operations, or injuries
- family details
- occupation or role
- highly specific clinical history
- distinctive combinations of age, sex, location, diagnosis, and life circumstances
If someone in the practice, local community, school, workplace, or referral network could reasonably work out who the person is, treat the information as identifiable.
Do not paste consultation recordings or transcripts into unapproved tools
AI scribes and transcription tools need special care because they may capture a real conversation. A consultation can include health information, personal details, family context, employment issues, mental health information, financial concerns, complaints, and other sensitive material.
Before using AI to record, transcribe, or summarise a consultation, the practice should know:
- whether the client has been informed
- whether informed consent is required
- where the audio and transcript are stored
- whether data is reviewed by humans
- whether data may be used to improve the tool
- how long data is retained
- who checks the final note
- what happens if the client declines
If those questions have not been answered, do not use a general AI tool as a workaround.
Do not paste information that asks AI to make the clinical decision
Be careful with prompts that ask AI to:
- diagnose
- triage
- decide whether urgent care is needed
- assess risk
- choose treatment
- interpret clinical findings
- recommend an individual management plan
- decide whether a client is safe to exercise, work, drive, or return to sport
- replace professional reasoning
AI can help structure thinking or draft general explanations, but it should not become the decision-maker. A qualified professional remains responsible for the final judgement.
Do not paste confidential business or staff information casually
Client information is not the only risk. Allied health practices also hold sensitive business and staff information.
Avoid pasting:
- staff performance concerns
- workplace complaints
- incident reports
- contracts
- supplier negotiations
- payroll or financial details
- insurer correspondence
- legal correspondence
- business strategy
- internal disputes
- identifiable student or supervisee information
If the information would be inappropriate to share outside the practice, do not assume it is safe to paste into a public or personal AI account.
Do not paste files just because upload is available
The ability to upload a file does not mean the file is appropriate for that tool.
Be cautious with:
- PDFs
- referral letters
- spreadsheets
- exported reports
- screenshots
- photos
- forms
- rosters
- invoices
- email threads
- presentations
- policy documents
Files can contain hidden details such as names, metadata, comments, tracked changes, email addresses, document history, or embedded images. A file may reveal more than you intended.
Use safer alternatives
In many cases, you can get the benefit of AI without using sensitive information.
Safer options include:
- use a fictional example
- generalise the scenario
- remove more detail than feels necessary
- describe the task without including client facts
- ask for a structure rather than a completed client-specific answer
- use public information
- create a template that a clinician completes manually
- ask AI to generate questions to consider, not a decision to follow
For example, instead of pasting a real referral letter, you could ask:
Create a general checklist a physiotherapist could use when reviewing a referral for a new musculoskeletal client. Do not make clinical decisions. Include sections for missing information, red flags to consider, consent, goals, and follow-up questions.
That prompt gets structure without exposing a real person.
The quick test before you paste
Before entering anything into an AI tool, ask:
- Could this identify a client, staff member, student, referrer, or business?
- Is this health information, personal information, or confidential information?
- Would the person expect this information to be entered into this tool?
- Has the practice approved this tool for this kind of information?
- Do I know where the data goes and how long it is kept?
- Could I get the same benefit with a fictional, generalised, or de-identified version?
- Who will review the output before it is used?
If you are unsure, do not paste it. Use a safer version, ask for approval, or pause before continuing.
Related resource
For a practical prompt-by-prompt check, use the Before You Paste Into AI checklist. It is designed to help allied health teams slow down before pasting, uploading, dictating, or transcribing information into an AI tool.
Related reading: Why you should not paste client information into public AI tools and When sensitive information goes into the wrong AI tool.
Useful starting resources include Ahpra’s guidance on AI in healthcare, the OAIC’s overview of the Australian Privacy Principles, and AHAI’s article on what it means when sensitive information goes into the wrong AI tool.