AI Use and Data Protection Policy
1. Purpose
This policy outlines how Mahora Medical uses Artificial Intelligence (AI) tools in its day-to-day operations and how it protects the privacy of patient information. Our AI use is limited to supporting communication and clinical note writing. AI is not used for making clinical decisions, diagnoses, or treatment plans.
2. Scope
This policy applies to all staff, contractors, and technology partners who use or manage AI tools at Mahora Medical, and its implications for patients.
3. Permitted Use of AI
AI tools are used only for the following functions:
3.1 Patient Communication (Administrative Only)
- Assisting in non-clinical communication, such as appointment reminders, follow-up messages, and responses to general queries.
- All AI-generated messages have been reviewed by a staff member.
3.2 Clinical Note Writing Support
- Assisting in transcribing or summarising notes from clinical consultations based on information provided by the clinician.
- All clinical documentation produced with AI support is reviewed and approved by a qualified health professional before being included in the patient record.
4. Prohibited Use of AI
- AI is not used to diagnose medical conditions or create treatment plans.
- AI does not independently communicate with patients without prior human oversight.
- AI outputs are not considered part of the official medical record unless verified by a clinician.
5. Privacy and Data Protection
We are committed to protecting your personal information in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.
5.1 Collection and Use of Data
- AI tools will only access health information necessary for the permitted uses listed above.
- Wherever feasible, health information is de-identified before being processed by AI systems.
5.2 Data Security
- All AI tools used by the practice must meet industry standards for data security and encryption.
- Any AI tools used are reviewed to ensure they comply with New Zealand health information privacy regulations.
5.3 Access and Authorisation
- Only authorised staff members who are trained in data protection protocols can use AI tools.
- Staff are trained to use AI tools appropriately and to safeguard patient confidentiality.
5.4 Data Retention
- AI-generated drafts that are not reviewed or approved for inclusion in the patient record are deleted within 30 days.
- Final documentation is stored securely in line with our standard medical record retention policies.
6. Transparency and Patient Rights
- We believe in being transparent with our patients. Information about our use of AI tools is available on our website and in the practice.
- If you prefer that your information is not processed using AI tools, you may notify us and we will respect your request where practical and legally allowable.
7. Oversight and Accountability
- All outputs from AI tools are reviewed and confirmed by a qualified staff member before being communicated to patients or included in medical records.
- Clinicians retain full responsibility for all clinical documentation and communication decisions.
8. Policy Review
This policy will be reviewed annually or sooner if there are changes in technology use, clinical protocols, or New Zealand privacy laws.
9. Contact Us
If you have any questions or concerns about how your health information is handled or how AI is used in our practice, please contact:
Practice Manager
Victoria Hawke
06 8782722
