AI Scribes Collect Sensitive Health Data Without Consent as 40% of GPs Deploy Tech

Every medical consultation is now a potential data harvest. With 40% of GPs deploying AI scribes, sensitive health conversations—about mental illness, sexual health, or genetic conditions—are being recorded and processed, often without informed patient consent. For cybersecurity professionals, this explosion of unregulated audio and text data represents a dangerous new attack vector, with no clear breach notification protocols or liability if that data leaks.

The rapid adoption of AI scribes by Australian general practitioners has reached a critical inflection point, with 4-in-10 GPs now using the tools—a doubling in the past 12 months—according to a new report from Digital Rights Watch titled 'Off The Record: AI scribes in Australian healthcare.' The findings underscore a tension between touted productivity gains and mounting evidence of risks to patient safety, privacy, and equity. While the technology promises to reduce administrative burdens by transcribing consultations and even drafting prescriptions, referrals, and diagnoses, the report highlights a dangerous gap in testing, consent practices, and safeguards for vulnerable populations.

“

With 40% of GPs deploying AI scribes, sensitive health conversations—about mental illness, sexual health, or genetic conditions—are being recorded and processed, often without informed patient consent.

The core concern centers on patient consent and the right to opt out. The report details an alarming incident in which a Melbourne psychiatrist refused to accept new patients who would not allow an AI scribe to record and transcribe their sessions. This coercive dynamic—making healthcare access contingent on surrendering to AI surveillance—contravenes the legal requirement for explicit patient consent and fundamentally undermines the trust essential to the doctor-patient relationship. Tom Sulston, policy head at Digital Rights Watch, stressed that patients must retain the ability to say no without jeopardizing their care, stating, 'It needs to be okay for patients to feel uncomfortable about AI and say can we just have an old-fashioned consult the way that they used to be done?'

Beyond consent, the report exposes significant technical shortcomings with direct clinical consequences. AI scribes exhibit markedly lower transcription accuracy for patients with non-English accents and those from minority backgrounds. This bias can lead to flawed clinical records, misdiagnoses, and inappropriate treatment plans, deepening existing health disparities. The problem is compounded by the fact that many scribe tools go beyond mere transcription to generate medical outputs, yet they lack rigorous independent testing or proven safety standards. As Sulston asked, 'Patients have a reasonable concern about have these things been tested? Have they been proven safe?'

The privacy dimension is equally urgent. These AI systems listen to and process intimate, stigmatized health information—ranging from mental and sexual health to genetic conditions—often without clear disclosure about data storage, third-party access, or cloud processing. Patients are left in the dark about whether their sensitive conversations are being used to train AI models or shared with technology vendors. The report notes that doctors are legally obligated to obtain consent, but this is frequently overlooked, leaving patients exposed to potential breaches and unauthorized data exploitation.

The insurance and liability landscape remains unclear. If an AI scribe introduces an error that leads to patient harm, it is ambiguous whether medical indemnity insurance will cover the costs. This regulatory vacuum creates a chilling effect where clinicians adopt the technology for efficiency while patients bear the risk. The rapid scale-up—from near-zero to 40% penetration in a short timeframe—has outpaced both healthcare governance and digital privacy law, raising the specter of systemic failures as usage continues to climb.