When a practice decides to take AI seriously, the first instinct is often to commission a long policy. It gets written, approved, filed, and never read again. Meanwhile staff keep doing what they were doing.
A better starting point is one page. Short enough to read in two minutes, specific enough to answer the questions staff actually have, and easy to update when the tools change.
What the page needs to answer
Staff have four questions, and the policy should answer each in a sentence or two:
- Which tools can I use? Name them. "Approved AI tools" means nothing; "the practice assistant at assistant.example.com.au" means something.
- What can never go into anything else? Be concrete: patient or client names, health information, Medicare numbers, tax file numbers, case details, anything from a client file.
- What do I have to check? AI output is a draft. Someone qualified reads it before it goes to a patient, client, court or colleague.
- Who do I ask? One named person, not "management".
What to leave out
A one-page policy works because it is short. Resist the urge to add:
- a history of artificial intelligence;
- long lists of every possible risk;
- vague principles such as "use AI responsibly" without saying what that means;
- anything you wouldn't actually enforce.
If you need more detail for your own records, such as a vendor assessment or a privacy impact assessment, keep it in a separate document. The page for staff stays a page.
The template
Copy this, replace the parts in square brackets, and delete anything that doesn't apply.
[Practice name]: using AI at work
Last updated [date]. Questions to [name, email].1. Approved tools. You may use [tool name and link] for work. It runs [on our own server / under our business agreement with provider], and what you put in it is not used to train AI models.
2. Everything else. Do not put any of the following into any other AI tool, including free chatbots, browser extensions or apps on your own phone: patient or client names or details, health information, identifiers such as Medicare numbers or TFNs, anything from a patient or client file, or anything marked confidential.
3. Check before you send. Treat every AI output as a first draft. Read it in full, check facts, names, dates, doses and citations, and fix anything wrong. You are responsible for what you send, not the tool.
4. Be open about it. If a patient or client asks whether AI was used, tell them honestly. [If you use an AI scribe: always ask the patient before recording, and switch it off if they say no.]
5. If something goes wrong. If you think confidential information has gone into a tool it shouldn't have, tell [name] the same day. You won't be in trouble for reporting it; we need to know quickly.
6. Ideas welcome. If there is a task you think AI could help with, or you are using a tool that isn't listed here, talk to [name]. We would rather add a good tool than have people work around this page.
Making it stick
A policy only works if the approved option is genuinely convenient. If staff have to jump through hoops to use the sanctioned tool, they will drift back to whatever is on their phone. A few habits help:
- Launch it in a staff meeting, not by email. Show the approved tool doing a real task, such as tidying a referral or summarising a long letter.
- Make the "tell us the same day" rule safe. If reporting a mistake leads to blame, people stop reporting.
- Review it every six months, or whenever you add or drop a tool. Change the date at the top each time.
- Keep a copy where people look. The staff intranet, the shared drive, or pinned in the team chat.
Where this fits
A one-page policy doesn't make a practice compliant on its own, and it doesn't replace your privacy policy or professional obligations. What it does is give staff a clear, honest answer to "can I use this?", which is where most problems start. If you want help choosing the approved tool to name in point 1, that is exactly what our free assessment covers.
This is general information, not legal advice. Adapt the template to your practice and, if in doubt, have it reviewed by someone who knows your obligations.
