Owner Reporting AI Readiness

Reporting is a management workflow. It still needs a privacy boundary.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Owner-dentists and practice managers often want AI to summarise production, chair utilisation, treatment acceptance, bookings, marketing and follow-up performance. This guide helps separate useful reporting work from unsafe data movement.

Good use cases

AI can help with:

• Turning exported totals into a management summary
• Drafting a weekly meeting agenda
• Explaining trends in plain English
• Creating action lists from non-identifiable metrics
• Comparing planned vs completed workflow tasks
• Summarising public marketing activity
• Drafting questions for the practice manager or treatment coordinator

High-review use cases

Review before using AI with:

• Patient lists
• Treatment acceptance exports with patient names
• Recall or reactivation lists
• Unscheduled treatment reports
• Appointment notes
• Complaints
• Staff performance data
• Provider-level clinical notes
• Any PMS export that includes names, dates of birth, contact details or treatment specifics

Red / amber / green reporting rule

Use this table as a starting classification. Items in amber or red are possible data-movement exposure requiring review — not a declared breach.

Status	Reporting data
Green	Aggregated, non-identifiable totals and generic operational notes.
Amber	Small segments, provider reports or staff data that could identify people.
Red	Patient-identifiable PMS exports, treatment plans, notes, recalls or complaint data in public AI.

Overseas processing and APP 8 — a consideration to assess

Before feeding practice or patient data into an AI reporting tool, owners should check where that tool processes and stores data.

If the tool processes data on overseas servers — or uses overseas AI subprocessors — the workflow may involve cross-border disclosure of personal information. Under the Australian Privacy Act, APP 8 requires an entity to take reasonable steps before disclosing personal information to an overseas recipient, and the Australian entity can remain accountable for how the overseas recipient handles that information (s 16C). This applies even when the tool is from a reputable vendor.

This is a consideration to assess, not a declared breach. Many AI reporting tools are cloud-hosted in the US or elsewhere. That alone is not automatically a problem, but it does mean the practice should review:

• Where the tool processes and stores data
• Whether the data includes any patient-identifiable fields (names, dates of birth, contact details, treatment details)
• What contracts, data-processing agreements or terms of service exist
• Whether patients were told their information might be handled by overseas systems
• Whether aggregated, non-identifiable data can be used instead

If the reporting workflow uses only aggregated, non-identifiable totals — as recommended in the minimum reporting dataset below — the overseas-processing risk is substantially lower. The higher concern arises when patient-level PMS exports, recall lists, treatment notes or complaint data are fed directly into an overseas-hosted AI tool.

Possible cross-border review trigger: if your AI reporting tool processes patient-identifiable data on overseas infrastructure, APP 8 considerations apply. This should be reviewed before the workflow is used at scale.

Safer reporting prompt

Summarise these aggregated practice metrics for an owner-dentist.
Do not infer patient details, clinical advice or individual staff performance.
Provide operational observations and questions for management review.

Minimum reporting dataset

Prefer aggregated fields:

Metric	Safer shape
Production	Weekly total by category
New patients	Count by source
Emergency bookings	Count and conversion trend
Treatment acceptance	Percentage by broad treatment category
Recall	Count by status, not patient list
Marketing	Spend, clicks, calls and bookings
Follow-up	Count of outstanding tasks

Avoid exporting patient-level rows unless the workflow is approved for that data.

Owner dashboard questions

Use AI to help ask better questions:

• What changed this week?
• Which funnel step is weakest?
• Which follow-up queue is growing?
• Which guide or scanner drove interest?
• Which booking source needs review?
• Which workflow needs a staff checklist?
• What should be discussed at the next owner/manager meeting?

Human review rule

AI reporting should not be treated as truth by default.

Before acting on a recommendation:

1. Check the source data.
2. Check whether the metric is aggregated or patient-level.
3. If the tool is overseas-hosted, confirm no patient-identifiable data was included in the input.
4. Ask whether the suggested action is operational, clinical or financial.
5. Escalate clinical or patient-specific decisions to the dentist.
6. Record the final human decision.

Staff policy insert

AI may be used to summarise aggregated practice metrics and draft management notes.
Patient-identifiable PMS exports, treatment lists, recall lists, complaints,
clinical notes and contact details must not be entered into public AI tools.
AI reporting outputs are drafts for owner or manager review, not automatic decisions.

---

This guide is educational material only. It does not provide clinical, financial, legal or compliance advice, and does not determine whether a practice is compliant or non-compliant with any law or regulation. Any data-movement patterns identified here are possible areas for review, not declarations of a breach.