Using AI in your practice marketing: Ahpra and OAIC guidance

What Ahpra’s 2024 AI principles and the OAIC’s guidance on commercial AI products mean for AI-written copy, images, reviews and patient data.

21 October 202411 min read

On 21 October 2024, the Office of the Australian Information Commissioner (OAIC) published guidance on privacy and the use of commercially available AI products. It came two months after Ahpra and the National Boards published guidance, reviewed on 22 August 2024, on meeting professional obligations when using artificial intelligence in healthcare. Together, these two documents are the main official guidance on how health practices should approach AI tools, including the ones now used every day to write web copy, reply to reviews, draft newsletters and answer enquiries.

Neither document created new law. Both explain how existing obligations apply. That is the key point for your marketing: there is no separate, lighter set of rules for AI-generated content. If an AI tool writes a misleading claim and you publish it, the claim is yours. If you paste patient details into a public chatbot, the privacy obligations are yours too.

What has happened since

A few later developments affect how you read this guidance:

No mandatory AI rules, for now. The Australian Government consulted on mandatory guardrails for AI in high-risk settings from 5 September to 4 October 2024. The Department of Industry, Science and Resources now says the Government “will not proceed at this time” with those proposals. The National AI Plan, released on 2 December 2025, focuses on investment, adoption and a $29.9 million commitment to establish an AI Safety Institute in early 2026. As at October 2026, we are not aware of any binding AI-specific rule for health advertising beyond the TGA and Ahpra requirements and general law.
A specific cosmetic rule. Ahpra’s guidelines for advertising higher risk non-surgical cosmetic procedures, effective 2 September 2025, say advertisers must not use automated apps or tools that predict an individual’s appearance after a procedure.
Privacy policies and automated decisions. From 10 December 2026, new Australian Privacy Principles 1.7 to 1.9 require privacy policies to disclose certain decisions made by, or with substantial help from, computer programs using personal information.

What changed

Ahpra: meeting your professional obligations when using AI

Ahpra and the National Boards published principles for practitioners using or planning to use AI. They describe these as a translation of existing code of conduct obligations, not new rules, and say the guidance will be updated regularly. The page was reviewed on 22 August 2024, the same day the Medical Radiation Practice Board published a news item pointing practitioners to it.

The guidance groups obligations under five headings: accountability, understanding, transparency, informed consent, and ethical and legal issues. It does not mention advertising or marketing directly. Its principles still matter for marketing, because marketing is one of the main places practices use AI.

OAIC: privacy and commercially available AI products

The OAIC released two guides on 21 October 2024. One covers privacy obligations when businesses use commercially available AI products. The other is for developers training generative AI models. For practices, the first guide is the relevant one.

Privacy Commissioner Carly Kind said “AI products should not be used simply because they are available” and that the community and the OAIC expect AI users to take a cautious approach, assess risks and make privacy a key consideration.

Who it applies to

The Ahpra guidance applies to all registered health practitioners using AI tools, whether for clinical work, record-keeping, patient communication or anything else.

The OAIC guidance applies to organisations with obligations under the Australian Privacy Principles in the Privacy Act 1988, which includes health practices. It is also relevant to the contractors who handle patient information for you, such as a marketing agency managing your enquiry forms or patient email lists, so make sure anyone working on your marketing follows the same rules.

What the guidance requires

Accountability: you stay responsible for the output

Ahpra says “practitioners must apply human judgment to any output of AI.” Regulator approval of a tool does not change that duty. For marketing, this means a person with knowledge of your obligations should check every AI-drafted page, post, ad and email before it goes out.

Understanding: know what the tool does with data

Ahpra expects practitioners to understand a tool well enough to use it safely, including its intended use and how data is used to retrain the AI, and where and how it is stored. If an AI tool keeps what you type and uses it to train future versions, anything you paste into it may not stay private.

Transparency and informed consent

Ahpra says practitioners should tell patients about their use of AI and address any concerns, with the level of detail depending on context. Where AI needs a patient’s personal data, such as an AI scribe recording a consultation, informed consent is expected. Ahpra notes possible criminal implications for recording consultations and expects an explicit consent step first.

Privacy applies to what goes in and what comes out

The OAIC guidance says “privacy obligations will apply to any personal information input into an AI system”, and to output that contains personal information. If AI is used to generate or infer personal information, including images, that counts as a collection of personal information and must meet the collection rules.

Use information only for the purpose it was collected

The OAIC notes that APP 6 requires organisations to use or disclose personal information only for the primary purpose it was collected for, unless an exception applies. Patient information collected to provide care should not be fed into an AI tool to build marketing campaigns without considering whether that use is permitted.

Do not enter personal information into public AI tools

The OAIC’s best-practice recommendation is to “not enter personal information, and particularly sensitive information, into publicly available generative AI tools”. Health information is sensitive information. This is the single most practical rule for your front desk and marketing team.

Update your privacy policy

The OAIC says businesses should update their privacy policies and notifications with clear and transparent information about their use of AI.

Accuracy

The OAIC also reminds organisations that APP 10 requires reasonable steps to ensure the personal information they handle is accurate. AI tools can produce confident but wrong output, so check anything that ends up in a patient record or communication.

What it means for your marketing

Website

AI writing tools are good at fluent, persuasive copy, which is exactly the kind of copy that drifts into claims you cannot support. Watch for:

Claims about outcomes, success rates or how a treatment “will” make someone feel.
Comparisons with other practitioners or treatments.
Superlatives and words that suggest certainty or safety.
Invented statistics or references. Check every number and every source an AI tool provides.
Generic content that does not match what your practice actually offers.

The National Law prohibits advertising that is false, misleading or deceptive, and that does not change because a tool wrote the first draft.

Images

AI-generated or AI-edited images can mislead if they suggest a result or a setting that is not real. For higher risk non-surgical cosmetic procedures, Ahpra’s advertising guidelines require real, unedited images and ban appearance-prediction tools. For other services, treat AI images with the same caution: do not let them imply treatment results.

Google Business Profile and reviews

Replying to reviews with an AI tool is common. Two cautions apply. First, do not paste a patient’s details or clinical information into a public AI tool to draft the reply. Second, keep replies general. It is safer not to discuss a reviewer’s care in public, whoever drafts the reply. Separately, the ACCC has said that creating fake reviews, or editing or removing genuine negative reviews to inflate ratings, breaches the Australian Consumer Law. Using AI to generate reviews is no different.

Social media

AI caption generators often add hashtags, emojis and promotional phrasing automatically. Review every caption against the same standard as your website. If you use AI to create “patient stories”, remember that the testimonial ban applies to advertising regulated health services, and invented stories are also likely to be misleading.

Paid ads

Many ad platforms now generate headlines and descriptions automatically. Turn off or review automated text features so the platform cannot publish claims you have not approved.

Email and SMS

Do not upload patient lists or enquiry data to a public AI tool to segment, personalise or write campaigns. If you use AI features inside an email platform, check what data the provider uses, where it is stored and whether it trains models. The Spam Act consent and unsubscribe rules still apply to anything you send.

Chatbots and enquiry handling

A chatbot on your website is a communication channel and may collect personal information. Make sure it tells users they are dealing with an automated tool, does not give individual clinical advice, does not make claims your website would not make, and that your privacy policy explains how chat data is handled.

Common mistakes we see

Pasting real enquiries into a public chatbot to draft a reply, including names, symptoms or contact details.
Publishing AI copy without a compliance read, on the assumption that the tool “knows” the rules.
Trusting AI-supplied facts, including statistics, research citations and regulatory requirements.
AI-generated images that imply results, or that show a clinic, team or patient that does not exist.
Privacy policies that say nothing about AI, even though the practice uses AI scribes, chatbots or AI features in its software.
Letting ad platforms auto-write ads with no review.

A practical checklist

List every AI tool used in the practice, including features built into software you already use.
For each tool, find out whether it stores inputs, where data is held and whether inputs are used for training.
Write a simple rule for staff: no patient names, contact details or health information in publicly available AI tools.
Require human review of every AI-drafted page, post, ad, email and review reply before publishing.
Check every statistic, citation and claim in AI output against a reliable source.
Do not use AI to create reviews, testimonials or patient stories.
Do not use AI images that could imply treatment results. For higher risk non-surgical cosmetic procedures, do not use appearance-prediction tools at all.
Review automated ad text features on Google and Meta and switch off or approve them.
Update your privacy policy to explain how you use AI, and plan for the new automated decision disclosure rules from 10 December 2026.
Where AI uses patient data in care, such as AI scribes, follow Ahpra’s guidance on informed consent.

How this fits with other rules

Ahpra and the National Law. The AI guidance restates code of conduct obligations. The advertising rules in the National Law, including the bans on misleading advertising and testimonials, apply to AI-generated marketing in exactly the same way as to anything else.

Privacy Act. The OAIC guidance explains how the Australian Privacy Principles apply to AI tools. Patient health information is sensitive information and needs extra care. The OAIC’s June 2026 determinations on tracking pixels on health websites are a reminder that the regulator is actively looking at how health businesses use technology to collect data for marketing.

Australian Consumer Law. Misleading claims and fake reviews breach the ACL whoever, or whatever, wrote them.

TGA. If AI writes copy about therapeutic goods, including medicines and devices, TGA advertising rules apply.

Government AI policy. The Government is not proceeding at this time with mandatory guardrails. Voluntary guidance exists, but as at October 2026 the binding rules for AI in health marketing are the ones above.

Frequently asked questions

Can we use AI to write our website content?

Yes. Nothing in the Ahpra or OAIC guidance stops you. But you remain responsible for what you publish, so the content needs the same review against the advertising rules as anything written by a person.

Do we have to tell patients we use AI for marketing?

Ahpra’s transparency principle is about telling patients when AI is used in their care. The OAIC says businesses should update privacy policies with clear information about their use of AI. If AI tools process personal information, your privacy policy should explain that.

Can staff use a public chatbot to draft replies to patient emails?

Only without personal information. The OAIC recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools. Staff can ask a tool for a general template and then add details themselves outside the tool.

Are AI before-and-after previews allowed?

For higher risk non-surgical cosmetic procedures, no. Ahpra’s advertising guidelines for those procedures say advertisers must not use automated apps or tools that predict an individual’s appearance after a procedure. For other services, any image that implies a result you cannot support risks being misleading.

Is there an Australian law specifically about AI in health advertising?

Not as at October 2026. The Government has said it will not proceed at this time with mandatory guardrails. Existing laws, including the National Law, the Privacy Act, the ACL and TGA rules, apply to AI content.

Need a hand?

If your team is already using AI to produce content, we can review what has been published and set up a simple approval process. Our compliant content service pairs efficient drafting with a proper compliance read, and our compliance training covers safe AI use for front desk and marketing staff.

This article is general guidance based on the published rules, not legal advice. Final responsibility for advertising sits with the registered practitioner, and complex situations may need independent legal advice.