AI Receptionists & Patient Privacy in NZ

AI receptionists and patient privacy: what NZ practices need to tell people

The short answer

Tell patients three things: an AI assistant may answer, whether calls are recorded, and how to reach a person instead. Under the Privacy Act 2020 and the Health Information Privacy Code 2020 you stay responsible for patient information, wherever your provider stores it. Generate the wording above.

By Akaash, founder of FirstVoice

Last updated 16 September 2026

Build your patient wording

What kind of practice is this?

Practice name

Are calls recorded?

Who handles privacy requests?

What the AI says when it answers

"You're speaking with an AI assistant for Our medical centre. This call is recorded so we get your details right. If you'd rather speak to a person, just say so."

Your provider should be able to set this greeting for you.

Paragraph for your website privacy page

How we answer your calls

Our medical centre uses an AI assistant to answer calls when our team can't get to the phone, including after hours. It books appointments, answers general questions and takes messages. It does not give clinical advice and it never asks for card details.

Calls are recorded and transcribed so we have an accurate record of what you asked for. Recordings and transcripts are stored by our phone technology provider on servers in the United States, under a written data processing agreement. We keep them only as long as we need them.

If you'd rather not use the AI assistant, ask for a person at any time and we'll put you through or call you back. Urgent or clinical matters go to our team, and in an emergency you should call 111.

To ask what we hold about you, or to have it corrected or deleted, contact our privacy officer.

Waiting-room or reception sign

Our medical centre now uses an AI assistant to answer calls we can't get to, including after hours. Calls are recorded. Ask for a person any time. In an emergency, call 111.

Script for your front desk team

What to tell patients about our AI phone assistant

1. "It's an AI assistant that answers when we're with patients or closed. It books appointments and takes messages."
2. "It doesn't give clinical advice, and it never asks for your card details."
3. "Calls are recorded so we get details right. You can ask us not to record, and you can ask for a copy of what we hold."
4. "If you'd rather talk to one of us, just say so and it'll put you through or take a message."
5. "If it's an emergency, hang up and call 111."

These are drafts to start from, not legal advice. Have your privacy officer or lawyer check them, and change anything that doesn't match how your practice actually works.

General information, not legal advice. Have your privacy officer check anything before you publish it.

Why this comes up so fast in health

Patients notice an AI on the phone sooner than other customers do, and they react more strongly. The complaints that spread aren't about the technology being imperfect. They're about feeling recorded without being told, or not being able to reach a human when something is worrying them.

Practices also conflate two different tools. An AI scribe listens to consultations and drafts clinical notes. An AI receptionist answers the phone. They raise different consent questions, and a patient who has refused one will assume the worst about the other.

The four things to get right

1. Say it at the start of the call

A short greeting does most of the work: who the caller has reached, that it's an AI assistant, whether the call is recorded, and that a person is available. That single line prevents most complaints, and the generator above writes it for you.

2. Put it in writing where patients look

Your website privacy page should say an AI assistant may answer calls, what it does and doesn't do, whether calls are recorded, how long recordings are kept, where they're stored, and who to contact about them.

3. Be straight about overseas storage

The Privacy Act allows sending personal information overseas with appropriate protections, but patients ask directly where their information sits. With FirstVoice, call recordings and transcripts are stored and processed in the United States by our voice technology provider, under a signed Data Processing Addendum and a HIPAA Business Associate Agreement. FirstVoice does not claim any compliance certification of its own, and you can read the detail on security and privacy.

4. Keep clinical judgement out of it

An AI receptionist should book, answer practical questions, and take messages. It should never triage symptoms, discuss results, or give advice. Set your escalation rules so that anything urgent goes to your team, and anything dangerous goes to 111 first.

What patients tend to ask

"Is this being recorded?" Answer at the start, not when asked.
"Where does the recording go?" Name the country and the agreement.
"Can I talk to a real person?" Yes, and it should take one sentence.
"Will it read my notes?" No. Say what it can and can't see.
"Can you delete it?" Explain your retention period and how to ask.

Before you switch it on

Agree your recording setting and retention period.
Publish the website paragraph and brief the front desk.
Write your escalation rules, including the 111 line.
Check your professional body's guidance: councils differ on advertising and testimonials.
Run test calls, including asking for a person and describing an emergency.

The testing guide covers that last step, and the health industry pages set out how calls are handled for GPs, dentists, physios, vets and clinics.

Frequently asked questions

Do we need patient consent to use an AI receptionist?

Tell patients plainly and give them an easy way to reach a person instead. Under the Privacy Act 2020 you must take reasonable steps to make people aware you're collecting their information and why. What that means for your practice is a question for your privacy officer or the Privacy Commissioner.

Is it legal to record calls at a medical practice in New Zealand?

A party to a call can generally record it, and health information is also covered by the Health Information Privacy Code 2020. Practices that record should say so at the start of the call, keep recordings only as long as needed, and be able to provide or delete them on request.

Where is call data stored?

With FirstVoice, calls are stored and processed in the United States by our voice technology provider, under a signed Data Processing Addendum and HIPAA Business Associate Agreement. Storage overseas is allowed under the Privacy Act, but you should tell patients and satisfy yourself about the protections in place.

Can an AI receptionist read out test results?

No. FirstVoice is scripted never to discuss results or give clinical advice. It books, answers practical questions and takes messages, and anything clinical goes to your team or, in an emergency, to 111.