Short answer
AI for healthcare in New Zealand is safest and most useful in administration: routing appointment enquiries, tracking referral paperwork and answering staff questions from non-clinical policies. It should never assess symptoms, give personalised advice or make clinical decisions. Health information is covered by the Health Information Privacy Code 2020, and Health NZ tells its own staff not to put patient information into unapproved AI tools.
- Keep AI to administration: no symptom assessment, clinical triage or personalised advice.
- The Health Information Privacy Code 2020 takes the place of the IPPs for health agencies.
- Health NZ staff must not enter patient information into unapproved generative AI tools.
- Any message that mentions symptoms goes straight to a clinician, with no AI reply.
Where AI belongs in a health provider, and where it does not
AI belongs in the administrative layer of health care: the inbox that fills with booking changes, the referral letters that need chasing, the staff member asking how many days’ notice the leave policy requires. It does not belong anywhere a clinical judgement is made. That line is the whole design brief for this sector, and every workflow on this page sits on the administrative side of it.
The administrative load is large because the sector is large. Health care and social assistance is the biggest employing industry in Auckland, with about 95,500 employees, and in Christchurch, with about 33,300, according to Stats NZ business demography data for February 2025 (provisional counts; the ranking is ours). Clinical AI is arriving at the same time: the Government said on 28 February 2026 that an AI scribe was live in every emergency department, rolled out to 1,250 ED doctors and frontline staff. Scribes are clinical tools and outside the scope of this guide.
Healthcare administration workflow map
| Workflow | What AI does | What a person still decides | Data involved | Difficulty |
|---|---|---|---|---|
| Appointment enquiry routing | Sorts booking, cancellation and admin requests by type and clinic, drafts admin replies, and sends any mention of symptoms straight to a clinician queue | Clinical urgency and the type of appointment needed | Portal messages, email, web forms, voicemail transcripts | Medium: symptoms must escalate |
| Referral administration workflow | Checks outgoing referrals for required admin fields, tracks acknowledgements, chases overdue responses and files replies to the right record | Clinical content and priority of the referral | Referral letters, e-referral acknowledgements, practice management system | Medium: patient matching |
| Nonclinical policy search | Answers staff questions from HR, privacy, complaints and IT policies, quoting the section | How a policy applies to a particular case | Policy manual, procedures, employment agreements | Low: read-only, non-clinical |
| Patient portal message sorting | Labels messages as admin, results query, repeat request or symptom-related and routes them; never replies on clinical matters | Every clinical response | Portal messages | High: clinical content arrives unannounced |
| Funding and claim paperwork | Checks forms for missing administrative fields before a staff member lodges them | Clinical details and lodgement | Claim forms, invoices | Medium: forms differ by funder |
| Account and invoice queries | Drafts replies to billing questions from the fee schedule and flags disputes | Write-offs and payment arrangements | Invoices, fee schedule | Low: bounded answers |
| Complaint logging | Logs complaints, extracts dates and issues, drafts an acknowledgement for the practice manager | The response and any remedy | Complaint emails and letters | Medium: tone and sensitivity |
| Recall and reminder drafting | Fills approved reminder templates from the recall list | Who is recalled and why | Recall lists from the practice system | Low: fixed wording |
Three of these have worked guides: routing appointment enquiries, administering referrals and searching non-clinical policies.
Health privacy rules and sector guidance that apply
- Health Information Privacy Code 2020. The HIPC “covers health information about identifiable individuals that is collected, used, held, and disclosed by health agencies” and takes the place of the information privacy principles for the health sector. It applies to providers such as PHOs and rest homes, and to bodies such as ACC and health insurers. Amendment No 2 (March 2026) reflects the new indirect-collection notice rule in force from 1 May 2026.
- Security is being enforced. On 23 September 2026 the Privacy Commissioner issued compliance notices to Manage My Health and Health NZ for failing the security requirements of HIPC rule 5 at the time of the December 2025 cyber attack. Every AI vendor you add becomes another place health information sits.
- Health NZ’s own rules. Its guidance on generative AI, updated in May 2026, says its expert advisory group recommends caution, and that employees and contractors must not enter patient or organisational information into unapproved tools or use them for clinical decisions or personalised advice. It also says Health NZ has no private LLMs available. These rules bind Health NZ staff and contractors; for other providers they are a clear signal of what the system expects.
- Medical Council. Its guidance on AI in patient care, published 10 March 2026, says doctors must not use AI to impersonate themselves, including through chatbots. A reception assistant must never present as a clinician.
- Privacy impact assessment. For health information in particular, run the privacy impact assessment the Privacy Commissioner expects before go-live, and have a person check outputs before anyone acts on them.
This is general information. Check obligations in your funding and PHO agreements and take privacy or legal advice before deploying.
Practice systems and where AI connects
Most providers run a practice management system such as Medtech Evolution or Indici, a patient portal such as ManageMyHealth, secure messaging for referrals and results, and Microsoft 365 for email and policies. AI should connect through approved integrations with logged access, not through staff copying messages into a chatbot. Data location needs a recorded decision: no major AI vendor offered guaranteed in-New Zealand processing as at October 2026, and the nearest option we know of is Amazon Bedrock’s AU profile, which limits Claude processing to Australian and New Zealand regions. Our notes on Microsoft 365 and data residency for AI systems go further.
A first project: appointment enquiry routing with red-flag rules
Routing is the right start because the AI sorts and drafts but decides nothing clinical, and the escalation rules can be tested before a single patient message is touched.
- Inputs
- Portal messages, emails and web form requests to the front desk.
- Systems
- The practice management system’s appointment book, a classification model, and the shared inbox.
- Steps
- Each message is labelled admin or clinical. Clinical or uncertain messages go straight to the clinician queue with no AI reply. Admin requests get a drafted response and a suggested booking action.
- Human review
- Reception approves every draft. A clinician reviews a weekly sample of messages labelled admin to check none should have escalated.
- Outputs
- Routed messages, approved replies, and a log of every escalation.
- Measures
- Time to route, misroutes, and missed escalations, which must be zero.
- Risks
- Symptoms buried in admin requests, shared family email addresses, and messages in languages other than English.
Illustrative example: a six-doctor practice receives about 150 portal messages and emails a day, and reception spends around 1.5 minutes reading and routing each, about 3.75 hours a day. If staff instead confirm AI routing in about 30 seconds per message, that falls to 75 minutes, saving roughly 2.5 hours a day. The saving only counts if the weekly clinician audit finds no missed escalations. Our AI workflow automation service builds this, and the lesson on managing AI mistakes and escalation covers the escalation design.
Where AI fails in health administration
Policy questions about safe use are covered by our AI governance work, and RAG development is how we build cited policy search.
Workflows we map in this sector
- Appointment enquiry routingPatient emails and portal messages sorted into the right admin queue, with anything clinical flagged to staff at once.
- Nonclinical policy searchStaff ask how leave, privacy, procurement or rostering rules work and get the current policy clause, cited.
- Referral administration workflowReferrals registered, matched to the right patient and checked for gaps before a clinician reads them.
Sources
- Health Information Privacy Code 2020, Office of the Privacy Commissioner, accessed 19 October 2026
- Privacy Commissioner issues Compliance Notices to Manage My Health and Health NZ, Office of the Privacy Commissioner, 23 September 2026
- Using generative AI and large language models, Health New Zealand | Te Whatu Ora, last updated 21 May 2026
- Guidance on using artificial intelligence (AI) in patient care, Medical Council of New Zealand, 10 March 2026
- AI scribe now in every emergency department, New Zealand Government, 28 February 2026
- Geographic units by industry and statistical area, 2000–2025, Stats NZ, 30 October 2025
- Artificial intelligence and the Information Privacy Principles, Office of the Privacy Commissioner, September 2023
- Run generative AI inference with Amazon Bedrock in Asia Pacific (New Zealand), AWS Machine Learning Blog, 26 March 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.