# AI for New Zealand healthcare administration. URL: https://levystreet.com/industries/healthcare-administration/ Updated: 2026-10-19 How NZ clinics and health providers use AI for appointment enquiries, referrals and policy search, within the HIPC and Health NZ guidance. Admin only. ## Short answer AI for healthcare in New Zealand is safest and most useful in administration: routing appointment enquiries, tracking referral paperwork and answering staff questions from non-clinical policies. It should never assess symptoms, give personalised advice or make clinical decisions. Health information is covered by the Health Information Privacy Code 2020, and Health NZ tells its own staff not to put patient information into unapproved AI tools. - Keep AI to administration: no symptom assessment, clinical triage or personalised advice. - The Health Information Privacy Code 2020 takes the place of the IPPs for health agencies. - Health NZ staff must not enter patient information into unapproved generative AI tools. - Any message that mentions symptoms goes straight to a clinician, with no AI reply. ## Where AI belongs in a health provider, and where it does not AI belongs in the administrative layer of health care: the inbox that fills with booking changes, the referral letters that need chasing, the staff member asking how many days' notice the leave policy requires. It does not belong anywhere a clinical judgement is made. That line is the whole design brief for this sector, and every workflow on this page sits on the administrative side of it. The administrative load is large because the sector is large. Health care and social assistance is the biggest employing industry in Auckland, with about 95,500 employees, and in Christchurch, with about 33,300, according to [Stats NZ business demography data for February 2025](https://www.stats.govt.nz/assets/Uploads/New-Zealand-business-demography-statistics/New-Zealand-business-demography-statistics-At-February-2025/Download-data/geographic-units-by-industry-and-statistical-area-2000-2025-descending-order.zip) (provisional counts; the ranking is ours). Clinical AI is arriving at the same time: the Government said on 28 February 2026 that an [AI scribe was live in every emergency department](https://www.beehive.govt.nz/release/ai-scribe-now-every-emergency-department), rolled out to 1,250 ED doctors and frontline staff. Scribes are clinical tools and outside the scope of this guide. ## Healthcare administration workflow map | Workflow | What AI does | What a person still decides | Data involved | Difficulty | |---|---|---|---|---| | [Appointment enquiry routing](/industries/healthcare-administration/appointment-enquiry-routing/) | Sorts booking, cancellation and admin requests by type and clinic, drafts admin replies, and sends any mention of symptoms straight to a clinician queue | Clinical urgency and the type of appointment needed | Portal messages, email, web forms, voicemail transcripts | Medium: symptoms must escalate | | [Referral administration workflow](/industries/healthcare-administration/referral-administration-workflow/) | Checks outgoing referrals for required admin fields, tracks acknowledgements, chases overdue responses and files replies to the right record | Clinical content and priority of the referral | Referral letters, e-referral acknowledgements, practice management system | Medium: patient matching | | [Nonclinical policy search](/industries/healthcare-administration/nonclinical-policy-search/) | Answers staff questions from HR, privacy, complaints and IT policies, quoting the section | How a policy applies to a particular case | Policy manual, procedures, employment agreements | Low: read-only, non-clinical | | Patient portal message sorting | Labels messages as admin, results query, repeat request or symptom-related and routes them; never replies on clinical matters | Every clinical response | Portal messages | High: clinical content arrives unannounced | | Funding and claim paperwork | Checks forms for missing administrative fields before a staff member lodges them | Clinical details and lodgement | Claim forms, invoices | Medium: forms differ by funder | | Account and invoice queries | Drafts replies to billing questions from the fee schedule and flags disputes | Write-offs and payment arrangements | Invoices, fee schedule | Low: bounded answers | | Complaint logging | Logs complaints, extracts dates and issues, drafts an acknowledgement for the practice manager | The response and any remedy | Complaint emails and letters | Medium: tone and sensitivity | | Recall and reminder drafting | Fills approved reminder templates from the recall list | Who is recalled and why | Recall lists from the practice system | Low: fixed wording | Three of these have worked guides: [routing appointment enquiries](/industries/healthcare-administration/appointment-enquiry-routing/), [administering referrals](/industries/healthcare-administration/referral-administration-workflow/) and [searching non-clinical policies](/industries/healthcare-administration/nonclinical-policy-search/). ## Health privacy rules and sector guidance that apply - **Health Information Privacy Code 2020.** The [HIPC](https://www.privacy.org.nz/privacy-principles/codes-of-practice/hipc2020/) "covers health information about identifiable individuals that is collected, used, held, and disclosed by health agencies" and takes the place of the information privacy principles for the health sector. It applies to providers such as PHOs and rest homes, and to bodies such as ACC and health insurers. Amendment No 2 (March 2026) reflects the new indirect-collection notice rule in force from 1 May 2026. - **Security is being enforced.** On 23 September 2026 the Privacy Commissioner [issued compliance notices](https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/) to Manage My Health and Health NZ for failing the security requirements of HIPC rule 5 at the time of the December 2025 cyber attack. Every AI vendor you add becomes another place health information sits. - **Health NZ's own rules.** Its [guidance on generative AI](https://www.healthnz.govt.nz/health-professionals/guidance-standards/topic/digital-technologies/using-generative-ai-and-large-language-models), updated in May 2026, says its expert advisory group recommends caution, and that employees and contractors must not enter patient or organisational information into unapproved tools or use them for clinical decisions or personalised advice. It also says Health NZ has no private LLMs available. These rules bind Health NZ staff and contractors; for other providers they are a clear signal of what the system expects. - **Medical Council.** Its [guidance on AI in patient care](https://www.mcnz.org.nz/assets/standards/Guidance-on-using-artificial-intelligence-AI-in-patient-care-March-2026.pdf), published 10 March 2026, says doctors must not use AI to impersonate themselves, including through chatbots. A reception assistant must never present as a clinician. - **Privacy impact assessment.** For health information in particular, run the [privacy impact assessment the Privacy Commissioner expects](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf) before go-live, and have a person check outputs before anyone acts on them. This is general information. Check obligations in your funding and PHO agreements and take privacy or legal advice before deploying. ## Practice systems and where AI connects Most providers run a practice management system such as Medtech Evolution or Indici, a patient portal such as ManageMyHealth, secure messaging for referrals and results, and Microsoft 365 for email and policies. AI should connect through approved integrations with logged access, not through staff copying messages into a chatbot. Data location needs a recorded decision: no major AI vendor offered guaranteed in-New Zealand processing as at October 2026, and the nearest option we know of is Amazon Bedrock's [AU profile](https://aws.amazon.com/blogs/machine-learning/run-generative-ai-inference-with-amazon-bedrock-in-asia-pacific-new-zealand/), which limits Claude processing to Australian and New Zealand regions. Our notes on [Microsoft 365](/integrations/microsoft-365/) and [data residency for AI systems](/engineering/data-residency-for-ai-systems/) go further. ## A first project: appointment enquiry routing with red-flag rules Routing is the right start because the AI sorts and drafts but decides nothing clinical, and the escalation rules can be tested before a single patient message is touched. - **Inputs**: Portal messages, emails and web form requests to the front desk. - **Systems**: The practice management system's appointment book, a classification model, and the shared inbox. - **Steps**: Each message is labelled admin or clinical. Clinical or uncertain messages go straight to the clinician queue with no AI reply. Admin requests get a drafted response and a suggested booking action. - **Human review**: Reception approves every draft. A clinician reviews a weekly sample of messages labelled admin to check none should have escalated. - **Outputs**: Routed messages, approved replies, and a log of every escalation. - **Measures**: Time to route, misroutes, and missed escalations, which must be zero. - **Risks**: Symptoms buried in admin requests, shared family email addresses, and messages in languages other than English. Illustrative example: a six-doctor practice receives about 150 portal messages and emails a day, and reception spends around 1.5 minutes reading and routing each, about 3.75 hours a day. If staff instead confirm AI routing in about 30 seconds per message, that falls to 75 minutes, saving roughly 2.5 hours a day. The saving only counts if the weekly clinician audit finds no missed escalations. Our [AI workflow automation](/services/ai-workflow-automation/) service builds this, and the lesson on [managing AI mistakes and escalation](/learn/managing-ai-mistakes-and-escalation/) covers the escalation design. ## Where AI fails in health administration - **Clinical drift.** "Can I move my appointment, the chest pain is worse" looks like a reschedule. Detection must err towards escalation, and any symptom, medication or distress cue goes to a clinician. - **Identity mismatch.** Two patients share a name and birth year, or a family shares one email. Match on several identifiers in the practice system and never merge records automatically. - **Outdated policies.** A confident answer from last year's leave policy causes real disputes. Index only current documents, with owners and review dates. - **Impersonation.** An assistant that signs off as "Dr" breaches the Medical Council's expectation. Name it as an automated admin assistant. - **Language and tone.** Messages in te reo Māori, Samoan or Mandarin, or from distressed patients, should go to a person rather than receive a machine reply. Policy questions about safe use are covered by our [AI governance](/services/ai-governance/) work, and [RAG development](/services/rag-development/) is how we build cited policy search. ## Questions people ask ### Can AI triage patients in a New Zealand general practice? Not clinically. Deciding how urgent a symptom is, or what a patient should do about it, is a clinical decision, and Health NZ's guidance tells its own staff not to use generative AI for clinical decisions or personalised advice. What AI can do is administrative routing: sort messages by type, send anything mentioning symptoms straight to a clinician's queue, and draft replies to purely administrative requests for staff to approve. ### Is appointment and booking data covered by the Health Information Privacy Code? Usually, yes. The Health Information Privacy Code 2020 covers health information about identifiable individuals collected, used, held or disclosed by health agencies. The reason for an appointment, a referral destination or a note that someone attends a particular clinic can all reveal health information, so treat the front-desk inbox with the same care as the clinical record when choosing and configuring AI tools. ### Can our reception team use ChatGPT to draft emails to patients? Not with patient details in a personal or unapproved account. Use a business plan whose terms exclude training on your inputs, record where data is processed, and complete a privacy impact assessment first, as the Privacy Commissioner expects. Health NZ's rules for its own employees and contractors go further and prohibit entering patient information into unapproved generative AI tools, which is a sensible benchmark for any provider. ### Does this guide cover AI scribes? No. Scribes record and summarise consultations, which is clinical documentation and a decision for clinicians. The Medical Council's March 2026 guidance says doctors need informed consent when using an AI tool to record a consultation. The Government reported in February 2026 that AI scribes were live in every emergency department. This page covers the administration around care, not care itself. ### Where should a health provider's AI system process data? As close to home as you can get, and somewhere you have recorded and approved. No major AI vendor offered guaranteed processing inside New Zealand as at October 2026; the closest available option is Amazon Bedrock's AU profile, which confines Claude processing to Australian and New Zealand regions. Whatever you choose, the provider's security becomes part of yours, as the Privacy Commissioner's 2026 compliance notices on health data security showed. ## Sources - [Health Information Privacy Code 2020](https://www.privacy.org.nz/privacy-principles/codes-of-practice/hipc2020/) - [Privacy Commissioner issues Compliance Notices to Manage My Health and Health NZ](https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/) - [Using generative AI and large language models](https://www.healthnz.govt.nz/health-professionals/guidance-standards/topic/digital-technologies/using-generative-ai-and-large-language-models) - [Guidance on using artificial intelligence (AI) in patient care](https://www.mcnz.org.nz/assets/standards/Guidance-on-using-artificial-intelligence-AI-in-patient-care-March-2026.pdf) - [AI scribe now in every emergency department](https://www.beehive.govt.nz/release/ai-scribe-now-every-emergency-department) - [Geographic units by industry and statistical area, 2000–2025](https://www.stats.govt.nz/assets/Uploads/New-Zealand-business-demography-statistics/New-Zealand-business-demography-statistics-At-February-2025/Download-data/geographic-units-by-industry-and-statistical-area-2000-2025-descending-order.zip) - [Artificial intelligence and the Information Privacy Principles](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf) - [Run generative AI inference with Amazon Bedrock in Asia Pacific (New Zealand)](https://aws.amazon.com/blogs/machine-learning/run-generative-ai-inference-with-amazon-bedrock-in-asia-pacific-new-zealand/) Published by Levy Street (https://levystreet.com), Wellington, New Zealand.