Short answer
AI nonclinical policy search is a workflow where health sector staff ask plain-language questions about administrative policies, such as leave, rostering, privacy procedures, procurement, IT use and complaints handling, and get an answer quoting the current policy clause with its version. Clinical guidelines are excluded from the index by design. In New Zealand, staff must not paste patient information into it, and HR still confirms individual entitlements.
- Only documents a controller has tagged non-clinical and current are indexed.
- Every answer quotes the clause, document version and owner; no source, no answer.
- Clinical questions get a refusal and a pointer to the clinical guideline system.
- Block patient identifiers in questions; the tool is not approved for health information.
What nonclinical policy search covers
AI nonclinical policy search lets staff ask “Can I carry over annual leave into next year?” or “What do I do if I email a patient letter to the wrong address?” and get the answer from the organisation’s current policy, quoted with its clause, version and owner. Health organisations hold hundreds of such documents. Many were inherited: the Health Information Privacy Code page notes that district health boards were disestablished in the Pae Ora reforms, and plenty of providers still carry policy sets from before and after that change.
The search is only as good as its scope, so the first decision is what goes in.
| Document class | In the index | Why |
|---|---|---|
| HR, leave, rostering, code of conduct | Yes | High question volume, low clinical risk |
| Privacy and information security procedures | Yes | Staff need fast, correct answers on breaches |
| Procurement, travel, delegations, facilities | Yes | Rules people forget between uses |
| Complaints process (administrative steps) | Yes | Process only, not clinical review of complaints |
| Clinical guidelines, protocols, medication policies | No | Clinical governance and clinical systems |
| Investigation files, personnel records | No | Restricted personal information |
How the workflow runs
- Inputs
- The approved policy register with owners, versions and review dates; current policy documents; and staff questions from the intranet or Teams.
- Systems
- SharePoint or the document management system as the source of truth, a private search index restricted to tagged documents, a model API, and single sign-on so answers respect who is asking.
- Steps
- Ingest only documents tagged non-clinical and current; split by clause; screen each question for patient identifiers and clinical content; retrieve; answer only from retrieved clauses with quotes; refuse and redirect when nothing matches or the question is clinical; log question, sources and answer.
- Human review
- The document controller approves what enters the index. Policy owners review a monthly sample of answers in their area and every answer marked wrong. HR and payroll answer anything about an individual.
- Outputs
- Cited answers, refusals with a named contact, and a monthly report of unanswered questions and conflicting policies.
- Measures
- Correct answers on a fixed test set, answers marked wrong, refusal rate, questions to HR inboxes, and policies past review date.
- Risks
- Superseded policies, conflicting documents, clinical drift, patient details in questions, and over-broad permissions.
NZ rules and guidance that set the boundaries
Health NZ tells its staff not to put personal, confidential or sensitive patient information into unapproved generative AI tools, and not to use them for clinical decisions. Even outside Health NZ, that is the right default. This tool is approved for policy questions, not patient information, so questions are screened for names, NHI numbers and dates of birth and blocked with an explanation. If patient information did reach it, the Health Information Privacy Code 2020 would apply, including rule 5 on security safeguards.
Where the data sits matters for procurement. New Zealand is a Microsoft 365 local data storage region, but Microsoft’s plan for in-country Copilot processing, updated April 2026, does not list New Zealand. Record where each option processes questions.
Illustrative example: a 250-staff primary care network
Illustrative example, synthetic numbers: a network with 420 policy documents receives about 300 policy questions a month in HR and quality inboxes. Assumptions: answering one takes 10 minutes of searching and replying; after launch, 60% are answered with a citation and no follow-up; the clean-up retires a third of documents as duplicates or superseded.
- Staff time: 180 questions x 10 minutes = 30 hours a month back for HR and quality.
- Clean-up: about 140 documents retired or merged before launch, which helps everyone, with or without AI.
- Model fees: 300 questions at 15,000 input and 400 output tokens on OpenAI’s gpt-6.1-sol, at US$2 and US$10 per million tokens (OpenAI, as listed on 19 October 2026), is about US$10 a month.
What stays with people
HR and payroll decide individual entitlements and employment matters. Policy owners decide what policies say and resolve conflicts. The privacy officer handles actual privacy incidents; the tool only explains the procedure. Clinical leads own anything clinical.
Where policy search goes wrong
- Old versions. A 2019 policy in a shared folder outranks the 2025 version. Index from the register, not the folder.
- Conflicts. Two current policies disagree after a merger. Show both, flag the conflict, and report it to the owners.
- Citation theatre. An answer cites a clause that does not support it. Sample-check citations against answers; see checking AI answers against sources.
- Permission leaks. Restricted documents indexed for everyone. Respect source permissions, as covered in building private AI search.
This is a RAG development job, and our SharePoint guide covers the source side. Related workflows are appointment enquiry routing and referral administration; see the healthcare administration overview.
Sources
- Using generative AI and large language models, Health New Zealand | Te Whatu Ora, accessed 19 October 2026
- Health Information Privacy Code 2020, Office of the Privacy Commissioner, accessed 19 October 2026
- Data location for Microsoft 365, Microsoft Learn, 8 October 2026
- Microsoft offers in-country data processing to 15 countries for Microsoft 365 Copilot, Microsoft, updated 3 April 2026
- API pricing, OpenAI, accessed 19 October 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.