Any chat box on a healthcare website will eventually receive a message like, "I've had chest pain since this morning, should I come in?" It does not matter whether the chatbot was built to handle that. Patients type what worries them. That is why, at Bolder Digital, we start every healthcare chatbot project with the rules, and only then talk about features.

Let me walk you through what Australian regulation actually allows, where the real risks sit, and what a healthcare chatbot can do well inside those boundaries. This is general information based on published guidance, not legal advice. Any practice should confirm its own obligations with a health law professional.

The Question That Decides Everything: What Is the Chatbot Intended to Do?

The Therapeutic Goods Administration regulates software according to its intended purpose, not the technology behind it. A chatbot that provides diagnostic or treatment recommendations can be regulated as a medical device. TGA guidance on AI based software has also pointed to chatbots that apply clinical triage protocols as an example of the kind of tool that can be caught. A regulated device must be included on the Australian Register of Therapeutic Goods before it is supplied, unless an exclusion or exemption applies.

Calling a tool "general information" does not protect it if its documentation and marketing show it is meant to support clinical decisions. Symptom checkers are a common example.

Administrative software sits on the other side of the line. AI used for scheduling, billing, and similar tasks is generally unlikely to be regulated as a medical device, because it is not making clinical recommendations. That single distinction should shape the whole design of a practice chatbot. Keep it administrative in its build, its scripts, and how it is described.

What a Healthcare Chatbot Can Do Well

Inside that boundary, there is a lot of genuinely useful work.

• Booking, rescheduling, and cancelling appointments.

• Answering non clinical questions such as opening hours, location, parking, fees, bulk billing policy, what to bring, and whether a referral is needed.

• Capturing contact details and routing an enquiry to the right person on your team.

• Giving after hours information, including how to reach emergency services.

• Handing a conversation to a staff member whenever a patient asks or needs one.

These are the questions that clog a front desk, and none of them need clinical judgement.

What It Must Never Do

A chatbot should not assess symptoms, reassure a worried patient, interpret results, suggest a treatment or medication, or decide how urgent something is. Those are clinical activities. They are also exactly the features that risk tipping a tool into regulated territory.

The harder part is that patients will describe symptoms anyway. A properly built chatbot recognises this and does not try to help clinically. It responds with fixed wording the practice has approved in advance. For an emergency, call 000. For a mental health crisis, immediate crisis support such as Lifeline on 13 11 14, and a handoff to staff. Otherwise, an offer to book or connect them with the team. This wording should be written and approved by the practice, not generated freely on the spot.

Your Chatbot Is Part of Your Advertising

This one catches practices out. AHPRA's advertising rules under section 133 of the National Law apply to any person or business advertising a regulated health service, and advertisers are responsible for content produced on their behalf. AHPRA treats content promoting a regulated health service as advertising across channels, so it is safest to treat what your chatbot says about your services the same way.

That means no testimonials, which AHPRA defines as recommendations or positive statements about the clinical aspects of a service. It also means no claims that create an unreasonable expectation of beneficial treatment, no unsupported superlatives, and any discount or offer must state its terms.

In practice, the chatbot should answer only from content the practice has approved. It should not quote patient reviews about clinical outcomes, promise results, or describe the practice as the best at anything it cannot substantiate. AHPRA has also made clear that practitioners remain responsible for any AI they use, must apply human judgement, and should understand a tool's intended use and limits. A call to your indemnity insurer is worth making as well.

Health Information in a Chat Is Sensitive Information

Health service providers are covered by the Privacy Act regardless of turnover, so the small business exemption that applies to many other industries does not help here. Health information is sensitive information under the Act, which carries a higher standard of care, including consent requirements for collection. Chat transcripts containing it are personal information you are responsible for protecting, keeping only as long as needed, and giving patients access to on request. Private sector health service providers are also covered by the Notifiable Data Breaches scheme, so where a chat vendor stores your transcripts matters.

Three practical habits follow.

• Collect only what is needed to make a booking.

• Tell patients not to share clinical details in chat.

• Ask any provider where transcripts are stored and processed, whether that is overseas, and whether conversations are used to train models.

From 10 December 2026, new automated decision making transparency rules under the Privacy Act may also require privacy policy updates for some uses of AI, so it is worth checking how they apply.

Tell Patients They Are Talking to an AI

OAIC guidance stresses that public facing AI tools such as chatbots should be clearly identified as AI, and AHPRA's guidance highlights transparency as a principle for practitioners using AI. A short, plain opening line does the job, together with an obvious way to reach a real person at any point. Honesty at the start builds the trust the rest of the conversation depends on.

How Bolder Digital Builds Healthcare Chatbots

Our approach to a healthcare chatbot starts with scope. We build it for administrative work only, on approved content, with fixed emergency and crisis wording and a clear handoff to your team. Before it speaks to a real patient, we test it against the awkward scenarios. These include a patient typing a symptom, asking for medication advice, or asking whether a result is normal. After launch, we review real conversations to catch anything it is struggling with.

You can see how this fits into ourAI Chatbot service. We would still always recommend that the practice confirms its specific obligations with a health law professional and its indemnity insurer, particularly before adding any feature that goes near clinical territory.

The Bottom Line

A healthcare chatbot can genuinely lighten the load on a front desk, answering routine questions and handling bookings around the clock. What makes it safe is deliberate design:

• Keep it administrative.

• Keep the emergency wording fixed.

• Treat its replies as advertising.

• Treat its transcripts as sensitive information.

• Be honest that it is an AI.

Get those right and the chatbot supports your team. Skip them and the risk lands on the practice, not the software. That is the standard we hold every Bolder Digital healthcare chatbot to.

Frequently Asked Questions

Can a healthcare chatbot tell a patient what is wrong with them?
It should not. A chatbot that provides diagnostic or treatment recommendations can be regulated as a medical device by the TGA and must be included on the ARTG before supply unless an exclusion or exemption applies. Administrative chatbots for booking and general information are generally unlikely to be regulated.

Does a chatbot on my practice website count as advertising under AHPRA rules?
It is safest to assume yes. The advertising rules apply to any person or business advertising a regulated health service, and advertisers are responsible for content produced on their behalf. That means no testimonials about clinical aspects, no unreasonable expectations of treatment, and no misleading claims in what the chatbot says.

Is patient information typed into a chatbot covered by the Privacy Act?
For health service providers, yes, regardless of turnover. Health information is sensitive information, so chat transcripts containing it need appropriate security, retention limits, and patient access. Health service providers are also covered by the Notifiable Data Breaches scheme.

What should a healthcare chatbot do if a patient describes an emergency?
It should not attempt to assess it. It should respond with pre approved wording directing the patient to call 000, or to crisis support in a mental health situation, and hand the conversation to staff where appropriate.

How does Bolder Digital approach healthcare chatbots?
We keep the chatbot on the administrative side, build it on approved content with fixed emergency wording, connect it to a clear human handoff, and test it against difficult scenarios before launch. Practices should still confirm their own obligations with a health law professional.

Jarryd Holmes, Founder & Owner, Bolder Digital | Prospect Vale, Tasmania |bolderdigital.com.au