Hope Psychology | Clinical Care Auckland

AI Policy

Version: 1.0 Author: Hope Psychology Approved by: Clinical Lead Effective date: 21 August 2025 Next review: 21 August 2026

1. Purpose

This policy establishes Hope Psychology’s requirements, safeguards, responsibilities, and procedures for the ethical, lawful, and clinically appropriate use of artificial intelligence (AI) systems and tools in the provision of psychological services. The policy ensures that use of AI supports clinical care while protecting client privacy, confidentiality, and dignity, and complies with relevant New Zealand law and professional standards as well as internationally recognised good practice.

Key commitments:

  • AI will be used only as a clinical support tool, not as a replacement for clinician judgement or therapeutic relationship.
  • Client privacy and confidentiality will be prioritised in all AI uses.
  • Clients will be informed and will provide consent for AI uses that involve their personal or health information.

(See legal and regulatory context in Section 12.) New Zealand Legislation; privacy.org.nz 2. Scope

This policy applies to:

  • All clinicians, administrative staff, contractors, interns, and students using Hope Psychology systems or third-party services.
  • All AI systems, including but not limited to: automatic speech-to-text transcription services, large language models (LLMs), decision support tools, clinical note generators, analytics platforms, and third-party AI-enabled products used in clinical, administrative, research, training, or quality improvement activities.
  • All client data (personal and health information) processed by AI tools, whether stored on-premises or in the cloud, and whether processed within New Zealand or offshore.

3. Definitions

  • AI system / AI tool: Any software, model, algorithm, or service that uses machine learning, natural language processing, pattern recognition, or related techniques to generate outputs or assist decision making.
  • Transcription service: An AI or hybrid human/AI service that converts audio of sessions into text.
  • Personal information/ health information: Information that identifies or is reasonably capable of identifying an individual, including mental health and clinical notes. In New Zealand this is regulated by the Privacy Act 2020 and the Health Information Privacy Code 2020. New Zealand Legislation; privacy.org.nz

4. Governance and accountability

4.1. Executive oversight Hope Psychology will designate an AI Governance Lead (could be the practice manager or a nominated clinician) responsible for:

  • Oversight of AI procurement and deployment decisions.
  • Maintaining the AI inventory and risk register.
  • Ensuring that privacy impact assessments are completed.
  • Reporting to the Clinical Lead on AI risks and performance.

4.2. AI use authorisation No AI system that processes client health information may be used for clinical or administrative purposes until:

  • A documented Privacy Impact Assessment (PIA) / Data Protection Impact Assessment (DPIA) has been completed and approved.
  • A vendor security and privacy assessment and contract (including data processing agreement) is in place where a third party is involved.
  • Clients have been provided with information and given consent where required (see Section 6).

Regulatory and professional obligations must be confirmed prior to deployment. privacy.org.nz; Ministry of Health NZ

5. Risk assessment and validation

5.1. Risk classification Classify each AI use-case by potential harm (low, medium, high). Examples:

  • Low risk: administrative summaries that contain no client identifiers.
  • Medium risk: automated anonymised analytics for quality improvement.
  • High risk: clinical decision support, diagnostic suggestions, or transcription containing identifiable clinical content.

5.2. Validation Before clinical deployment, AI systems must be validated for:

  • Accuracy and reliability for the intended use-case.
  • Known limitations and failure modes.
  • Potential for bias or differential performance across demographic groups. Clinical staff must pilot the tool in a controlled setting, document results, and retain responsibility for final clinical decisions. Guidance from New Zealand health authorities advises caution and validation before clinical use. nzmii.co.nz; PubMed Central

6. Informed consent and client information

6.1. Transparency Clients must be told, in clear language, when AI will be used in relation to their care, including:

  • The types of AI used (for example: “speech-to-text transcription”, “note-assist LLM”).
  • What data will be processed, how it will be used, stored, and for how long.
  • Whether data will leave New Zealand or be processed by third parties.
  • The client’s rights to access, correction, and withdrawal of consent where possible.

6.2. Consent process

  • Obtain written informed consent for high- and medium-risk AI uses (for example transcribing session audio or using clinical decision support) prior to first use. Low-risk administrative uses may be covered by general privacy notices but must still be documented.
  • Consent must be specific, informed, and voluntary. Clients must be given the option to decline AI-assisted transcription or other AI uses without detriment to care.
  • Clinicians must record consent decisions in the client record.

6.3. Sample consent wording (to adapt) “I understand that Hope Psychology may use a secure AI-based transcription service to convert audio of sessions into text to help clinical formulation and treatment planning. The transcript will be stored securely and will not be shared outside Hope Psychology except as described in this form. I understand risks include potential errors in transcription and, where third parties process data offshore, possible cross-border data transfer risks. I consent/ do not consent to the use of AI transcription for my sessions.” (See Appendix A for a full template.)

These steps align with the Privacy Act 2020 and Health Information Privacy Code requirements for collection, use and disclosure of health information. New Zealand Legislation; privacy.org.nz

7. Privacy, confidentiality, and data protection

7.1. Minimum necessary and purpose limitation

  • Only data necessary for the specific, documented clinical or administrative purpose shall be processed by AI. Re-use for other purposes must be lawful and documented. New Zealand Legislation

7.2. De-identification and anonymisation

  • If transcripts or outputs are used for research, training, audit, or supervision, they must be de-identified to a standard that prevents re-identification, unless the client has given explicit written consent to identifiable use.

7.3. Cross-border transfers

  • If any AI vendor or processing takes place offshore, Hope Psychology must ensure transfer is lawful and secure. Clients must be informed that their data may be processed overseas, and the practice must assess safeguards. The Health Information Privacy Code includes rules for disclosure of health information outside New Zealand. privacy.org.nz; flexiblelearning.auckland.ac.nz

7.4. Data retention and deletion

  • Transcripts, model outputs, and intermediate data are part of the client record and shall be retained in accordance with clinical record retention policies and legal obligations.
  • Deletion requests will be handled in line with legal rights and clinical safety considerations, balancing the right to erasure with obligations to retain health records for continuity of care.

7.5. Access control and logging

  • Access to AI-processed data will follow least-privilege principles; role-based access controls must be enforced.
  • All access, export, or sharing of AI outputs must be logged and auditable.

 7.6. Encryption and security

  • Data in transit and at rest must be encrypted to industry standard. Vendors must support secure APIs and authentication. Security controls must be documented and tested.

8. Use of transcription services (specific)

8.1. When transcription may be used

  • For clinical formulation, documentation, clinical supervision (with consent), quality improvement, and clinician professional development. Transcriptions must be treated as health information.

8.2. Provider selection and contracting

  • Use only vendors that meet security, privacy, and regulatory requirements. Contracts must specify:
  1. That the vendor is a data processor only and will not claim ownership of client data.
  2. Prohibition on the vendor using client data to train their models unless explicit, informed client consent and contract terms permit it.
  3. Security measures, breach notification timelines, and audit rights.

8.3. Hybrid human review

  • If the vendor uses human review for transcription accuracy, the practice must ensure human reviewers are bound by confidentiality, have appropriate background checks, and that clients have been informed and consented.

8.4. Quality control

  • Clinicians must review transcripts for accuracy and correct any errors before relying on them for clinical decisions or formal documentation.

8.5. Avoiding over-reliance

  • Clinicians retain full clinical responsibility and must not rely solely on AI transcripts or AI-generated summaries for clinical judgement.

Te Whatu Ora and other New Zealand health authorities advise caution and validation for AI and LLM tools in clinical contexts; transcription services must be validated and their limitations disclosed. nzmii.co.nz; privacy.org.nz

9. Clinical decision support and treatment planning

9.1. Assistive role

  • AI outputs may be used to assist clinicians in formulation, to suggest treatment options, or to summarise themes, but clinicians must exercise independent professional judgement and document clinical decisions.

9.2. No autonomous clinical decisions

  • AI must not be used to make autonomous diagnostic or treatment decisions without clinician review and consent where appropriate.

9.3. Documentation

  • When AI materially influences formulation or treatment planning, clinicians must note:
  1. Which AI tool(s) were used and for what purpose.
  2. The clinician’s assessment of the AI output and how it was used in decision making.

10. Education, competence, and training

10.1. Staff training

  • All staff using AI tools must receive training on:
  1. The tool’s intended use and limitations.
  2. Privacy and data security requirements.
  3. How to validate and interpret outputs.
  4. Incident reporting procedures.

10.2. Competence requirements

  • Use of AI in clinical practice is an extension of professional competence obligations. Psychologists must maintain competence in technology use as part of their continuing professional development and meet standards set by regulatory bodies. New Zealand Psychologists Board

11. Supervision, audit and quality assurance

11.1. Supervision

  • Supervisors must ensure supervisees using AI tools understand ethical and privacy obligations and that clinical judgement takes precedence.

11.2. Audits

  • Regular audits will be conducted on AI use, data flows, access logs, vendor compliance, and incident records. Audit results and remedial actions will be documented.

11.3. Reporting

  • Any adverse events, privacy breaches, or near-misses involving AI must be reported immediately to the AI Governance Lead and logged; serious breaches will be reported to the Office of the Privacy Commissioner and other regulators as required. New Zealand Legislation

12. Legal and regulatory context (New Zealand)

The following sources inform this policy and must be considered in practice:

  • Privacy Act 2020: Governs collection, use, disclosure, storage, and retention of personal information; requires agencies to apply IPPs and consider purpose limitation and data minimisation. New Zealand Legislation
  • Health Information Privacy Code 2020: Sets rules specific to health information handling and includes requirements for disclosure outside New Zealand. privacy.org.nz
  • Privacy Commissioner guidance on AI: The Privacy Commissioner has stated the Privacy Act applies to AI use and recommends PIAs, transparency, and risk assessment before deployment. privacy.org.nz
  • Te Whatu Ora / sector advice: New Zealand health sector organisations caution that current LLMs/AI tools are not validated for clinical decision making and outline risks including privacy and inaccuracy. Hope Psychology will align with such advice before deploying clinical AI tools. nzmii.co.nz
  • Professional standards: Psychologists must comply with the NZ Psychologists Board competencies and relevant Codes of Ethics and professional body guidance. New Zealand Psychologists Board; psychology.org.nz

These are not exhaustive of all obligations. Hope Psychology will monitor law and guidance changes and update practice accordingly.

13. Incident response and breach handling

13.1. Immediate action

  • On suspicion or confirmation of a privacy breach involving AI tools, immediately:
  1. Contain the breach (revoke access, suspend service where feasible).
  2. Notify the AI Governance Lead and Clinical Lead.
  3. Conduct an initial assessment of scope and impact.

13.2. Notification

  • Notify affected clients where there is a real risk of harm and report to the Office of the Privacy Commissioner as required by law. Document all steps taken. New Zealand Legislation

13.3. Remediation and review

  • Implement corrective actions, remediate security gaps, and review contracts and controls with the vendor. Undertake a post-incident review and update policies as required.

14. Vendor selection and contracting checklist

Before engaging any third-party AI provider:

  • Verify vendor security certifications and practices (encryption, SOC2 or equivalent where available).
  • Confirm data processing agreement prohibits vendor use of Hope Psychology client data to “train” models unless explicitly authorised by contract and by client consent.
  • Require clear breach notification clauses and short notification timelines.
  • Confirm data residency, export controls, and lawful cross-border transfer mechanisms.
  • Clarify human reviewer access policies and confidentiality obligations.
  • Reserve audit rights or require third-party attestation of controls.
  • Document retention and deletion procedures and ability to export client data in usable form.

15. Research, teaching and secondary uses

  • Use of AI-processed material for research or training requires separate ethics approval where needed and explicit client consent for identifiable information. De-identified data may be used after robust re-identification risk assessment. Professional guidance on using clinical material in teaching must be followed. New Zealand Nurses Organisation; Ministry of Health NZ

16. Records and documentation

Maintain clear records of:

  • AI tool inventory and approved use-cases.
  • PIAs / DPIAs, validation reports, vendor assessments, and contracts.
  • Client consent records specific to AI use.
  • Access logs, audit results, incidents and remediation records.
  • Training records for staff using AI.

17. Limitations and disclaimers

  • AI outputs may be incorrect, biased, or incomplete. Clinicians must not delegate final clinical decisions to AI.
  • Use of third-party AI may incur risks of inadvertent data exposure; the practice will minimise those risks but cannot guarantee zero risk. Clients must be informed.

18. Review and continuous improvement

  • This policy will be reviewed annually or earlier if:
  • There are changes in law or regulatory guidance.
  • Hope Psychology adopts new AI capabilities.
  • A significant incident or audit indicates the need for change.

19. Responsibilities summary

  • AI Governance Lead: Maintain AI inventory, approvals, PIAs, vendor oversight.
  • Clinical Lead: Clinical oversight of AI uses; approval of clinical deployments.
  • Clinicians: Obtain informed consent, validate AI outputs, document use and decisions.
  • Practice Manager / IT: Maintain security controls, access management, backups, and vendor contracting.
  • All staff: Complete training and report incidents.

20. Appendices (summaries; full templates available on request)

Appendix A — Sample client informed consent for AI transcription (adapt and include practice contact details). Appendix B — Vendor assessment checklist (security, human review, data use, export). Appendix C — PIA / DPIA template (risk matrix, mitigation actions). Appendix D — Audit log format (timestamp, user, action, dataset accessed).

21. References (key guidance and legislation consulted)

flexiblelearning.auckland.ac.nz - Health Information Privacy Code (2020).

Ministry of Health NZ - Data protection and privacy.

New Zealand Legislation - Privacy Act 2020 (New Zealand).

New Zealand Nurses Organisation - Guideline: Privacy, Confidentiality and Consent in Professional Development Activities, 2025.

New Zealand Psychologists Board - New Zealand Psychologists Board — Core competencies and Code of Ethics.

nzmii.co.nz - Te Whatu Ora / sector advice on AI use in healthcare.

privacy.org.nz/Privacy-Act-2020 - Health Information Privacy Code 2020 (New Zealand).

privacy.org.nz/resources-and-learning - Office of the Privacy Commissioner — Artificial Intelligence guidance.

psychology.org.nz - Code of Ethics.

PubMed Central - An example of governance for AI in health services from Aotearoa New Zealand.