A New Zealand clinic can use an AI receptionist for the administrative side of the phone: hours, location, fees, appointment requests, cancellations and messages. It must never give clinical advice, triage symptoms or discuss results, and it needs a fixed instruction to send urgent callers to 111. Because almost everything a patient says on the phone is health information, the clinic also has to meet the Health Information Privacy Code 2020 for every recording and transcript. This guide covers both halves. It is general information, not legal advice.
Calls it can handle, and calls it must not
| Suitable for an AI receptionist | Not suitable: take a message or transfer |
|---|---|
| Opening hours, address, parking, public holiday hours | Any question about symptoms, medicines or what to do next |
| Fees, enrolment and what to bring to a first appointment | Test results |
| Appointment requests, reschedules and cancellations | Deciding how urgent something is |
| Messages for a named clinician or the practice manager | Repeat prescription decisions (it can take the request as a message) |
| After-hours calls, with your after-hours instructions | Anything involving a distressed caller, where a person should take over |
| Overflow when the front desk is on another call | Confirming whether someone is a patient to a third party |
The dividing line is simple. If the answer would be the same for every caller, the AI can give it. If the answer depends on the caller's health, a person gives it.
The safety instruction comes first
Before anything else goes into the knowledge base, write the urgent-call rule. The agent should be told that if a caller describes anything that sounds urgent, it stops, tells them to hang up and ring 111, and does not ask further questions. For non-urgent health questions it can give the Healthline number. Healthline is free on 0800 611 116, 24 hours a day, 7 days a week, and is staffed by nurses and paramedics. It should also say, in your greeting or early in the call, that it is an AI assistant and cannot give medical advice. Test this rule more than any other before going live.
Does the Health Information Privacy Code apply to your clinic?
Almost certainly. The Health Information Privacy Code 2020 is issued by the Privacy Commissioner and takes the place of the general privacy principles for the health sector. Clause 4(2)(a) applies it to "an agency which provides health or disability support services". The Commissioner's summary says it applies to all agencies providing personal or public health or disability services, and names doctors, nurses, dentists, pharmacists and optometrists as examples. If you provide health services to individuals, assume it applies to you.
The definition of health information is wider than many clinics expect. Under clause 4(1) it includes information about a person's health and medical history, information about health services being provided to them, and information "collected before or in the course of, and incidental to, the provision of any health service". A caller's name, number and "I need to see someone about my knee" is health information from the moment the agent hears it. So is the recording, and so is the transcript.
The rules that matter when an AI answers the phone
The full text of the code has 13 rules plus rule 3A. These five do most of the work for a phone agent.
Rule 1: collect only what you need
Health information must be collected for a lawful purpose connected with what the clinic does, and the collection must be "necessary for that purpose". For a booking request that usually means a name, a callback number and the type of appointment. Do not script the agent to ask for a date of birth, an NHI number or a description of symptoms unless you truly need them at that point. Callers will volunteer more than you ask for, which is a good reason to keep retention short.
Rule 3: tell callers what is happening
When you collect health information from a person you must take reasonable steps to make sure they know it is being collected, why, who will receive it, and that they can access and correct it. In practice: the greeting says the caller is speaking to an AI assistant and that the call is recorded, and your privacy statement explains the rest. Our guide to call recording law in NZ covers the recording notice. From 1 May 2026, rule 3A adds similar duties when you collect information about someone from another person, such as a parent ringing about an adult child.
Rule 5: security, including your service providers
You must protect health information with "such security safeguards as are reasonable in the circumstances". Rule 5(1)(b) speaks directly to outsourcing: if information has to be given to someone providing a service to you, including "storing, processing, or destruction", you must do "everything reasonably within the power of the health agency" to prevent unauthorised use or disclosure. For an AI receptionist that means knowing which companies process the audio and text, having written terms with your provider, limiting dashboard logins to staff who need them, and removing access when someone leaves.
Rule 9: do not keep it longer than you need
Health information must not be kept longer than required for the purposes it may lawfully be used for. A recording of a booking request has done its job once the appointment is in your system. Rule 9 does not stop you keeping clinical records, but a phone transcript is not your clinical record. Choose a retention period on purpose, and delete earlier when you can.
Rule 12: information going overseas
Rule 12 limits when health information may be disclosed to a foreign person or entity. The grounds include the individual's authorisation after being expressly told the recipient may not offer comparable protection, the recipient being subject to comparable privacy laws, or the clinic believing on reasonable grounds that the recipient must protect the information comparably, "for example, pursuant to an agreement". Most speech recognition, voice and language model providers process data in the United States. Whether using them counts as a disclosure or as processing on your behalf depends on the arrangement, which is a question for your privacy officer or lawyer. Either way you need to know where the data goes and what the contracts say. Our Privacy Act guide explains the general version of this rule.
A setup checklist for clinics
- Write the urgent-call rule and the "no medical advice" line first, and test them.
- Put the AI disclosure and recording notice in the greeting. Our greeting scripts include a health example.
- Limit what the agent asks for: name, callback number, appointment type, preferred times.
- Tell it never to confirm to anyone that a named person is a patient.
- Set the shortest retention that works, and decide who deletes records and when.
- Give dashboard access only to staff who handle calls.
- Update your privacy statement to mention AI call handling, recording and overseas processing.
- Do a short privacy impact assessment: what is collected, where it goes, who sees it, how long it is kept, what could go wrong.
- Start with after-hours and overflow calls, not the whole front desk.
Questions to put to any AI receptionist provider
- Which companies process call audio and transcripts, and in which countries?
- What do your contracts with them say about protecting and not reusing our data?
- How long are recordings and transcripts kept, and can we delete individual calls?
- Can recording be turned off while keeping the written summary?
- Who at your company can access our calls, and is that access logged?
- Does it connect to our practice management system, or does it take messages only?
- What does the agent do when a caller describes an emergency?
Where KiwiAgent stands
Here are our own answers, including the ones that may rule us out.
- Processors. Calls are carried by Twilio, transcribed by Deepgram, voiced by ElevenLabs and understood by language models from OpenAI and Anthropic. Most of that processing happens outside New Zealand, mainly in the United States, under contractual data protection terms. Details are in our privacy policy. If your clinic's policy is that patient information must stay in New Zealand, that rules out any service that relies on overseas speech and language providers, and today that includes ours. Ask every vendor the same question.
- Retention. Recordings and transcripts are kept for 30 days on Starter and 90 days on Pro, and until you delete them on Business. You can delete any call earlier at any time.
- Practice management systems. KiwiAgent has no built-in connection to systems such as Medtech, Indici or Cliniko. It takes appointment requests and messages for your team to action. It can book directly only into a calendar you connect.
- Not a medical device. KiwiAgent is a general business phone agent. It is not designed for triage or clinical use and should not be set up to do either.
- Transfers. You set which calls are transferred to a person and what happens when nobody picks up.
Next step
If the fit looks right for your after-hours or overflow calls, talk to the demo agent to hear how it sounds, then tell us about your clinic. We will set up a free pilot with the urgent-call rule, greeting and minimal collection already in place, and send you written answers to the provider questions above for your privacy records.