AI in South African private practice: what's safe under POPIA and the HPCSA

By Baselayer.med · Published 2 Oct 2026 · Updated 2 Oct 2026

AI is now built into everyday practice software: dictation that turns speech into notes, assistants that draft referral letters, tools that summarise a patient's history before a consult. Used well, it takes repetitive writing and admin off your plate. But healthcare runs on trust, and in South Africa there are now clear expectations about how practitioners use AI.

This guide covers what the HPCSA's AI guidelines and POPIA mean in practice, which uses are low-risk and which need more care, and the questions to ask any vendor before you switch AI on.

General information, not legal advice. Read the source documents linked below and take advice for your own practice.

What the HPCSA says about AI

In 2025 the HPCSA published *Ethical Guidelines on the Use of Artificial Intelligence* (Booklet 20), dated September 2025. In summary (see the booklet and this legal summary by Bowmans):

You stay accountable. AI can support documentation, triage and decision-making, but the practitioner makes the final clinical decision and remains responsible for it.
Tell patients. Patients should be informed when AI materially contributes to their care.
Use validated, appropriate tools. Choose tools that are reliable, validated and suitable for your patient population, and avoid unrecognised or unvalidated ones.
No disadvantage for saying no. Patients who decline AI-assisted care shouldn't be disadvantaged.
Ethics, law and technical assurance. The guidelines expect AI use to be ethical, compliant with law (including POPIA) and technically sound.

What POPIA means for AI tools

The Protection of Personal Information Act (POPIA) applies to AI just as it applies to any other software that touches patient information:

Health information is special personal information. Section 32 lets medical professionals and practices process it where necessary for treatment and care or practice administration, under a duty of confidentiality. It doesn't make every downstream use acceptable, so keep AI use tied to treatment and running the practice.
Your vendor is an "operator". If an AI tool processes patient information on your behalf, you need a written agreement requiring appropriate security measures (sections 20–21), and you need to be satisfied with those measures (section 19).
Know where the data goes. Many AI models run on servers outside South Africa. Section 72 restricts transfers of personal information across borders unless conditions are met, such as adequate protection in the recipient country, binding agreements, or consent. Ask your vendor exactly where audio, transcripts and prompts are processed and stored.
No decisions by machine alone. Section 71 limits decisions with legal or substantial effects on a person that are based solely on automated processing. A clinician reviewing and signing off AI output is the safe pattern.
Breaches. If patient information is compromised, including through an AI vendor, section 22 requires notification of the Information Regulator and affected patients.

Low-risk vs higher-risk uses

Lower risk (with review)	Needs more care
Dictating your own notes and having them transcribed	Recording the whole consultation (needs the patient's informed agreement)
Tidying grammar and structure of a note you wrote	AI suggesting diagnoses or treatment plans
Drafting referral or motivation letters from your notes	Anything sent to a patient without clinician review
Summarising a patient's existing record before a consult	Patient-facing chatbots giving health advice
Admin: task lists, reminders, scheduling	Tools that keep or train on your patient data

The rule of thumb: AI drafts, the practitioner decides and signs.

Practical safeguards for your practice

Write a one-page AI policy. List the tools you use, what they're used for, who may use them, and that all clinical output is reviewed before it's saved or sent.
Update your consent and privacy notice. Tell patients if you use AI dictation or transcription, and give them an easy way to opt out. If you record consultations, get explicit agreement each time.
Review every output. Check AI-generated notes, letters and summaries for errors and omissions before signing. You're signing your own clinical record.
Keep AI inside your practice system. Don't paste patient details into free consumer chatbots. Use tools that are part of your practice software and covered by your operator agreement.
Keep a record. Note in the clinical record when a note or letter was AI-assisted, if your professional body or the booklet requires it.
Train the team. Everyone using AI features should understand these limits.

Vendor checklist: questions to ask before switching on AI

Where are audio, transcripts and prompts processed and stored? Which country?
Which AI model or provider is used, and under what agreement?
Is any patient data used to train models? Can that be switched off?
Is audio deleted after transcription? When?
Is the AI output editable, and does a clinician have to approve it before it's saved?
Is there an operator agreement (DPA) covering the AI features?
How are access, encryption and breach notification handled?

Example: an AI-assisted consult, done safely

At booking, the patient receives your privacy notice, which explains that you use AI-assisted dictation and how to opt out.
During the consult you examine, discuss and decide as usual. If you want to record, you ask the patient and note their agreement.
Afterwards, you dictate a summary. The tool transcribes it and drafts a structured note.
You read the draft, correct anything wrong, add what's missing, and sign it. Only then is it saved to the record.
If a referral letter is needed, the AI drafts it from your signed note. You review it before it's sent from the practice system, not from a personal email.

At every step, the clinical judgement and the signature are yours.

How AI works in Baselayer.med

Baselayer.med uses AI to take writing off your plate, not to make clinical decisions:

[Dictate to transcribe](/solutions/dictate-to-transcribe): speak your notes or tasks and get accurate text you can edit.
[AI assistant](/solutions/ai-assistant): helps draft and polish clinical notes and letters from what you've written or dictated. You review, edit and sign.
[Telehealth](/solutions/telehealth): video consults, with the option to record the consultation with the patient's consent and generate a SOAP-structured note draft for your review.
Your data: patient records are stored in encrypted cloud storage under our DPA.

Everything AI produces is a draft until a practitioner accepts it.

Baselayer.med is an all-in-one practice platform built in South Africa for nine professions. Plans: Practice R2 499/month (unlimited users) and Solo R899/month (up to 2 users), with every feature included and a 30-day free trial.

Frequently asked questions

Is it legal to use AI for clinical notes in South Africa? Nothing in POPIA or the HPCSA guidelines bans AI-assisted documentation. The HPCSA expects the practitioner to stay accountable and to use validated tools, and POPIA requires security safeguards, an operator agreement and lawful cross-border transfers. Take advice for your specific setup.

Do I have to tell patients I use AI? The HPCSA's 2025 guidelines expect patients to be informed when AI materially contributes to their care, and patients who decline shouldn't be disadvantaged. Updating your privacy notice and consent forms is the simplest way to do this.

Can I record consultations for an AI scribe? Only with the patient's informed agreement. Explain what's recorded, why, where it's processed and how long it's kept, and record their agreement.

Can I paste patient information into ChatGPT or similar tools? Not safely. Consumer chatbots aren't covered by an operator agreement with your practice, and you can't control where the data goes. Use AI that's built into your practice software under a DPA.

Who is responsible if the AI makes a mistake? The practitioner. The HPCSA guidelines are clear that AI supports, but doesn't replace, clinical judgement. Review every output before you sign it.