What questions should I ask a vendor before buying a healthcare AI chatbot?

Ask whether it ever gives clinical or medical advice (it shouldn't), how it handles crisis or self-harm language, where patient conversation data is stored, whether that data is used to train AI models (it shouldn't be), whether it integrates with your practice management software, and whether a Data Processing Agreement is available.

Should a healthcare AI chatbot ever give medical advice?

No. A healthcare AI chatbot should stick to practice-level questions - fees, hours, services, booking - and escalate anything clinical to a real staff member. One that answers clinical questions directly is a liability, not a feature.

What happens if the chatbot can't answer a question?

It should say so and escalate, rather than guessing or making something up. Good implementations collect the patient's contact details and flag the conversation for staff to follow up, so no enquiry is silently lost.

Does the chatbot need to integrate with my practice management software?

It depends how much of the booking process you want automated. A chatbot that only answers questions works fine standalone, but if you want it creating or confirming appointments, it needs a real integration with your specific system (like Cliniko or Zanda), not just a generic booking link.

Is patient data used to train AI models?

It shouldn't be, and this is worth confirming explicitly with any vendor. Conversations should be used only to answer that patient in the moment, never fed back into training a model that could surface details elsewhere.

What data protection agreements should a healthcare AI chatbot vendor offer?

At minimum, a clear Privacy Policy and Terms of Service, and ideally a Data Processing Agreement (DPA) available on request for practices in regulated industries - this sets out exactly how patient-adjacent data is handled, stored, and protected.

How do I check AHPRA compliance for a chatbot?

Look for whether it avoids unsubstantiated health claims, never promises clinical outcomes, and never gives advice beyond what the practice's own published content covers. Ask the vendor directly how the system is designed to stay within AHPRA's advertising guidelines.

What to Look for in a Healthcare AI Chatbot

Before buying a healthcare AI chatbot, check that it never gives clinical advice, recognises and escalates crisis language properly, keeps patient conversation data out of AI training, integrates with your actual practice management system rather than a generic booking link, and stays within AHPRA's advertising guidelines. Below is what to check for each of those, and why it matters.

The checklist

Never gives clinical or medical advice - answers practice questions, escalates the rest
Recognises crisis or self-harm language and responds with real support resources immediately
Doesn't use patient conversations to train AI models
Doesn't read your existing patient records - only sees what's typed into the chat
Integrates with your actual practice management system, not just a generic form
Never implies a human has joined the chat when it hasn't
Offers a Data Processing Agreement on request
Stores data in a jurisdiction you're comfortable with

Clinical boundaries come first

The single most important thing to verify is that the chatbot won't diagnose, recommend treatment, or make clinical claims - even when a patient pushes for one. A chatbot that confidently answers "should I be worried about this symptom" is a liability, not a feature. The right behaviour is to answer what it actually knows (fees, hours, services, how to book) and step aside for anything clinical.

Crisis handling isn't optional

Ask specifically how the system handles self-harm or crisis language, and whether that check runs before anything else - including before booking flows or general question-answering. It should surface real support resources immediately (in Australia: Lifeline 13 11 14, Beyond Blue) and alert your team without requiring the patient to ask for a human first.

Data handling and AHPRA

Confirm conversations aren't used to train AI models, that the vendor never reads your existing patient records in systems like Cliniko or Zanda, and that a Data Processing Agreement is available if you're in a regulated industry. Separately, ask how the system stays within AHPRA's advertising guidelines - no unsubstantiated health claims, no promised outcomes, no clinical advice dressed up as marketing copy.

Integration depth matters more than it looks

A chatbot that just hands out a generic booking link is doing less than one that creates the appointment directly in your practice management system. Ask exactly what the integration does: does it create a confirmed booking, or just point the patient somewhere else to finish the job themselves? Both can be legitimate depending on what the platform's own API supports, but you should know which one you're getting.