Clinical Algorithms and Automated Care Act 2026 (CAAC)

Recognising that clinical algorithms and automated care may improve safety, timeliness, and equality in healthcare but may also reproduce discrimination, obscure responsibility, or cause widespread harm, this Act establishes accountable human oversight, patient information rights, validation, registration, auditing, incident reporting, and safeguards for health data. This Act works in conjunction with and is read alongside the Digital Liberty and Algorithmic Rights Act 2025, the Online Safety and Digital Services Act 2025, the Unity and Equality Act 2025, the Senior Dignity and Welfare Act 2025, the Data Protection Act 2026, the Health Information and Patient Privacy Act 2026, the Linkslandic Health Service Act 2026, and the Patient Safety Bill when enacted or otherwise applicable. It preserves existing clinical duties, negligence law, equality protections, privacy rights, and judicial remedies.

Section 1A - Purpose

(a) The purposes of this Act are to protect patient safety, dignity, equality, privacy, informed participation, and accountable clinical judgment in the use of automated systems.

Section 1B - Clinical Algorithm

(a) A clinical algorithm is software used to diagnose, triage, prioritise, predict a clinical risk, recommend treatment, recommend a dosage, or make another material clinical recommendation.

(b) Software used solely for appointment booking, billing, stock management, or comparable administration is administrative software and is subject only to duties expressly applying to that category.

Section 1C - Responsible Persons

(a) A qualified clinician is a person authorised under applicable health-service rules to make or review the relevant clinical decision.

(b) A provider is a person or organisation that develops, supplies, deploys, or operates an algorithm in patient care.

(c) A patient includes a person receiving, seeking, or lawfully represented in relation to healthcare.

Section 2A - Human Review

(a) A provider must not use a clinical algorithm as the sole decision-maker for diagnosis, treatment, triage priority, admission priority, dosage, or refusal of clinically indicated care.

(b) A qualified clinician must retain responsibility for the clinical decision, consider the algorithm’s output critically, and have authority to depart from it.

Section 2B - Records and Reasons

(a) The provider must record the algorithm used, its version where available, the responsible clinician, the material recommendation, and the clinical decision.

(b) Where the responsible clinician departs materially from the recommendation, the clinician must record a proportionate reason, subject to urgent-care provisions.

Section 2C - Immediate Emergencies

(a) In an immediate emergency, a clinician may temporarily rely on an algorithmic recommendation where delay would create a serious risk of death or serious harm.

(b) The clinician must review and document the decision as soon as reasonably practicable, and emergency reliance does not remove any existing duty of care.

Section 3A - Notice of Use

(a) A patient must be informed, in an accessible manner, when a clinical algorithm materially influenced their care, unless giving notice at that time would create a serious and immediate risk to the patient.

Section 3B - Explanation

(a) A patient may request a plain-language explanation of the algorithm’s role, the categories of information considered, the material reasons for its recommendation, and the identity of the provider responsible for it.

(b) An explanation must not disclose another person’s confidential information, create a serious security risk, or disclose protected technical information beyond what is necessary to make the decision understandable.

Section 3C - Human Review

(a) A patient may request review by a qualified clinician of a decision materially influenced by a clinical algorithm.

(b) The review must be meaningful, timely, and capable of changing the decision where clinically justified.

Section 4A - Pre-Deployment Validation

(a) Before deployment in patient care, a provider must validate a clinical algorithm for its intended population, setting, purpose, accuracy, limitations, safety, and foreseeable failure modes.

(b) Validation data and methods must reasonably reflect the population served, including relevant variation in age, disability, ethnicity, sex, gender identity, and other characteristics where clinically and legally relevant.

Section 4B - Register

(a) The Health Minister must establish or designate a public register of clinical algorithms used in patient care.

(b) A registration entry must state the algorithm’s provider, purpose, clinical setting, version, validation summary, audit status, known limitations, and date of approval.

Section 4C - Protected Information

(a) The register may withhold confidential security information, trade secrets, personal information, and information whose publication would materially increase a risk to patients or public safety.

(b) The regulator must publish an intelligible public summary sufficient to support accountability.

Section 4D - Unregistered Use

(a) A provider must not deploy a clinical algorithm in patient care unless it is registered or covered by a time-limited authorisation for testing, urgent public-health response, or another prescribed exceptional purpose.

(b) An authorisation must state its scope, safeguards, responsible provider, and expiry or review date.

Section 5A - Independent Audits

(a) A provider must arrange an independent bias, safety, and performance audit at least annually for a high-risk clinical algorithm and at intervals prescribed for other regulated algorithms.

(b) An auditor must be independent of the provider, possess suitable expertise, and disclose conflicts of interest.

Section 5B - Audit Reports

(a) Audit results, material limitations, corrective actions, and unresolved risks must be sent to the Digital Rights Commission and the prescribed health regulator.

(b) The regulator must publish a suitable summary, subject to the protections in Section 4C.

Section 5C - Disadvantage and Restriction

(a) Where an algorithm causes or is reasonably likely to cause unlawful discrimination, material unsafe performance, or serious unexplained disadvantage to a group, the provider must promptly investigate and take corrective action.

(b) The regulator may impose conditions, require retraining or replacement, or suspend use. An interim restriction may be imposed without prior representations only where necessary to prevent an imminent serious risk to patients.

Section 5D - Representations and Review

(a) Before a non-urgent suspension or civil penalty, the regulator must give notice of the proposed action, reasons, and a reasonable opportunity to make representations.

(b) A provider may seek review by the Health Ombudsman or a court with jurisdiction under existing proceedings law.

Section 6A - Reporting

(a) Providers must report errors, near misses, and serious incidents involving a clinical algorithm through the applicable confidential patient-safety reporting system, identifying the involvement of the algorithm.

(b) Reporting under this Article does not replace any duty to report under health, equality, privacy, or professional regulation law.

Section 6B - Publication

(a) The competent regulator may publish anonymised information about serious incidents, systemic risks, and corrective action where publication is in the public interest and does not identify a patient or create an avoidable security risk.

Section 6C - No Transfer of Duty

(a) Use of an algorithm does not transfer, reduce, or extinguish a clinician’s or provider’s existing duty of care, nor does it determine civil liability or professional misconduct proceedings.

Section 7A - Restricted Characteristics

(a) A restricted characteristic or field protected under applicable health-privacy law must not be used as an input to a clinical algorithm unless its use is clinically justified, proportionate, lawful, and subject to any required consent or safeguard.

(b) A provider must not use a protected characteristic as a proxy to produce unlawful discrimination.

Section 7B - Training and Validation Data

(a) Data used to train, validate, monitor, or audit an algorithm must have a lawful basis and comply with applicable data-protection and health-privacy law.

(b) Data must be anonymised or de-identified where practicable and sufficient for the purpose, and safeguards must be used to prevent re-identification.

Section 7C - Data Rights

(a) Nothing in this Act limits a patient’s existing rights to access, correction, objection, consent withdrawal, meaningful human review, or remedy under applicable law.

Section 8A - Identification

(a) An automated health chat service must clearly state that it is automated and must not represent itself as a clinician or human professional.

Section 8B - Safety Direction

(a) Where a user may require urgent or emergency care, the service must clearly direct the user to appropriate emergency services or urgent clinical assistance.

(b) A provider must design the service to identify and appropriately escalate reasonably foreseeable high-risk situations.

Section 8C - Information and Privacy

(a) The service must explain in accessible terms how user information is used and must comply with applicable health-privacy and data-protection law.

Section 9A - Complaints

(a) A patient may complain to the Digital Rights Commission about discrimination, digital rights, or data practices, and to the Health Ombudsman about clinical safety, care, or professional accountability.

(b) The bodies must cooperate, avoid duplicate investigation where practicable, and inform the complainant of the appropriate route.

Section 9B - Offences and Penalties

(a) A person who knowingly deploys an unregistered clinical algorithm in patient care, falsifies a validation or audit record, or obstructs a lawful investigation commits an offence classified and punished under the applicable Low Offence or Fine Offence category prescribed by law.

(b) A penalty must be proportionate to culpability, patient harm, duration, scale, and any remedial action, and does not limit civil, professional, or regulatory remedies.

Section 9C - Guidance and Implementation

(a) The Health Minister must publish guidance, model documentation, and implementation standards after consultation with clinicians, patients, disabled people, minority communities, providers, and technical experts.

(b) The Minister may prescribe phased or risk-based compliance dates, but may not remove the human-review, equality, privacy, or emergency-safety protections in this Act.

Section 10A - Three-Year Review

(a) The Health Minister must commence a review of this Act within three years of its commencement and lay a report before Parliament.

(b) The report must assess patient outcomes, equality effects, incidents, costs, administrative capacity, innovation, rural and small-provider impacts, complaints, enforcement, and any need for further legislation.

Section C1 - Rights and Due Process

(a) This Act must be interpreted consistently with the Constitution, including rights to dignity, equality, privacy, healthcare, fair administrative action, and access to lawful remedies.

Section C2 — Proportionality and Existing Law

(a) Regulatory action under this Act must be lawful, reasoned, necessary, and proportionate.

(b) This Act preserves the jurisdiction of courts and existing regulators and is read alongside the relevant Acts identified in the Preamble.