New Patient Enquiries at Your Clinic: Answer Fast, Book Well, Stay Privacy-Compliant

New patient enquiries are where a clinic's growth starts, and too often they stall at the front desk. To handle them well you need to reply quickly, book the appointment on that first contact, and get your privacy basics right, because health service providers are covered by the Privacy Act whatever their size. This guide covers how to set up an enquiry workflow that doesn't depend on reception being free. It also covers what to tell patients when you collect their details, and how to handle call recording across states.

Why new patient enquiries stall at the front desk

In most allied health clinics, reception is doing several jobs at the same time. They check patients in, take payments, deal with health fund claims, answer the phone and reply to web forms. When the waiting room is busy, the new patient enquiry that came in through your website gets put off until later. Later often means the end of the day, and by then the person may have booked with whoever got back to them first.

The underlying problem is that enquiries arrive whenever patients have time to send them, while your capacity to reply depends on how quiet the clinic is. You fix it by designing a process that doesn't depend on someone happening to be free. Asking reception to try harder won't do it.

Build an enquiry workflow that doesn't create a backlog

Bring every channel into one queue

New patient enquiries come in through web forms, online booking widgets, emails, social media messages, phone calls and referrals from GPs. If each lands in a different inbox, some will be missed. Send them all to a single list that shows who is handling each one and where it's up to. A practice management system, a shared inbox with clear rules, or a simple CRM can all work. What matters is that everyone looks at the same place.

Decide what "fast" means and who owns it

Agree on a target response time for new enquiries and who is responsible during each part of the day, including lunch breaks, early mornings and after hours. If no one is named, the job falls to whoever is least busy, which in practice can mean nobody. Some clinics have a staff member handle callbacks in a protected block of time. Others use automation to make the first contact and pass the patient to a person after that.

Book on the first contact

A callback is only useful if it ends with an appointment. Give whoever makes contact, whether that's a person or an AI voice agent, everything they need to finish the booking during the call:

• Live access to practitioner availability, not a list printed that morning
• Clear rules on appointment types, lengths and which practitioner treats which conditions
• Fees, gap payment information and what to bring to the first visit
• Whether a referral is needed for the patient's funding pathway, such as a GP plan, NDIS or a workers' compensation claim
• When to hand the call to a clinician, such as when a patient describes red-flag symptoms

Close the loop with confirmations and reminders

Once the patient is booked, send a confirmation and a reminder before the appointment. Under the Do Not Call Register Regulations 2017, a call whose primary purpose is rescheduling or reminding of an appointment is not a telemarketing call. The ACMA also says that messages are generally not spam if they are appointment or payment reminders and have no advertisements. Keep reminders strictly about the appointment. If you add a promotion for another service, the message is no longer only a reminder.

Privacy: your clinic is covered whatever its size

Many small business owners assume privacy law doesn't apply to them. The OAIC explains that most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act 1988, but some are regardless of turnover, including health service providers. Allied health clinics should treat themselves as covered and check the details with a lawyer if they're unsure.

This matters for enquiries because a new patient often shares health information before they ever walk in: a sore back, a child's speech delay, a recent surgery. That's sensitive information, and it deserves care from the very first contact.

Give a collection notice at the point of contact

An organisation covered by the Privacy Act must take reasonable steps, at or before collecting personal information or as soon as practicable afterwards, to tell the person matters such as its identity and contact details and the purposes of collection. In practice:

• Put a short notice next to your web enquiry form explaining who you are, why you're collecting the details and how to contact you
• Link to your privacy policy from the form and from confirmation messages
• Give staff and any AI agent a brief spoken version to use on calls
• Only ask for the information you need to book, and save detailed clinical history for the consultation

Be upfront if AI is involved

If an AI system makes contact with patients or collects their details, say so. The OAIC's guidance says that when an organisation collects personal information through a public-facing AI system, it should make sure people are aware they are interacting with an AI system rather than a human. The same guidance recommends that businesses update their privacy policies and notifications with clear information about their use of AI.

Plan ahead too. From 10 December 2026, organisations covered by the Privacy Act that use personal information in automated decision-making that could affect people's rights or interests must explain in their privacy policies the kinds of personal information used and the kinds of decisions made. If any automated tool in your intake process makes decisions such as triage or eligibility, review your privacy policy now.

The stakes have gone up

The Privacy and Other Legislation Amendment Bill 2024, which passed in November 2024, introduced a statutory tort for serious invasions of privacy and gave the OAIC new tiers of civil penalties and the ability to issue infringement notices. Careless intake processes now carry more risk than they used to.

Announcing call recording

Recording calls helps with training and quality, and it gives you a record of what was agreed. The rules differ between states, though, and your patients and staff may be in different places. Some examples:

• Victoria Legal Aid says that under both state and Commonwealth law it is legal to record a private conversation if the person recording is a party to it and the recording isn't made through a device installed within the phone.
• In NSW, section 7 of the Surveillance Devices Act 2007 prohibits recording a private conversation you're part of unless all principal parties consent, or one consents and the recording is reasonably necessary to protect their lawful interests or isn't made to be shared with non-parties.
• In South Australia, the law generally prohibits recording a private conversation without the consent of all principal parties, subject to some exceptions, and consent can be express or implied.
• Legal Aid Queensland says it is not illegal in Queensland to record a conversation you are involved in, but communicating or publishing it without permission is illegal, with some exceptions.

The simplest approach is to announce recording at the start of every call, explain why, and let the patient continue without being recorded if they object. That works under the strictest rules you're likely to come across. Get a lawyer to check your wording, especially if you operate in several states.

Keep enquiry follow-up separate from marketing

Calling someone back about the enquiry they made is different from promoting your services. The ACMA says that where a call has more than one purpose and one of them is to sell or promote goods or services, the call is commercial and must comply with the telemarketing rules. If your callback script drifts into upselling a package or a new service, the rules change.

For direct marketing more broadly, the OAIC notes that APP 7 does not apply to communications covered by the Do Not Call Register Act or the Spam Act, but generally applies to direct marketing calls to numbers not on the Register. Where it applies, you must give people a simple way to opt out and, if asked, stop using their information for direct marketing within a reasonable period. Record consent and opt-outs against each contact so that nobody calls a person who has asked you to stop.

Questions to ask before you change your process

• Where do our new patient enquiries currently come from, and which ones go unanswered longest?
• Who owns first contact at each time of day?
• Can whoever makes contact see live availability and book on the spot?
• Do our web forms and call scripts include a collection notice?
• Do we tell patients when they're speaking to an AI, and does our privacy policy say how we use it?
• Do we announce recording, and has a lawyer checked the wording for each state we operate in?
• Are reminders kept free of promotional content?
• How do we record consent and opt-outs for past enquiries?

Where an AI voice agent fits

Once the workflow is clear, automation can do the part that most often gets dropped, which is getting back to new enquiries quickly. Dialessa is an AI voice agent that calls new enquiries within a minute, books the appointment into your calendar and follows up past leads whose consent is still current. It identifies itself as AI, and you can set it up to give your collection notice and recording announcement. That leaves your front desk free to look after the patients who are already in the clinic.

Whatever tools you use, the principles are the same. Respond quickly, book on the first contact, tell patients what you're collecting and why, and keep enquiry follow-up separate from marketing.