NSW Health used Amazon Bedrock to help map about 6,000 staff roles for its Single Digital Patient Record programme, according to an iTnews report published on 2 October 2026. Work estimated to require roughly 30 days was reduced to days, the report says, with specialists reviewing every recommendation. The case concerns preparation of staff access permissions, rather than AI making clinical decisions.
Access mapping connects workforce roles with the permissions people need in a digital system. It can involve comparing many job descriptions and deciding which groups require which functions. In this case, iTnews reported comments by Marc Pelusi, an associate director working on AI delivery for the programme, at an AWS event. He described AI as providing recommendations while people retained accountability.
The reported time saving is a project estimate, not an independently measured productivity result. The account does not establish an audited error rate or a complete calculation including cloud costs and specialist review. It also concerns workforce information; it does not establish that patients’ clinical records were entered into the AI model. Those distinctions matter when assessing both the benefit and the privacy implications.
The scale of the wider programme helps explain why role mapping matters. NSW Health’s delivery plan describes a statewide platform spanning electronic medical records, patient administration and laboratory information. The programme covers 228 hospitals and more than 600 community health centres, alongside pathology services. A permissions problem can therefore become a practical barrier to staff doing their work, as well as an information-security concern.
The programme has already moved beyond a purely future rollout. The official delivery page records first-phase deployments during March and May 2026, with implementation continuing across the system. That timeline makes it important to distinguish the specific access-mapping task from claims about the completion or performance of the entire patient-record programme.
NSW’s broader health AI framework sets out expectations around trust, transparency and accountability. Its relevance here is the way a relatively bounded task can still require governance: a recommendation about access has consequences when somebody acts on it. Human review is meaningful when the reviewer can understand the proposed permission, identify a mismatch and correct it before it takes effect.
The framework’s privacy guidance also emphasises protection of information, access controls and appropriate privacy assessment. These principles provide questions for evaluating projects, rather than independent confirmation that this implementation met every requirement. A useful assessment would examine the data supplied, the permissions granted, review records and how decisions are corrected when staff roles change.
Amazon’s Bedrock documentation says customer content is not used to train its underlying models or shared with model providers, and describes encryption protections. Those service commitments are relevant, but they do not establish which settings NSW Health used or independently validate the project. The next useful evidence would connect faster preparation with accurate permissions in operation, including exceptions and corrections. That would show how much of the reported efficiency survives the full process of giving the right staff appropriate access.
Questions about human oversight also run through ASIC’s planned review of banking AI, although lending and customer decisions involve different tasks and consequences from staff-access mapping.
