Patient privacy laws in Australia: a plain guide for clinics

Every allied health practice holds health information, which the law treats as one of the most sensitive kinds of personal information. That means privacy law applies to you whatever your size, and the questions it raises come up every week: a parent asking for a copy of their child's file, a GP wanting a report, a staff member emailing a spreadsheet to the wrong address. This is a plain guide to the rules, written for owners and practice managers rather than lawyers.

It is general information, not legal advice. Privacy law in Australia has been amended recently and further reform has been proposed, so confirm your current obligations with the Office of the Australian Information Commissioner (OAIC) and, where one applies, your state or territory regulator.

The Privacy Act and the Australian Privacy Principles

The main law is the Privacy Act 1988, which contains the 13 Australian Privacy Principles (APPs). Many small businesses are exempt from the Act, but health service providers that hold health information are not, so the small business exemption does not help a clinic. The principles that matter most day to day:

• Open and transparent management (APP 1). Have a clear, current privacy policy that says what you collect, why, how you store it and how people can complain.
• Collection (APPs 3 and 5). Collect only what you need, generally with consent for health information, and tell people at or before collection why you are collecting it and who you might share it with.
• Use and disclosure (APP 6). Use information for the purpose you collected it, or a directly related purpose the patient would reasonably expect, unless they consent or another exception applies.
• Direct marketing (APP 7). Patient details are not a mailing list. Using health information for marketing generally needs the patient's consent, and people need an easy way to opt out.
• Overseas disclosure (APP 8). If information goes overseas, including to a software vendor or service provider, you may have extra obligations. Ask your vendors where data is stored and processed.
• Security (APP 11). Take reasonable steps to protect information from misuse, loss and unauthorised access, and destroy or de-identify it when you no longer need it, subject to record-keeping laws.
• Access and correction (APPs 12 and 13). Patients can ask to see, and to correct, the information you hold about them.

State and territory health records laws

Some states and territories have their own health privacy laws that apply alongside the federal Act, including to private practices. Victoria has the Health Records Act 2001, New South Wales the Health Records and Information Privacy Act 2002, and the ACT the Health Records (Privacy and Access) Act 1997. These can add rules on access, transfer and how long records must be kept, including longer periods for children's records. If you practise across a border, check both sets of rules.

Consent in practice

Consent works best when it is specific and recorded. At intake, explain in plain words what you collect, who you share it with (the referring GP, a plan manager, an insurer), and what software you use to store and process it. Record the consent on the patient's file, along with how they prefer to be contacted.

Revisit consent when something changes: a new funder, a new use, a new tool. If you start using AI to help draft notes, for example, tell patients. Our guide to AI clinical notes in Australia covers that case in more detail.

Handling access requests

A patient asking for their records is exercising a right, not making a complaint. Handle it the same way every time:

1. Confirm who is asking and that they are entitled to the information, particularly for children, guardians and nominees.
2. Respond within a reasonable time, and within any timeframe set by the state law that applies to you.
3. Provide the information in the form requested where that is reasonable.
4. Refuse only on a ground the law allows, and explain the refusal in writing.
5. Keep a record of the request and your response.

If a patient asks you to correct something in their clinical record, do not overwrite the original. Add the correction, or a note of their request, in a way that keeps the history visible.

When something goes wrong: data breaches

Under the Notifiable Data Breaches scheme, if a breach is likely to result in serious harm to the people affected, you must notify the OAIC and those people. A misdirected email with a patient's report, a lost phone with records on it, or a staff login used by someone else can each be a data breach.

If you suspect one, contain it first, then assess it promptly, within the timeframe the scheme sets. Write down what happened and what you did. The OAIC publishes guidance on deciding whether a breach is notifiable; read it before you need it.

Where your software fits

Software cannot make you compliant, and be wary of any vendor that says theirs does. It can make the right habits easier. In AspireOS, each patient's profile records their privacy consent and how they like to be contacted, and patient outreach works from marketing consent and a do-not-contact list. Access is split across four sign-in roles with a permission grid the owner can narrow, and non-clinical job titles can never write clinical notes. Sign-in supports a two-factor code, notes are completed and locked with their version history kept, and patient pages are never stored on the phone app.

Practice data is hosted in Sydney, and the audit trail records activity, logins, communications and AI actions. Our security page sets out how data is stored, who can reach it and what is logged, in plain terms.

If you would like to walk through how consent, roles and the audit trail work in practice, start a free trial and check them against your privacy policy.