Compliance and Risk

The Privacy Act 1988 for Australian Medical Practices: A Practical Guide

Health information is among the most sensitive personal data a practice handles, and the Privacy Act 1988 (Cth) sets the legal floor for how it is collected, used, stored, disclosed and disposed of. The 13 Australian Privacy Principles (APPs) apply to every private-sector medical practice that turns over more than $3 million a year, and to almost every health service provider regardless of turnover under the small-business health-services exemption rule in section 6D. The practice manager owns the operational privacy programme: making sure the policy is current, staff are trained, breaches are escalated within 72 hours, and the evidence file is ready for the OAIC if it ever asks.

TalentMed Pty Ltd (RTO 22151) delivers the HLT57715 Diploma of Practice Management, which covers the governance, risk management and operational reporting competencies a PM needs to design and run a privacy programme that holds up under audit.

Most medical practices fall inside the Privacy Act 1988 by virtue of being health service providers, not because of their turnover. The general $3 million small-business exemption (section 6D) is overridden for businesses that provide a health service and hold health information (section 6D(4)(b)). In practice, that captures GP practices, specialist rooms, dental practices, allied health, psychology, and most clinical services regardless of size.

Section 6FA defines health information broadly (any information about an individual’s health or disability, plus genetic and health-service information that identifies them), and the My Health Records Act 2012 layers additional rules on top of the Privacy Act for any practice connected to the My Health Record system.

For how this fits the wider operational compliance picture, see RACGP Standards 5th edition and the accreditation cycle.

The 13 APPs are written in general terms; the practical translation into the practice is what the PM needs on file. Six APPs do most of the day-to-day work: APP 1, 5, 6, 11, 12 and 13. The others shape collection and disclosure rules in the privacy policy, but rarely surface in operational decisions.

The OAIC’s Guide to securing personal information and Health privacy guide translate APP language into healthcare-specific operational guidance and are the reference assessors and OAIC investigators use.

Consent is the engine of lawful collection, use and disclosure under the APPs, but the Act distinguishes between express and implied consent and the practical line is not always obvious. Get it wrong and a routine disclosure becomes a breach.

APP 11 requires the practice to take “such steps as are reasonable in the circumstances” to protect information. The OAIC’s Guide to securing personal information sets out what reasonable steps look like in healthcare. The benchmark is risk-proportionate: a single-doctor rooms operation does not need an enterprise security operations centre, but it does need the basics done well and documented.

Cyber-incident risk is now the dominant operational privacy threat. Phishing, ransomware and credential theft are the most common breach vectors reported to the OAIC in healthcare. The APP 11 evidence file should include a recent cyber-risk assessment and an incident response plan that names a decision-maker for the first 24 hours.

Since February 2018 the Notifiable Data Breaches (NDB) scheme has required mandatory reporting of eligible data breaches to the OAIC and affected individuals. A breach is “eligible” if there is unauthorised access, disclosure or loss, AND the breach is likely to result in serious harm. Healthcare breaches almost always meet this threshold because health information is, by its nature, sensitive.

The 30-day clock runs from the moment the practice becomes aware (or ought reasonably to have been aware) of an eligible breach. Use the time for proper investigation; do not delay notification once the eligibility threshold is clearly met.

The PM owns the privacy programme as a system, even where individual tasks are delegated to clinical or admin staff. What the OAIC and RACGP assessors want to see is consistent ownership and an evidence file that proves the system runs.

The audit is the discipline that makes the privacy programme survive turnover. Sit it alongside the operational dashboard at GP practice KPIs and dashboards and the infection-control evidence file at infection control in Australian GP practices.

The Privacy and Other Legislation Amendment Act 2024 introduced the first tranche of reforms from the Government’s response to the Privacy Act Review. The reforms give the OAIC stronger civil-penalty powers, introduce a statutory tort for serious invasion of privacy, and lay groundwork for further reform tranches.

The new statutory tort lets a person sue directly for serious invasion of privacy where the conduct was intentional or reckless, the invasion was serious, and there is no overriding public interest. The practical implication: an unauthorised disclosure that historically ended at an OAIC complaint can now also surface in court. The standards have not changed; the consequences have.

The HLT57715 Diploma of Practice Management covers the governance, risk management and operational reporting competencies a PM needs to design and run a privacy programme that holds up under audit, accreditation, and OAIC investigation.

Keep exploring