Health Practice Privacy Policy Template (Australia)

Privacy Requirements for Australian Health Practices

If you provide a health service and hold health information, you are required to have a clearly expressed, up-to-date Privacy Policy, and to make it available free of charge to anyone who asks for it. That applies to a sole practitioner working from a single room and to a multi-site clinic in the same terms.

Health information is not ordinary personal information

Under the Privacy Act 1988 (Cth), health information is classified as sensitive information. That means stricter rules on when you may collect it, what you may use it for, and who you may pass it to. It covers your clinical notes, test results, treatment plans and correspondence, and it also covers information you collect about a patient’s family, their carer and their emergency contact.

Three layers of obligation

The Commonwealth. The Privacy Act 1988 and the 13 Australian Privacy Principles, together with the Notifiable Data Breaches scheme in Part IIIC.

Your State or Territory. New South Wales has the Health Records and Information Privacy Act 2002 and 15 Health Privacy Principles. Victoria has the Health Records Act 2001 and 11 Health Privacy Principles. The Australian Capital Territory has the Health Records (Privacy and Access) Act 1997, which requires you to answer an access request within two weeks rather than the 30 days used elsewhere. Queensland, South Australia, Western Australia, Tasmania and the Northern Territory have no separate private sector health records statute, so the Commonwealth Act stands alone.

Your profession. AHPRA and National Board codes of conduct, your accreditation standards and your indemnity insurer’s expectations sit on top of the legislation.

If you practise in more than one State, all of the relevant rules apply at once. Your Privacy Policy has to reflect every one of them.

What has changed recently

The Privacy and Other Legislation Amendment Act 2024 reshaped a body of law that had been broadly stable for a decade. Since June 2025, individuals have had a right to take legal action for serious invasions of privacy. From 10 December 2026, Australian Privacy Principles 1.7 and 1.8 require your Privacy Policy to disclose where a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect a person, and to say whether a person makes the final call.

In a health practice that reaches further than most owners expect:

• Appointment triage or urgency ranking tools
• Clinical risk flagging, including drug-interaction and sepsis alerts
• Automated Medicare, DVA, health fund or insurance eligibility checks
• Non-attendance or no-show risk scoring
• Online booking forms that decline or redirect a booking based on the answers given

Digital scribes are the other change. AI tools that listen to a consultation and draft the clinical note are now common in Australian practice, and most Privacy Policies were written years before they existed. If a tool records your patients, your policy has to say so, say what happens to the recording, and say that the patient can decline.

Which States and Territories does it cover?

All of them. The generator asks which States you practise in and writes the correct rules into your policy for each one:

• The health records legislation that applies to you
• The retention period for adult records, and the separate rule for patients who were under 18 when the information was collected
• The deadline for answering an access request, including the shorter ACT deadline
• The right privacy complaints body and the right health complaints body for each State

Where to put your Privacy Policy

A Privacy Policy only works if people can find it. Australian Privacy Principle 1.5 requires you to make it available free of charge, and in the form a person asks for where that is reasonable and practicable.

• Website footer: create a Privacy Policy page and link to it from the footer of every page.
• Reception: keep a printed copy available for patients who ask, particularly if you do not have a website.
• Intake forms: link to it from your new-patient form, alongside your short collection notice.
• Online bookings: link to it from the booking page, before the patient submits their details.
• Telehealth: link to it in the appointment confirmation email.

What happens if your policy is out of date

Nothing, until somebody reads it. Then two people read it very carefully: the patient making a complaint, and the regulator assessing it.

A policy that describes a practice you no longer run is evidence, and it is evidence you published yourself. Review it whenever your practice changes: new software, a new service, a new location, a new way of contacting patients. That is the step almost everybody skips, and it is the step that turns a compliant policy into a non-compliant one.