Australian Privacy Principles and handling health records in your healthcare business

Privacy law is one of the less glamorous corners of running a healthcare practice, yet a single misstep — a misdirected email, an unsecured cloud folder, an untrained offshore team member — can expose your healthcare business to regulatory action, reputational damage, and loss of patient trust. For Australian healthcare businesses, the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) set the baseline, and health information attracts the highest level of protection within that framework. This guide walks through the APPs that matter most to everyday healthcare business operations and explains what you need to think about when offshore staff form part of your team.

What makes health information special under Australian law

Health information is defined broadly under the Privacy Act. It covers not just clinical records but also information about a person’s physical or mental health, a disability, an expressed wish about future health services, and information collected while providing a health service. It is classified as sensitive information, which means the threshold for lawful collection and use is higher than for ordinary personal information.

Most private-sector healthcare businesses are covered by the Act because they are either health service providers or they turn over more than $3 million per year. Sole practitioners providing health services are also covered regardless of turnover. State and territory public health systems operate under their own legislation — the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW), and equivalents elsewhere — which run alongside the federal framework and are sometimes stricter. Providers operating across borders must satisfy both.

The thirteen APPs in plain English — the ones healthcare businesses trip over most

The APPs cover the full lifecycle of personal information: collection, use, disclosure, storage, access, and correction. Below are the principles that generate the most compliance questions for healthcare business operators.

APP 1 — Open and transparent management

You must have a clearly written privacy policy that describes what information you collect, why, how you store it, and whether it goes offshore. The policy must be available free of charge — typically on your website and at reception. If you engage offshore staff who touch patient data, your policy should say so in plain terms.

• APP 3 — Collect only what is reasonably necessary for your health service functions. Asking for information you do not need creates risk without benefit.
• APP 6 — Use or disclose health information only for the primary purpose of collection (providing healthcare) or a permitted secondary purpose such as billing, or with the patient’s consent.
• APP 8 — Before disclosing personal information to an overseas recipient, take reasonable steps to ensure they will handle it consistently with the APPs. This is the principle most relevant to offshore staffing arrangements.
• APP 11 — Take reasonable steps to protect information from misuse, interference, loss, and unauthorised access. This covers both physical security and cyber security.
• APP 12 and 13 — Patients have the right to access their own health information and to request corrections. You need a documented process for handling these requests within the 30-day timeframe.

Cross-border disclosure and your offshore team

APP 8 is the provision healthcare business owners most often overlook when they engage offshore administrative or clinical support staff. The principle applies whenever personal information is disclosed to a person or organisation outside Australia — and that includes a remote Filipino team member accessing your practice management system from Manila.

“Disclosure” in this context does not require you to actively send a file. It is enough that the overseas recipient can view or retrieve the information. If your offshore staff log into your PMS, view appointment bookings, process referral letters, or handle billing queries, APP 8 is engaged.

The default obligation under APP 8 is that you must take reasonable steps to ensure the overseas recipient handles the information in a way that is at least as protective as the APPs. In practice, this means your offshore staffing provider should have demonstrable data-handling policies, your services agreement should include binding privacy obligations, and you should be able to point to those controls if the Office of the Australian Information Commissioner (OAIC) ever asks.

Practical controls for healthcare businesses using offshore staff

The legal framework sets the floor; operational controls are how you reach it. A layered approach — contracts, technology, training, and audit — gives you the best chance of meeting your APP 8 obligations.

• Include a data-processing schedule in your offshore staffing agreement that mirrors APP obligations and specifies what data can be accessed, on which systems, and for what purpose.
• Use role-based access controls in your PMS and telehealth platforms so offshore staff see only the patient data necessary for their function — for example, billing staff do not need access to clinical notes.
• Require multi-factor authentication and mandate the use of your healthcare business’s managed devices or a secured VDI environment rather than personal laptops.
• Maintain an audit log of system access and review it periodically. Most modern PMS platforms provide this natively.
• Deliver documented privacy training to offshore staff at onboarding and annually thereafter, and keep a record of completion.
• Store training records, access logs, and your services agreement somewhere you can retrieve them quickly — the OAIC can request evidence during a complaint investigation.

Notifiable data breaches — what to do when something goes wrong

Since 2018, the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act has required covered entities to notify the OAIC and affected individuals when an eligible data breach occurs. An eligible breach is one that is likely to result in serious harm to one or more individuals whose information is involved.

For healthcare businesses, common triggers include: a patient record sent to the wrong recipient, ransomware encrypting health data, an offshore team member accidentally sharing a file externally, or a lost device containing unencrypted health information. You have 30 days from becoming aware of a suspected breach to complete your assessment and, if the breach is eligible, notify the OAIC and affected individuals.

Your incident response plan should identify who in the practice has authority to declare a breach, who contacts the OAIC, and how patients are notified. If you do not have a written plan, drafting one is a practical first step that costs little and protects a great deal.

Looking ahead — privacy reform and the health sector

The Australian Government is progressing reforms to the Privacy Act following the 2023 review report. Proposed changes include a direct right of action for individuals, strengthened consent requirements, and expanded definitions of sensitive information. Health practices should expect stricter obligations over the next two to three years, not looser ones.

Healthcare businesses that build privacy compliance into their operating model now — rather than retrofitting it after an incident or a regulatory change — will be better placed to adapt. Engaging offshore staff through a provider that already operates within a documented privacy framework reduces your risk considerably compared with ad hoc arrangements.

This article provides general information only and does not constitute legal advice. Healthcare business owners should seek advice from a qualified privacy lawyer or contact the OAIC for guidance specific to their circumstances.