Protecting patient health data when offshoring: Australian Privacy Principles in practice

Offshoring healthcare administration to the Philippines raises a legitimate question that every responsible healthcare business owner should ask before they start: what happens to patient data? The answer is not ‘don’t offshore’ — it is ‘offshore with the right controls in place’. Australian privacy law has clear requirements for overseas disclosure of health information, and meeting them is straightforward if you approach it systematically.

This post covers the legal obligations under the Privacy Act 1988 and the Australian Privacy Principles (APPs), the My Health Records Act considerations relevant to healthcare business admin, and the practical technical and contractual controls that make offshore arrangements both legal and defensible.

What Australian privacy law actually requires

The Privacy Act 1988 applies to all APP entities — which includes most general practices, specialist practices, allied health providers, and NDIS registered providers handling health records. When you share patient information with an overseas recipient (including a contractor working remotely from the Philippines), APP 8 is the operative clause.

APP 8 requires that before disclosing personal information overseas, you either take reasonable steps to ensure the overseas recipient will not breach the APPs, or you obtain the individual’s consent. In practice, consent for routine admin handover is not workable at scale — so the operative obligation is the reasonable steps requirement.

What counts as reasonable steps

• A written data handling agreement with your offshore contractor or their employer, specifying: permitted uses of patient data, storage and transmission standards, breach notification obligations, and data return or destruction on contract termination.
• Evidence that the offshore staff member has completed privacy and confidentiality training before accessing any patient records.
• Documented access controls: the offshore staff member should only be able to see the patient data necessary to perform their specific tasks (minimum necessary access principle).
• A process for your practice to audit access and investigate potential breaches.

The Office of the Australian Information Commissioner (OAIC) takes the position that contractual arrangements alone are not sufficient — you must also have reasonable grounds to believe the recipient will comply. Engaging through a provider like HealthDoers, where staff are specifically trained in Australian healthcare privacy obligations, materially strengthens that position.

The My Health Records Act and what it changes

If your practice is registered with My Health Records (My HR), additional constraints apply. Only authorised healthcare provider employees may access the My HR system, and that access must be logged and auditable. Overseas staff — including offshore VAs — must not access My HR directly. This is not a gap in the offshoring model; it is a clear delineation of tasks.

Offshore admin staff can work with your practice management system, appointment data, billing records, referral logs, and patient communication queues without ever touching My HR. The boundary is clear and easy to enforce through role-based access controls in your practice software.

Contractual controls: what your data handling agreement must include

Whether your offshore staff are engaged through HealthDoers or another provider, your practice should hold a data processing agreement (DPA) that covers the following at minimum.

• Scope of permitted processing: explicitly list the categories of data the offshore team may access (e.g. appointment records, billing data, patient contact details) and those they may not (e.g. clinical notes, pathology results, My HR).
• Storage and transmission standards: prohibit storage of patient data on personal devices or personal cloud accounts; require encrypted transmission for any data transfer.
• Sub-processing restrictions: your DPA should prohibit the offshore provider from sub-contracting access to patient data without your written consent.
• Breach notification: specify that any suspected breach must be reported to your practice manager within 24 hours, consistent with your obligations under the Notifiable Data Breaches (NDB) scheme.
• Audit rights: retain the right to request access logs and compliance evidence on reasonable notice.
• Termination and data return: on contract end, all patient data held by the offshore contractor must be returned or destroyed, with written confirmation.

HealthDoers provides a standard DPA template as part of the placement process. Review it with your practice’s legal adviser if your patient cohort includes particularly sensitive categories (e.g. mental health, substance use, or family violence disclosures).

Technical controls: making policy enforceable

A signed agreement is a necessary condition but not a sufficient one. Technical controls are what actually prevent data mishandling. The following set of controls is achievable for any small to medium practice without significant IT expenditure.

• Multi-factor authentication (MFA) on every system the offshore VA accesses. Without MFA, a compromised password means a compromised patient record.
• Role-based access control (RBAC) in your practice management software: create a restricted user profile for your offshore VA that limits visibility to the specific data sets they need.
• Audit logging: ensure your practice management system records a log of who accessed which records and when. Most clinical software platforms (Best Practice, Cliniko, Nookal) have this capability built in — activate it if you have not already.
• Virtual desktop or VPN: where technically feasible, deliver system access through a virtual desktop environment so that data is processed on your infrastructure, not the VA’s local machine.
• Screen watermarking: some practices enable dynamic watermarking on remote sessions so that any screenshot or photograph of the screen carries an identifying trace. This is a secondary deterrent but easy to implement with tools like Splashtop or BeyondTrust.
• Device policy: establish a written acceptable-use policy prohibiting the use of personal USB drives, personal email, or personal cloud storage for any practice-related data.

Training your offshore team on Australian privacy obligations

HealthDoers VAs complete privacy and confidentiality training as part of their pre-placement preparation, but your practice should also run a brief, documented induction covering your specific policies. This does not need to be elaborate: a one-hour session covering your privacy policy, the types of data the VA will handle, the escalation path for suspicious activity, and the consequences of a breach is sufficient. Document the date, attendees, and content.

Refresher training annually, and whenever there is a material change to your systems or policies, is good practice and will be relevant if you ever need to demonstrate compliance to the OAIC.

Building a defensible offshore model

The healthcare businesses that handle offshore privacy well are not those that have the most complex policies — they are the ones that have closed the gap between policy and practice. Written agreements, minimum access provisioning, MFA, audit logs, and documented training are not burdensome requirements; they are the baseline of responsible data management for any staff member, onshore or offshore.

As Australian health regulators continue to increase scrutiny of data handling across the sector — particularly in the wake of major healthcare breaches in recent years — practices with documented offshore compliance frameworks will be well-positioned. Those without them will be exposed, regardless of where their admin staff are located.