Compliance Guide — Updated August 2026

Privacy Act Health Data Compliance Guide

Everything Australian healthcare providers need to know about Privacy Act obligations, APP 11 security requirements, and OAIC breach notification procedures.

Get a Free Compliance Assessment Healthcare Security Overview

Why the Privacy Act Matters for Healthcare

The Privacy Act 1988 (Cth) is Australia's primary federal privacy legislation. It establishes the 13 Australian Privacy Principles (APPs) that regulate how organisations collect, use, store, and disclose personal information — with heightened obligations for health information.

Healthcare is classified as a high-risk sector under the Privacy Act. The Office of the Australian Information Commissioner (OAIC) consistently identifies healthcare as the top or second most breached sector in Australia. In the most recent reporting period, healthcare accounted for 18% of all Notifiable Data Breach (NDB) reports — second only to financial services.

For healthcare organisations, Privacy Act compliance is not optional. Failure to implement adequate security measures, failure to notify the OAIC of a breach, or failing to respond appropriately can result in enforceable undertakings, public reports, and reputational damage that erodes patient trust.

What Counts as "Health Information" Under the Privacy Act?

The Privacy Act defines health information broadly. It includes any information about an individual's physical or mental health — past, present, or future — and is treated as "sensitive information" requiring a higher standard of protection.

Medical histories, diagnoses, and treatment records
Mental health, psychiatric, and psychological records
Genetic and genomic data
Disability information and healthcare needs
Pharmaceutical records and prescriptions
Allied health records (physiotherapy, psychology, optometry, dental)
Information collected in connection with health research (if identifiable)

Key Australian Privacy Principles for Healthcare Providers

APP 1

Open and Transparent Management

Healthcare organisations must have a clear, accessible privacy policy explaining how health information is collected, used, stored, and disclosed. The policy must be available on request and, for larger organisations, published online.

APP 3

Collection of Solicited Personal Information

Collect only health information that is reasonably necessary for the health service. Obtain consent before collecting sensitive health data. Inform patients why information is collected and who it may be shared with.

APP 6

Use or Disclosure of Personal Information

Use or disclose health information only for the primary purpose for which it was collected (e.g., providing treatment), or with patient consent. Disclosure to third parties (insurers, researchers) requires explicit consent or statutory authorisation.

APP 11

Security of Personal Information (Core Obligation)

Take reasonable steps to protect health information from misuse, loss, and unauthorised access, modification, or disclosure. This is the primary security obligation. It requires a risk-based approach — security controls proportionate to the sensitivity of the data.

APP 12

Access to Personal Information

Patients have a right to access their health information. Requests must be responded to within 30 days. Organisations must not charge excessive fees for access and can only refuse in limited circumstances.

APP 13

Correction of Personal Information

Healthcare providers must correct inaccurate, out-of-date, or misleading health information on request. If correction is refused, the individual can request a note of disagreement be attached to the record.

APP 11 Deep Dive: What "Reasonable Security" Means in Practice

"An organisation must take such steps as are reasonable in the circumstances to protect personal information it holds from misuse and loss and from unauthorised access, modification or disclosure." — Privacy Act 1988, APP 11.1

The OAIC has published guidance on what constitutes "reasonable" security for health data. The key factors are: the sensitivity of the information, the volume of records held, the organisation's size and resources, and the potential harm from a breach. For most healthcare providers — even small GP practices — this means implementing the ACSC Essential Eight at Maturity Level 1 as a minimum baseline.

Minimum APP 11 Security Controls for Healthcare

Encryption

Encrypt patient data at rest (on servers, laptops, USB drives) and in transit (email, file transfers). Patient management systems (Best Practice, Medical Director, Cliniko) should use encrypted databases.

Access Controls

Restrict access to patient records on a need-to-know basis. Staff should only access records relevant to their role. Role-based access controls (RBAC) are best practice.

Multi-Factor Authentication (MFA)

Enable MFA on all systems containing health data: email, patient management, cloud storage, billing platforms, and remote access VPN.

Audit Logging

Maintain logs of who accessed which patient records and when. Audit logs are essential for OAIC investigations and for detecting insider threats or unauthorised access.

Patch Management

Apply security patches to patient management software, operating systems, and clinical applications within 14 days of release for critical patches, 30 days for others.

Backup & Recovery

Maintain secure, offline backups of patient data. Test recovery quarterly. A healthcare practice that loses patient records due to ransomware and cannot recover faces both OAIC investigation and clinical risk.

Staff Training

Train all staff handling patient data on privacy obligations, phishing recognition, and data handling procedures. Annual training is the minimum; quarterly awareness updates are best practice.

Incident Response Plan

Document procedures for detecting, containing, and notifying the OAIC of data breaches. Without a plan, the 30-day notification window is very difficult to meet.

Notifiable Data Breaches: The 30-Day Rule

The Notifiable Data Breaches (NDB) scheme requires organisations to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. For healthcare, this applies to virtually any breach involving patient records, given the sensitivity of health information.

The 30-Day Clock Starts When You Become Aware

You have 30 days from the date you become aware of a suspected eligible data breach to complete an assessment and notify the OAIC. Burying the breach or delaying the assessment does not pause this clock — it increases regulatory risk.

Step-by-Step NDB Notification Process

Contain the breach

Immediately limit the ongoing exposure. Disconnect compromised systems, revoke stolen credentials, or prevent further data access.

Assess the breach

Determine what data was accessed or exposed, how many individuals are affected, whether the information is likely to cause serious harm (identity theft, financial loss, embarrassment). Complete within 30 days.

Notify the OAIC

Submit an NDB statement to the OAIC via the online portal. Include: date of breach, date discovered, type of information, number of individuals affected, and steps taken.

Notify affected individuals

Notify all affected individuals either directly (email, letter, phone) or through published notification if direct contact is not practicable. Notify at the same time as OAIC.

Document and remediate

Record the breach, response, and remediation steps taken. Implement controls to prevent recurrence. Retain breach records for 5 years.

OAIC Enforcement: What Healthcare Providers Are Facing

The OAIC has significantly increased enforcement activity against healthcare organisations that fail to protect health data or notify breaches on time. Outcomes of OAIC investigations include:

Enforceable Undertakings

Binding commitments to improve privacy practices, typically including mandatory security audits, staff training programs, and regular compliance reporting to the OAIC.

Public Investigation Reports

Published on the OAIC website — naming the organisation and detailing the breach. These public reports cause lasting reputational damage, patient distrust, and referral losses.

Civil Penalty Applications

For serious or repeated breaches, the OAIC can apply to the Federal Court for civil penalties of up to $50M for large organisations under the 2024 Privacy Act amendments.

Declaration Orders

Declarations requiring specific actions: destroying data improperly obtained, ceasing particular data practices, or compensating affected individuals for loss or damage caused by the breach.

Is Your Healthcare Practice Privacy Act Compliant?

ShieldForce specialises in Privacy Act compliance for Australian healthcare providers. We assess your current security posture, identify gaps, and implement controls to protect patient data.

Book Your Free Privacy Assessment

References

Authors: ShieldForce Editorial Team, led by Obi Ibeto, Founder & CEO, ShieldForce Australia

Published: August 2026 | Last Updated: August 2026

See our full author credentials