Telehealth Security & Compliance Guide

Telehealth in Australia: Scale and Obligation

Telehealth in Australia expanded at extraordinary speed during the COVID-19 pandemic and has since become a permanent feature of the Medicare Benefits Schedule. Services Australia reports that Medicare-subsidised telehealth consultations now represent over 20% of all GP consultations, with more than $2.5 billion in Medicare telehealth rebates paid annually. Allied health, mental health, and specialist services have all embraced telehealth MBS items as a permanent care delivery channel.

This scale creates proportional cybersecurity risk. Every telehealth consultation involves the real-time transmission of health information — symptoms, diagnoses, treatment plans, and in many cases highly sensitive mental health content — across internet infrastructure. If that infrastructure is not properly secured, patient privacy is at risk. If consultation recordings are stored without encryption on non-compliant platforms, you face a serious Notifiable Data Breach (NDB) exposure.

The Australian Digital Health Agency (ADHA) has published a telehealth security framework that outlines the minimum technical and governance requirements for Medicare-eligible telehealth services. Meeting these requirements is not just good practice — for providers integrated with My Health Records and the Healthcare Identifier Service, it is a contractual and regulatory obligation.

Telehealth Platform Selection: Security Matters

Not every video platform is appropriate for Medicare-eligible telehealth consultations. The platform you choose must meet minimum security standards: end-to-end encryption for video and audio, Australian data storage, session access controls, and no third-party advertising data use. The following platforms are commonly used in Australian healthcare:

Security Requirements for Video Consultations

A telehealth consultation that transmits health information must meet specific technical security standards to satisfy your Privacy Act obligations. The following controls are non-negotiable for any Medicare-eligible telehealth service:

Patient Consent for Telehealth: What Must Be Recorded

Patient consent for telehealth is both a clinical and a legal requirement. Under MBS telehealth rules, patients must consent to the telehealth modality. Under the Privacy Act, patients must understand how their health information will be captured, stored, and protected during a telehealth consultation.

Your consent record must document: the date consent was obtained, that the patient was informed of the telehealth modality, that the patient was informed of how data is stored and secured, and that the patient agreed to proceed. For psychology and mental health services, where extra-sensitive information is shared, your consent process should also specifically address session recording — confirming the patient's understanding of whether the session will be recorded, where that recording will be stored, and who will have access to it.

Data Sovereignty: Where Patient Data Must Reside

Under APP 8 of the Privacy Act, transferring patient health information to an overseas server requires either explicit patient consent or a determination that the overseas recipient is bound by privacy protections substantially similar to Australia's. For most healthcare providers, the practical answer is: keep all telehealth data in Australia.

This means: consultation video recordings must be stored on Australian servers; session metadata (patient name, date, consultation notes) must be stored in an Australian data centre; and any platform you use must contractually commit to Australian data residency for your account's data. When evaluating a telehealth platform, ask the vendor directly: "Where are consultation recordings stored?" and "Where is our patient data processed and stored?" Get the answer in writing.

The ADHA requires that any platform integrated with My Health Records stores all associated health data within Australia. This requirement cascades to telehealth platforms connected to the My Health Record system.

Network Security for Telehealth Delivery

The network over which a telehealth consultation is delivered is as important as the platform used. A clinician conducting a consultation over a home Wi-Fi network using a consumer router bought from JB Hi-Fi with unchanged default credentials is transmitting sensitive patient information over an unsecured channel — regardless of whether the platform itself uses end-to-end encryption.

My Health Records and Telehealth Integration

Providers integrated with My Health Record may upload telehealth consultation summaries — similar to any other consultation summary. These uploads are subject to the same security obligations as all My Health Record interactions: they must be made through conformant clinical software, using healthcare provider credentials authenticated through PRODA, with audit logging of all access and uploads.

Do not upload telehealth session recordings to My Health Record. Only structured clinical documents — consultation summaries, referrals, specialist letters, and similar — are appropriate for My Health Record upload. For detailed obligations under the My Health Records Act 2012, see our My Health Records security compliance guide.

Related Resources