For healthcare practices
Privacy compliance for healthcare practices, without the legal bill
Health information carries stricter rules, and health service providers are covered whatever their turnover. Get your policy, consent and breach plan in order.
10 minutes. No account needed for the score.
Why businesses trust Savira
- Australian owned
- Data hosted in Australia
- Built for the Australian Privacy Principles
- ABN 53 273 071 022
Why it matters for your practice
What makes healthcare different
No small business exemption
Health service providers are covered by the Privacy Act regardless of turnover.
Stricter rules for health information
Health information is sensitive information, with tighter rules on collection and use.
Tracking pixels in focus
The OAIC has made determinations about pixels on health websites.
Breach notification
Eligible data breaches must be reported to affected people and the OAIC.
Want the detail? Read: Health service providers and the Privacy Act
What Savira does for your practice
Your policy, consent and records in one place
- A privacy policy template for health providers
- A website banner that holds pixels until patients agree
- Breach notification templates for patients and the OAIC
- Staff training with healthcare scenarios
Ella's journey
Follow one person through your practice
- 1 · Book
Ella books online.
Savira: A collection notice on the booking form.
- 2 · Consent
She agrees to SMS reminders.
Savira: Her consent is logged with a timestamp.
- 3 · Track
Your site loads an ad pixel.
Savira: Held until she says yes.
- 4 · Ask
She asks what you hold about her.
Savira: A response template and a 30 day reminder.
- 5 · Prove
The OAIC asks what you did.
Savira: One export shows each step.
Your action plan
What to do, and when
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
Keep it current
- Review overseas providers
- Prepare for automated decision rulesLegal review
- Review your policy every year
Healthcare privacy checklist
A one page PDF you can work through this week. We email it to you.
We are a small practice. Does the small business exemption cover us?
No. Providing a health service removes the exemption entirely, regardless of turnover. A single-practitioner clinic has the same obligations under the Australian Privacy Principles as a large group.
How long do we have to keep patient records?
That is set by state and territory health records legislation rather than the Privacy Act, and the periods differ. Records for minors generally have to be kept until a specified age. Check the rules in your jurisdiction, then set retention periods you can actually apply, because holding records indefinitely is its own risk.
Does our website need a cookie banner if patients book through a third-party tool?
The Privacy Act does not name cookie banners as a requirement. It does require you to tell people what you collect and why, and to get consent before collecting sensitive information such as health details. If your site runs analytics or advertising scripts, a banner that holds them back until people agree is the most practical way to do that. A banner on its own is not enough, though. Visitors must be able to decline as easily as they accept, and declining has to actually stop the tracking.
Our privacy policy mentions paper records and not much else. Is that a problem?
It is, because a policy has to reflect what you actually do. Most practices have added online booking, a patient portal, telehealth, SMS reminders and analytics since the policy was written. Health information carries stricter obligations than most personal information, so a policy that understates what you collect is a poor position to be in.
A patient has asked for their records. Do we have to hand them over?
Generally yes, under APP 12, with limited exceptions such as where access would pose a serious threat to someone's life or health. Have a documented process covering who assesses a request and within what timeframe, and make sure it accounts for information held outside the clinical system, including the booking tool and the mailing list.
How long does setup take?
Most businesses complete the risk scorecard and publish a privacy policy in their first session. If you run analytics or ads on a WordPress site, the cookie banner takes about 10 minutes more.
Can I export my compliance records?
Yes. Every account includes your compliance logs: consent records, the notices and emails you have sent, and your published policies, ready to export.
Get the foundations in place this week
Free forever on Starter. No credit card. Built for the Australian Privacy Principles.