Do you need a cookie consent banner in Australia?
Health service providers are covered by the Privacy Act even as small businesses, so here is what applies to you and what to do next.
Published Updated 6 min read
Health service providers are covered by the Privacy Act 1988 (Cth) even when they are small businesses. If your organisation provides a health service and holds health information, other than in an employee record, the Act applies to you. Turnover does not change that.
That surprises a lot of owners. Most Australian small businesses sit under the $3 million annual turnover threshold and fall outside the Act entirely. Health is one of the carve-outs to that exemption, because health information is treated as one of the most sensitive kinds of personal information there is. The Office of the Australian Information Commissioner (OAIC) sets out the detail on its health and medical research page, and this is the plain English version.
Which businesses count as health service providers?
Under the Privacy Act, a "health service" is broader than most people expect. It covers any activity that involves:
assessing, maintaining or improving someone's physical or psychological health
managing that health where it cannot be maintained or improved
diagnosing or treating an illness, disability or injury
recording someone's physical or psychological health, so that health can be assessed, maintained, improved or managed
dispensing a prescription drug or medicinal preparation, if you are a pharmacist.
It also picks up activities carried out while providing aged care, palliative care, or care for a person with a disability.
So the obvious ones are in: private hospitals, day surgeries, GPs, pharmacists and allied health professionals. The less obvious ones are in too.
Type of business | Covered? | Why |
|---|---|---|
Physio, chiro or podiatry clinic | Yes | Assessing and treating physical health |
Naturopath or other complementary therapist | Yes | Complementary therapies count as health services |
Gym or weight loss clinic | Yes | Activity aimed at assessing or improving physical health |
Pharmacy | Yes | Dispensing prescription medicines |
Childcare centre or private school | Yes | Recording and managing children's health |
If you run a gym, a childcare centre or a wellness studio and you have never thought of yourself as a health business, that last column is the part to sit with.
What the Privacy Act actually asks of you
The Act governs how you collect and handle personal information, including health information. In practice that means being upfront about what you collect and why, only collecting what you genuinely need, keeping it secure, and not using it for something unrelated later on.
It also gives people a general right to access the information you hold about them. If a client asks for their records, you need a process for that, not a shrug.
The Australian Privacy Principles (APPs) are where the day to day obligations live, and a published privacy policy is the front door to all of it.
Can you use health information for research without consent?
Sometimes, but only inside a formal framework. The Privacy Act allows health information to be handled for health and medical research purposes where getting everyone's consent is not practicable. That recognises two things at once: health information should not drift into unexpected uses, and research genuinely matters for public health.
To keep the balance, the Privacy Commissioner has approved two sets of legally binding guidelines issued by the National Health and Medical Research Council (NHMRC), made under sections 95 and 95A of the Act. Section 95 covers personal information disclosed by Commonwealth agencies for medical research. Section 95A covers health information held by organisations, and requires that the public interest in the research substantially outweighs the public interest in privacy. Human Research Ethics Committees (HRECs) use them when deciding whether to approve a research proposal.
If you are a clinic being approached to share patient data for a study, this is the framework the researcher should already be working within. Ask them about it.
What about genetic information?
If a patient gives informed consent, the Privacy Act does not stop you using or disclosing their genetic information.
Where consent has not been possible, there is a narrow exception. A health service provider can use or disclose genetic information where all of the following apply:
the information was obtained while providing a health service to the patient
the provider reasonably believes there is a serious threat to the life, health or safety of a genetic relative
the use or disclosure is necessary to lessen or prevent that threat
the provider has complied with the guidelines issued under section 95AA of the Act
for a disclosure, the person receiving it is a genetic relative.
This is a high bar and it is not a general permission to share family health history. If you are ever weighing it up, get advice before you act.
What to do next
1. Decide whether you are a health service provider
Work through the definition above against what your business actually does, not what your ABN description says. Write down your reasoning so you can point to it later.
2. Publish a privacy policy that matches reality
Say what health information you collect, why, who you share it with and how someone gets access to their own records. Then check your practices match the words.
3. Get collection notices right at the front desk
The moment you take health details, whether on a paper intake form or an online booking, the person should understand what you are collecting and what for.
4. Tighten who can see the records
Reception, contractors, your practice management software vendor. Limit access to the people who need it, and keep it under review.
5. Have a breach plan before you need one
The Notifiable Data Breaches (NDB) scheme applies to you. Health data breaches carry real risk of serious harm, so know your assessment and notification steps in advance.
Frequently asked questions
Does the small business exemption cover my clinic?
No, not if you provide a health service and hold health information. The exemption does not apply to health service providers, whatever your turnover.
Do employee health records count?
Health information held in an employee record, about your own current or former staff, is treated differently under the Act. Client and patient records are the ones this page is about.
My gym takes injury history at sign-up. Am I really covered?
If you are assessing or improving someone's physical health and recording it, that fits the definition of a health service. Worth taking seriously rather than assuming otherwise.
Can a researcher just ask me for patient data?
They can ask, but handling it without consent has to sit within the NHMRC guidelines under sections 95 or 95A, usually with HREC approval. Ask to see it.
This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.
Read the original guidance from the OAIC: Health and medical research.