Health practice privacy checklist: what to fix first

Does the Privacy Act apply to every healthcare practice?

Yes. Health service providers get no small business exemption, so every practice is covered by the Privacy Act 1988 (Cth) and must follow the Australian Privacy Principles (APPs), regardless of turnover or staff numbers. Health information is also "sensitive information", which means stricter rules apply to how you collect, use and share it.

Regulators are no longer only looking at what happens in the clinic. In June 2026, the Office of the Australian Information Commissioner (OAIC) found two health providers breached the Privacy Act through tracking pixels on their websites. With court-ordered penalties now up to $50 million for serious interferences with privacy, your website deserves the same care as your patient files.

Who counts as a health service provider?

The definition is deliberately broad (we explain why the Privacy Act applies to health service providers in more detail). It goes well beyond hospitals and GPs to cover a wide range of organisations that handle health information as part of what they do, including:

• general practitioners, specialists and private hospitals

• pharmacies, pathology and radiology

• psychologists, physiotherapists, dentists, optometrists and other allied health practitioners

• aged care, disability, and drug and alcohol services

• IVF and fertility clinics, and blood and tissue banks

• complementary medicine practitioners

• telehealth providers and online health services

• gyms and weight loss clinics

• private schools and childcare centres.

Not sure where you fit? If your organisation collects, holds, uses or discloses information about the health of identifiable people, in any setting, you have obligations under the Privacy Act. Get advice on your specific circumstances, particularly if you handle information through websites, apps or third-party software.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the OAIC's powers. It can now issue infringement notices for certain breaches, use stronger investigation and information-gathering powers, and run public inquiries into systemic privacy practices across sectors, including healthcare.

2. Significantly higher penalties

Courts can order penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover, for a company’s serious interference with privacy (Privacy Act s 13G). Lower-tier penalties and OAIC infringement notices now apply to less serious breaches. For providers handling sensitive health data, that exposure is substantial.

3. Individuals can now sue

The statutory cause of action for serious invasions of privacy commenced on 10 June 2025. People can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Non-economic damages are capped at AU$500,000. For providers with systemic data handling failures, this creates real litigation and class action risk.

4. Tracking pixels on health websites need consent

In June 2026, the Privacy Commissioner found that using tracking pixels to follow visitors to health-related websites, and then target them with social media ads, is a collection of sensitive information. Where pixels collect sensitive information like this, the website provider must get consent. If your website runs analytics, advertising or retargeting tools from third-party platforms, this decision applies to you. Here's what the OAIC found about tracking pixels.

Why is healthcare under the regulator's spotlight?

Health information is among the most sensitive information anyone can share. When it is mishandled, whether in a clinic, on a website or through a third-party platform, the consequences for patients can be serious, and regulators treat any failure that way.

Risk areas the OAIC has flagged for health providers include:

• third-party pixels on your website firing before consent is captured

• privacy policies that don't match how you actually handle data

• collecting more than you need during patient intake

• weak security over patient records held in cloud systems

• staff sharing health information in ways the patient didn't expect or agree to.

The OAIC's June 2026 determinations against Medmate Australia and Monash IVF found both providers interfered with the privacy of people whose sensitive information was collected through third-party tracking pixels on their telehealth and fertility websites. Alongside them, the OAIC published findings from an inspection of 50 health service provider websites. That's a clear signal the regulator is actively checking the sector's digital practices, not just waiting for complaints.

It's also what patients expect. The Privacy Commissioner noted that 9 in 10 Australians consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data.

A real example: disclosing to police

The OAIC found a GP had disclosed a patient's health information to a police officer without valid authority. Even though police are an "enforcement body", the GP couldn't rely on the enforcement exception, because there was no evidence the disclosure was connected to an actual enforcement activity. The GP hadn't considered the risks of disclosing without consent, and the patient's privacy complaint succeeded.

Which Australian Privacy Principles matter most in healthcare?

• APP 1, open and transparent management: Keep a current, accurate and accessible privacy policy covering what you collect, why, how you use and disclose it, and how patients can access, correct or complain. Many practice policies are out of date, don't mention website data collection, or leave out third-party software and cloud providers.

• APP 2, anonymity and pseudonymity: Consider whether patients can practicably stay anonymous or use a pseudonym. Where that's lawful and practical, such as some counselling or information services, offer it and say so in your privacy policy.

• APP 3 and APP 5, collection and notification: Collect health information directly from the patient, by lawful and fair means, only with consent and only where it's reasonably necessary. At or before collection, tell the patient who you are, why you're collecting it, how it will be used, and how they can access it or complain. That covers your website and intake forms, not just conversations in the clinic.

• APP 6, use and disclosure: Use or disclose health information only for the primary purpose you collected it for. Secondary uses, such as marketing, research or sharing outside the treating team, need consent or must fit a specific exception. Sending promotional emails to patient contact lists is a common and avoidable breach.

• APP 7, direct marketing: You can't use health information for direct marketing without consent, and patients must always have a working opt-out. The OAIC can issue infringement notices for direct marketing breaches. This covers appointment reminders with promotional content, newsletters and any targeted advertising using patient data.

• APP 8, cross-border disclosure: Sending patient data overseas, including through cloud-hosted practice management software, overseas pathology platforms and US-based analytics or advertising tools, triggers APP 8. You need to take reasonable steps to make sure overseas recipients uphold comparable privacy protections. Relying on a platform's standard terms is increasingly not enough.

• APP 11, security: Take reasonable steps to protect patient information from misuse, interference, loss, and unauthorised access, modification or disclosure. That includes governance and training, ICT security controls, access management, physical security, reviewing third-party providers, and de-identifying or destroying records you no longer need.

• APP 12 and APP 13, access and correction: Patients have a right to access the health information you hold about them, and you must generally respond within 30 calendar days. If you refuse, give a written notice explaining why and how they can complain. You must also correct information that is inaccurate, out of date or misleading when asked.

• Notifiable Data Breaches (NDB) scheme: If patient data is accessed, changed, disclosed, lost or used without authorisation and this is likely to cause serious harm, you must notify the OAIC and the people affected. Extra notification obligations apply to breaches involving My Health Record data. Have a documented breach response plan in place before a breach happens, not after.

What should your practice do now?

Work through privacy in three stages. Close the most urgent gaps first, build the systems and culture for ongoing compliance next, then make privacy part of how your practice runs.

Immediate: 0 to 3 months

1. Audit your website for third-party tracking pixels from Google, Meta, LinkedIn and similar tools, and confirm none fire before valid patient consent is captured.

2. Update your privacy policy so it accurately reflects how you collect, hold, use and disclose health information, including through your website and third-party software.

3. Check that intake forms and in-clinic collection include a compliant privacy notice patients receive before they hand over information.

4. Confirm patient contact details aren't used for promotions or marketing without documented consent and a working opt-out.

5. Appoint a privacy lead or point of accountability within the practice.

6. Tighten access to clinical and admin systems: remove dormant accounts and enforce stronger authentication for everyone who accesses patient records.

Medium term: 3 to 12 months

1. Put in place a privacy management plan aligned to the OAIC's four-step framework: embed, establish, evaluate, enhance.

2. Document all the personal information your practice holds, how it's collected, where it's stored and how long it's kept.

3. Review all third-party software, cloud storage and overseas service providers for APP 8 compliance and proper data processing arrangements.

4. Set data retention schedules and delete or de-identify records you no longer need.

5. Build a data breach response plan covering identification, containment, assessment, notifying the OAIC and affected patients, and review.

6. Train all staff on the obligations specific to their role, since clinical, admin and reception staff each face different risk points.

7. Document how you receive and respond to access and correction requests within the 30-day timeframe.

Strategic: 12 to 18 months

1. Keep an eye on reforms affecting healthcare, particularly automated decision-making in clinical tools, AI-assisted diagnostics and children's health data.

2. Run privacy impact assessments before rolling out new digital health tools, patient portals or AI-assisted clinical software.

3. Make consent management a default design requirement for every patient-facing digital touchpoint, rather than a retrofit.

4. Build privacy risk into practice governance, board or management reporting, and professional indemnity insurance reviews.

5. Treat privacy capability as a genuine point of difference with patients and referring providers.

6. Review state and territory health privacy laws in each jurisdiction you operate in, as obligations may differ from Commonwealth requirements.

Healthcare privacy checklist

Use this to keep the team accountable. Give each item an owner and track progress.

• Privacy policy: Update it now to reflect current data practices, website tracking and third-party tools. Next, schedule an annual review with a named owner.

• Website and pixels: Audit and remove, or gate behind valid consent, every third-party tracking pixel now. Next, make consent-first tagging standard for any new website or digital tool.

• Collection notices: Confirm intake forms and in-clinic processes include a compliant privacy notice now. Next, standardise notices across every clinic and intake channel.

• Direct marketing: Confirm every patient contact list has documented consent and a working opt-out now. Next, review governance of your patient database and set consent expiry rules.

• Third-party vendors: Identify every software tool that processes patient data and review it for APP 8 compliance now. Next, put data processing agreements in place and fix non-compliant providers.

• Security: Tighten access controls, remove dormant accounts and enforce MFA on clinical systems now. Next, commission periodic risk assessments and review physical and ICT security.

• Breach response: Name a breach response lead and document your steps now. Next, formalise and test a breach response plan and keep a breach register.

• Access requests: Document how you'll respond to patient access requests within 30 days now. Next, train staff and track active requests.

• Training: Run an initial all-staff session with role-specific examples now. Next, build an annual refresher with scenario-based exercises into the calendar.

• Governance: Appoint a privacy lead and document a privacy management plan now. Next, build privacy risk into practice governance, reporting and your risk register.

A one page PDF you can work through this week. Download it here.

Get the checklist

How Savira helps healthcare practices

Getting the foundations right now means less rework, less risk and more confidence when the regulator comes looking.

Savira handles the parts of privacy compliance that are ongoing rather than one-off. Generate and maintain a privacy policy that reflects how your practice handles health information, collect consent through your website, and keep an auditable record of who agreed to what and when, so you can answer a patient or a regulator without digging through inboxes.

Whether you run a single clinic or a multi-site group, you get the compliance foundations without needing a consultant or a developer. See how Savira works for healthcare practices.

This guide was last updated 28 August 2026 to reflect the OAIC's June 2026 tracking pixel determinations against Medmate and Monash IVF, and the publication of the OAIC's "Your life, pixelated" report. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Source: Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation (OAIC). To see where your practice stands, get my risk score.

Content type: Explainer

Category: Who the Privacy Act covers

Excerpt: See what the Privacy Act expects of your healthcare practice, why your website is now in the regulator's sights, and the steps to take first.

Source title: Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation

Source URL: https://www.oaic.gov.au/news/media-centre/privacy-commissioner-finds-privacy-breaches-in-third-party-tracking-pixel-investigation