Understandably most people are sensitive about protecting their personal health information. For this reason, Australia’s privacy laws give heath information a higher level of protection than other types of personal data.

However, the myriad of privacy laws that apply to health information make it challenging for health providers to know and comply with their obligations.  

This week’s release of new health privacy guidance by the Australian Privacy Commissioner is a welcome move, as is the recent guidance issued by the Australian Medical Association on taking clinical images with personal devices.


‘Health information’ is defined in the Privacy Act 1988 (Cth) to mean:

  • information or an opinion about an individual’s health or disability, an individual’s expressed wishes about future health services provided to them, or a health service provided or to be provided to that individual
  • other personal information collected to provide or in providing a health service, or in connection with organ donation
  • genetic information about an individual in a form that could be predictive of their health.

Examples include medical and dental records, notes of symptoms or diagnosis and treatment provided, records about an individual held by a fitness club or gym, and photos taken of a patient’s injury or symptom.


This is particularly so for health service providers operating in multiple jurisdictions across Australia.

The Privacy Act protects health information and imposes obligations on all private sector ‘health service providers’. If you provide a health service (even if that’s not your primary activity) and hold health information, you will be a ‘health service provider’.

The Personally Controlled Electronic Health Records Act 2012 (Cth) regulates the collection, use and disclosure of health information included in an individual’s e-health record, and the Healthcare Identifiers Act 2010 (Cth) regulates the use and disclosure of health care identifiers used in the e-health record system.

State and Territory government health departments (and other public health networks, districts and services) must comply with their local privacy legislation when handling health information, as well as other types of personal information[1].

Some States even have their own legislation that private sector providers must also comply with[2]. Confusingly, laws vary between States and Territories and there is also significant overlap between the Federal and State/Territory laws.


This week the Office of the Australian Information Commissioner (OAIC) released a new series of draft health privacy resources for health service providers and consumers.

The consultation drafts, released for public comment, follow on from last year’s reforms to the Privacy Act, and the publication of the OAIC’s Australian Privacy Principles (APP) Guidelines. When finalised, they will replace all existing health privacy guidelines of the OAIC.

The new draft health privacy resources provide much more detailed guidance for health service providers than is currently available in the APPs.

They include information on privacy issues that arise most frequently for the health sector and guides for collecting, handling, using, disclosing and providing access to patients’ health information (including for health management and research purposes).

The closing date for comments on the draft resources is 20 October 2015.


The new wave of medical apps is making it increasingly easy for medical practitioners to take and circulate images of their patients’ injuries and symptoms, whether for professional (or other) collaboration with colleagues.

However, mobile health apps raise privacy concerns and potential Therapeutic Goods Administration (TGA) issues. See our recent article Mobile apps that collect health data: Will they be put under the privacy spotlight? for more on this.

Studies[3] show that an increasing number of doctors use their personal devices to take and transmit clinical images, and then store the images personally including using offshore cloud email services such as Gmail and Hotmail.

Clinical images – whether a photo, video or audio recording – will generally be ‘health information’ which is protected under Australian privacy laws. Clinical images are part of a patient’s medical record, and the same confidentiality and privacy obligations apply.

Recognising these issues, the Australian Medical Association (AMA) last year released a guide for doctors and medical students in the proper use of personal mobile devices such as smart phones and tablets when taking and transmitting clinical images.

It highlights the legal and ethical issues that medical practitioners must be alert to, when using a personal device to take and store clinical images and sending them to others.

The guide suggests processes for obtaining patients’ informed consent before taking clinical images, and for documenting, capturing, storing securely, disclosing, sending, deleting and de-identifying clinical images. The processes align with the requirements of privacy legislation for the handling of health and other personal information.

The guide also highlights that the doctor or medical student’s place of work may well have its own policies and contractual requirements relating to clinical images and the use of personal devices.

While “digital health” is empowering people to better manage, track and improve their own health and live longer, and offers enormous benefits and cost savings for providers, it remains a minefield for privacy and data security.

Health service providers must be alert to the privacy implications that attach to their business and operations – the consequences of not complying with privacy laws are significant and expensive!