Ask most small business owners whether the Privacy Act 1988 applies to them and they will tell you, correctly, that it does not. The Act has a small business exemption: organisations with an annual turnover of $3 million or less are generally outside it.
Ask the owner of a two-practitioner physiotherapy clinic the same question and the honest answer is different. The exemption does not apply to them. It is one of the most common and most consequential misunderstandings we come across in the health sector, and it is worth spelling out plainly.
The exemption has a carve-out, and health is in it
The small business exemption is not unconditional. The Act lists categories of small business that remain covered regardless of turnover, and one of them is any organisation that provides a health service and holds health information — other than in an employee record.
That wording is broad by design. It captures general practices, dental practices, physiotherapists, psychologists, podiatrists, chiropractors, dietitians, occupational therapists, and a long list of other allied health services. It also captures organisations that would not describe themselves as health providers at all but do provide a health service as part of what they do — which is why some disability and community services find themselves covered when they assumed otherwise.
Turnover is irrelevant. A sole-practitioner clinic and a hospital group are held to the same core obligations.
Why it matters more for health than for other data
Under the Act, health information is classified as sensitive information, which attracts the strongest protections it offers. Collection generally requires consent, use and disclosure are more tightly constrained, and the "reasonable steps" you are expected to take to secure it are judged against how sensitive it is and how much harm a breach would cause.
That last point is the practical one. A breach of a retail customer list is unpleasant. A breach of clinical notes, mental health records or a patient's medication history can cause serious, lasting harm to the individual — and the regulator, the courts and the public treat it accordingly. In the Office of the Australian Information Commissioner's periodic Notifiable Data Breaches reports, health service providers have consistently been among the sectors reporting the most breaches. That is partly because the sector is large, and partly because it is a deliberate target: the data is valuable and small practices are often lightly defended.
What you are actually obliged to do
Being covered by the Act means the Australian Privacy Principles apply to you. Boiled down to what matters day to day for a small practice:
- Collect only what you need, with consent. Intake forms that hoover up information "just in case" create obligations you then have to meet for data you never use.
- Tell people what you do with it. A clear, accurate privacy policy and collection notice — not a template copied from a website that describes a business unlike yours.
- Keep it secure. Take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. What counts as reasonable scales with sensitivity, and health information sits at the top of that scale.
- Destroy or de-identify it when you no longer need it — subject to any record-retention requirements that apply to your profession, which often require records to be kept for years.
- Give people access to their own information when they ask, and correct it when it is wrong.
The Notifiable Data Breaches scheme
Covered organisations are also subject to the Notifiable Data Breaches scheme. If you experience an eligible data breach — unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to the individuals concerned, and you cannot prevent that harm through remedial action — you must notify both the OAIC and the affected individuals.
For a practice, "likely to result in serious harm" is a low bar. Clinical information is close to the definition of information whose exposure causes serious harm. That means the realistic question in most incidents is not whether you must notify but how quickly you can establish what was accessed, contain it, and notify accurately.
Practices connected to My Health Record carry an additional, separate obligation under the My Health Records Act 2012, which has its own mandatory breach notification requirements to the OAIC and the System Operator — and that scheme is not limited to breaches likely to cause serious harm.
What "reasonable steps" look like for a small practice
The Act does not prescribe technology. It expects steps proportionate to the risk. For a small medical or allied health practice, the steps that matter most are also the ones most often missing:
- Individual logins for every staff member. Shared front-desk logins mean you cannot establish who accessed what, which undermines both your obligations and any investigation after an incident.
- Multi-factor authentication on every account that reaches patient data, including email. Most breaches of small practices begin with a compromised mailbox, not a sophisticated attack.
- Automatic screen locking on reception and consulting-room machines, set short enough to matter and fast enough to unlock that staff do not work around it.
- Backups that have actually been restore-tested. A backup nobody has restored from is a hope, not a control. Recovery time should be known, not discovered during an incident.
- Devices kept in support and patched. An unsupported operating system on a consulting-room PC is an open door, and "it still works" is not a defence.
- A written response plan that names who does what if something goes wrong, including how you would meet the notification obligations above within a reasonable timeframe.
None of this requires enterprise tooling. It requires a deliberate setup — the kind we build for medical and allied health practices as a matter of course, and the same foundation we apply for NDIS and disability providers, who face closely related obligations.
Two questions worth answering this week
Do we know what we hold, and where? Most practices cannot answer this precisely. Patient data usually lives in the practice management system, but also in email, in scanned documents on a shared drive, on a receptionist's desktop, and on a departed clinician's laptop. You cannot protect what you have not located.
If the practice management server died tonight, when would we see patients again? If the honest answer is "we would find out", that is the highest-value thing to fix. The backup and continuity conversation is a short one, and it removes the scenario a practice genuinely cannot afford.
A note on advice
This article describes the framework in general terms. It is not legal advice, and the specifics of your obligations depend on how your practice is structured and what it does. The OAIC publishes guidance for health service providers that is worth reading directly, and if there is any doubt about whether you are covered, a short conversation with a privacy lawyer is a good investment relative to finding out the other way.
What we can say without qualification is that if you provide a health service and hold health information, planning on the basis that the Privacy Act does not apply to you is a mistake — and the security baseline to close that gap is smaller and less disruptive than most practice owners expect.
*Last updated: 17 September 2026.*