The short answer: if your practice holds patient health information, the Privacy Act applies to you regardless of turnover. The parts that touch your IT are APP 11 (keep personal information secure, and destroy it when you're done with it), APP 8 (know what happens when an overseas vendor handles it), and the Notifiable Data Breaches scheme (tell people and the regulator if a breach is likely to cause serious harm). None of this requires guessing — the OAIC publishes exactly what "reasonable steps" means.
Checked October 2026. Sources are listed at the end.
Does the Privacy Act apply, no matter how small the practice is?
Yes. Businesses with turnover under $3 million are exempt from most of the Privacy Act — except health service providers, who are specifically excluded from that exemption. The OAIC's own guidance lists who's covered regardless of size: "a traditional health service provider, such as a private hospital, a day surgery, a medical practitioner, a pharmacist and an allied health professional," along with complementary therapists and a handful of other categories. A one-dentist practice and a fifty-chair clinic sit under the same obligations.
That matters for IT decisions specifically, because a lot of small-business software and hosting is priced and built for businesses that don't have to think about this. Your practice does.
What does APP 11 actually require?
APP 11 requires "reasonable steps" to protect personal information from misuse, loss and unauthorised access — and to destroy or de-identify it once you no longer need it. The OAIC splits this into two kinds of steps:
- Technical: encryption, strong passwords, antivirus, secured physical access to servers and devices, and properly wiping hardware before disposal.
- Organisational: staff training, written procedures, access controls with an audit trail, and a documented policy for when information gets destroyed rather than kept forever "just in case."
What counts as "reasonable" isn't a fixed checklist — the OAIC says it scales with how sensitive the information is, how much of it you hold, and what harm a breach would cause. Health information is treated as sensitive information under the Act, which pushes a practice toward the more rigorous end of that scale, not the minimum.
What do you need to check before using an overseas cloud vendor?
APP 8 doesn't ban overseas vendors. It makes you accountable for what happens to the information once it's overseas, which is a different and more involved obligation than just picking a provider with good reviews. Before you sign up to (or keep using) a cloud tool that stores or processes patient data offshore, the OAIC's guidance points to:
- A contract that limits what the vendor can do with the information — not a generic terms-of-service page, but terms that name the permitted purposes and bind any subcontractors to the same rules.
- Security measures that meet the same bar as APP 11 — ask what they actually are, not whether the vendor says it's "secure."
- A way to check compliance, not just trust — and the ability to walk away if a vendor changes its policies without telling you.
Some cloud storage arrangements count as your own "use" of the information rather than a disclosure to the overseas recipient, provided the contract gives you effective control over how it's handled. That distinction has real consequences for your obligations, so it's worth getting right rather than assumed.
What happens if there's a data breach?
The Notifiable Data Breaches scheme requires you to notify affected individuals and the OAIC when a breach involving personal information is "likely to result in serious harm." Not every lost laptop or misdirected email clears that bar — but deciding whether it does requires knowing what information was involved and how sensitive it was, which is hard to work out in the moment if nobody has mapped what you hold beforehand.
Privacy Act obligations vs what small practices usually have
| Obligation | What it requires | Common gap |
|---|---|---|
| APP 11 — Security | Reasonable technical and organisational steps, plus destruction when no longer needed | No written policy; passwords and access controls left to habit |
| APP 8 — Cross-border disclosure | A contract and due diligence before an overseas vendor handles the data | Cloud tools adopted without checking where data is hosted or what the contract says |
| NDB scheme | Notify individuals and the OAIC if a breach is likely to cause serious harm | No breach response plan, so nobody can quickly tell if the bar is met |
A practical checklist
- Map what personal information you hold and where. Practice management software, imaging, email, backups, and any spreadsheet someone built years ago. You can't secure or assess a breach in what you haven't listed.
- Check who can access it, and whether that access is still needed. Former staff logins and shared passwords are the most common finding on this point.
- List every vendor that touches patient data, including where they host it. This is your APP 8 list. If you don't know, ask the vendor directly.
- Confirm encryption and backup practices meet a documented standard, not just "it's probably fine." Our ransomware backup testing guide covers what a tested backup actually looks like.
- Write down what happens if something goes wrong — who assesses it, who decides if it's notifiable, and who actually contacts the OAIC. Deciding this during an actual breach costs time you don't have.
If you'd like this run over your own setup, the free IT health check covers security, backups and where your data actually lives, in plain English, with no obligation attached.
If something has already happened, call 03 7057 1878 — evenings until 9pm, Saturdays 8am–4pm, and a Sunday emergency line from 9am to 5pm. See after-hours cover for how that works.
Sources
- Rights and responsibilities, OAIC: who the small business exemption does and doesn't cover, including health service providers.
- Chapter 11: APP 11 — Security of personal information, OAIC: reasonable steps, technical and organisational measures, destruction and de-identification.
- Chapter 8: APP 8 — Cross-border disclosure of personal information and Sending personal information overseas, OAIC: obligations before using an overseas vendor.
- Notifiable Data Breaches, OAIC: what counts as an eligible data breach and the notification obligation.