Telehealth Privacy and Security in Australia

When you use a telehealth service, you share some of your most sensitive personal information: symptoms, medical history, medications, mental health status. Understanding how that information is legally protected - and what questions to ask before you share it - helps you make informed decisions about which services to use.

Australia has a comprehensive legal framework protecting health information. For telehealth services, the primary legislation is the Privacy Act 1988 (Cth), supplemented by state and territory health records legislation and professional obligations under AHPRA registration.

Under the Privacy Act 1988 (Cth), "health information" is classified as a subset of "sensitive information" - the highest-protection category. Health information includes:

• Information about your physical or mental health or disability
• Information about your expressed wishes about future healthcare
• Information about health services provided to you
• Genetic information that could predict the health of an individual

Sensitive information attracts stronger protections than general personal information. Under Australian Privacy Principle 3 (APP 3), an organisation generally cannot collect sensitive information without your express (rather than merely implied) consent, and only when the collection is reasonably necessary for the organisation's functions.

For a telehealth service, this means: they can collect the health information you provide in order to deliver a medical consultation and any associated documents. They cannot collect additional sensitive information beyond what is needed, and they cannot repurpose that information without separate consent.

The 13 Australian Privacy Principles (APPs) are the core rules in the Privacy Act 1988. For telehealth specifically:

APP 1 - Open and transparent management: The organisation must have a clearly expressed, up-to-date privacy policy that covers what information is collected, how it is used, how it is stored, and how you can access or correct it. The privacy policy must be freely available on the website.

APP 3 - Collection of personal information: Health information can only be collected with your consent and when reasonably necessary for the purpose. Collecting more than needed is not permitted.

APP 6 - Use or disclosure for secondary purposes: Information collected for a telehealth consultation can only be used for that consultation and directly related purposes. Using your health data for marketing, selling it to third parties, or sharing it with unrelated entities requires your separate consent or must fall within one of the narrow legal exceptions.

APP 11 - Security of personal information: The service must take reasonable steps to protect personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure. For health information, this includes:

• Encryption of data at rest and in transit
• Access controls ensuring only authorised personnel can view records
• Secure deletion or de-identification when information is no longer needed

APP 12 - Access to personal information: You have the right to access personal information held about you. The organisation must respond within a reasonable time (typically 30 days) and may only refuse in limited circumstances defined in the Act.

APP 13 - Correction of personal information: If information held about you is inaccurate, out of date, incomplete, or misleading, you have the right to request correction.

Since 2018, the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 has required organisations to notify both the OAIC and affected individuals of eligible data breaches.

An eligible data breach occurs when there is unauthorised access to, or disclosure of, personal information, and the breach is likely to result in serious harm to any individual whose information was involved.

Health information breaches are more likely than most categories to meet the "serious harm" threshold, given the sensitivity of the data and the potential consequences (identity theft, insurance discrimination, employment consequences, personal distress).

Under the NDB scheme, telehealth services must:

• Assess potential breaches within 30 days
• Notify the OAIC as soon as practicable if an eligible breach is confirmed
• Notify affected individuals directly (by email, post, or prominently on the website if direct notification is impractical)
• Include in the notification: what happened, the type of information involved, recommended steps you can take

If you are notified of a data breach by a telehealth service, you can make a complaint to the OAIC at oaic.gov.au.

Beyond legal requirements, reputable telehealth services implement technical security measures consistent with healthcare data standards:

Encryption: Health information should be encrypted both in transit (using TLS 1.2 or higher for all web communications) and at rest (AES-256 or equivalent for stored data). This means that even if data is intercepted in transit or if storage media is physically accessed, the information is unreadable without the encryption keys.

Access controls: The principle of minimum necessary access means only the practitioners and staff directly involved in your care can access your records. Administrative staff, billing teams, and technical staff should have access to different data layers appropriate to their function.

Authentication: Secure telehealth platforms require strong authentication for practitioner access - typically multi-factor authentication - to prevent unauthorised account access.

Audit logging: Legitimate services maintain logs of who accessed health records and when. This creates accountability and allows the service to investigate any suspected unauthorised access.

In addition to the federal Privacy Act, state and territory health records legislation adds further protections in some jurisdictions:

• New South Wales: Health Records and Information Privacy Act 2002 (HRIPA)
• Victoria: Health Records Act 2001
• Australian Capital Territory: Health Records (Privacy and Access) Act 1997

These state laws provide additional rights specific to health information and complement the federal Privacy Act framework. In states without specific health records legislation, the Privacy Act provides the primary framework.

The My Health Record system (established under the My Health Records Act 2012) is Australia's national shared digital health record. If you have a My Health Record, certain healthcare encounters may result in records being shared to it, subject to the specific settings you have configured.

Telehealth consultations can generate records that are uploaded to My Health Record. You control access to your My Health Record through the digital government portal (myhealth.gov.au), including which healthcare providers can access it, which records are visible, and whether documents can be uploaded.

Risk check

View larger image

Shared devices, public Wi-Fi, visible screens, wrong email, and unnecessary data sharing can create risk.

You can:

• Review what is in your My Health Record
• Set access controls for specific providers
• Download your records at any time
• Remove records (though the original data source retains them under their own retention obligations)

Telehealth services that upload consultation records to My Health Record should explain this to you and it should be covered in their privacy policy.

Before using a telehealth service for the first time, verify the following:

AHPRA-registered practitioners: The service should confirm its doctors are AHPRA-registered and their registration should be verifiable at ahpra.gov.au. An unregistered practitioner holding your health data has no professional accountability for its use.

Privacy policy: Read it. Specifically look for: what data is collected, how it is stored, who it may be shared with, how long it is retained, and how to exercise your access and correction rights.

LegitScript certification: LegitScript is an independent certification body for online healthcare services. LegitScript-certified services have been verified as operating within applicable regulatory frameworks.

Data residency: For health data, Australian data storage is preferable (and may be required by some state legislation). Check whether the service stores data in Australia or offshore.

Breach notification procedure: Does the privacy policy describe what happens in the event of a data breach? A service that has not thought about this is less likely to have adequate security practices.

If you believe a telehealth service has breached its privacy obligations, you have several options:

1. 1

   Raise it directly with the service: Most issues can be resolved at this stage. The service should have a formal complaints process described in its privacy policy.

1. 1

   Complain to the OAIC: If the issue is not resolved to your satisfaction, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC can investigate, mediate, and take enforcement action including requiring the organisation to change its practices.

1. 1

   State health complaints bodies: Depending on the nature of the complaint, the Health Care Complaints Commission (NSW), Health Complaints Commissioner (VIC), or equivalent bodies in other states may also have jurisdiction.

1. 1

   AHPRA complaint: If the privacy concern relates to the conduct of a specific registered practitioner (rather than the platform), an AHPRA notification is the appropriate mechanism.

• PBS: fees, patient contributions and Safety Net thresholds
• Services Australia: PBS Safety Net thresholds
• Healthdirect: medicines information
• Medical Board of Australia: telehealth consultations with patients
• AHPRA: Register of practitioners
• TGA: advertising a health service