Privacy Groundwork Before You Adopt AI

Yes. Under the Privacy Act 1988, health information falls within the category of sensitive information, which attracts stricter handling requirements than ordinary personal information, particularly around the circumstances in which it may be collected and the purposes for which it may be used or disclosed. Practically, this means a practice should apply a higher standard of diligence to any supplier that will see health information than it might apply to, say, an accounting package. This is general information rather than legal advice, and practices should seek advice on their specific circumstances.

The answer depends on what the system does with the information, and it is genuinely fact-specific rather than a simple yes or no. Where a system performs an administrative function a practice already performs (taking a booking, for example) and the information is used for the purpose it was collected for, the position is typically more straightforward than where new categories of information are captured or used for a secondary purpose. Separately, if calls are recorded, notification obligations arise under state and territory surveillance devices legislation regardless of the privacy analysis. Most practices address the practical side with a clear notification in the call greeting and an updated privacy policy, and take advice on anything beyond that.

First establish the facts: which countries, which entities, and whether the transfer is storage, processing or both. The Australian Privacy Principles impose specific obligations on cross-border disclosure, including taking reasonable steps to ensure the overseas recipient handles the information consistently with the APPs. Some practices adopt a policy of requiring Australian data residency for anything touching health information, which is simpler to administer even if it narrows the supplier field. Whichever position you take, document the reasoning so the decision is defensible later.

Start by determining whether the material forms part of the medical record, because that determines which retention rules apply. Australian medical record retention requirements commonly run to seven years from the date of last entry for adults, and until age twenty-five for records created while a patient was a child, with variations between states and territories and between practice types. Material that does not form part of the medical record should generally be retained only as long as it is needed for the purpose it was collected. Set the vendor’s retention configuration to match your documented policy rather than accepting their default.

Australia’s Notifiable Data Breaches scheme requires notification to the OAIC and to affected individuals where an eligible data breach occurs and is likely to result in serious harm. Because accountability sits with the practice as well as the supplier, you need to know before you sign how quickly the vendor will inform you, what information they will provide, and who is responsible for notifying patients. Agree this in the contract, and make sure your own practice breach response plan accounts for a breach that occurs at a supplier rather than internally.

No. It is a practical prompt list to help a practice structure its own assessment and ask better questions of suppliers, drawn from general Australian privacy principles. It is not legal advice, it is not exhaustive, and it cannot account for your specific circumstances, jurisdiction, practice type or the particular product you are considering. Obligations also change over time. For decisions with real consequence, and adopting a system that handles health information is one, obtain advice from a qualified professional and confirm the current position with the OAIC and any relevant professional body.