A telehealth consultation generates health information, and health information is protected by the Privacy Act 1988 and the Australian Privacy Principles (APPs) in exactly the same way whether the consult happens in a room or over video. The medium changes nothing about your obligations — but it does add a few practical things to get right.
Here’s what the Privacy Act asks of a practice delivering telehealth. This is general information, not legal advice; check the current OAIC guidance and your own state’s health records laws for the detail.
Health information is “sensitive information”
Under the Privacy Act, health information is a type of sensitive information and attracts a higher level of protection than ordinary personal information (OAIC). One point often missed: health service providers are covered by the Privacy Act regardless of turnover. The small-business exemption that applies to many other operators does not apply to a business providing a health service, so a solo practice is bound just as a hospital is (OAIC).
Most states and territories also have their own health records legislation that sits alongside the Commonwealth Privacy Act. The RACGP’s privacy resources are a good starting point for general practice, and note that both the APPs and the relevant state Act can apply at once.
A telehealth platform doesn’t discharge your privacy obligations for you. Your practice remains the entity accountable for the health information it collects — so the tools you choose need to help you meet the APPs, not quietly undermine them.
The Australian Privacy Principles that matter most
There are 13 APPs in total (OAIC). A handful do most of the work in a telehealth setting.
Openness and notice (APP 1 and APP 5)
You must manage personal information in an open and transparent way — which in practice means having a clear, up-to-date privacy policy — and you must tell patients how their information is collected and handled. If your telehealth process involves anything a patient wouldn’t assume (for example, where consult data is stored, or whether sessions are ever recorded), that belongs in your privacy notice and in what you say at the start of the consult.
Collection (APP 3)
Collect only the health information reasonably necessary for the care you’re providing. Telehealth doesn’t change the principle, but be deliberate about tools that capture more than you need — chat logs, automatic recordings, or transcripts you didn’t intend to keep.
Use and disclosure (APP 6)
Health information collected for a patient’s care is generally used and disclosed for that purpose. Using or disclosing it for an unrelated secondary purpose usually needs consent or another lawful basis. This is worth checking against any third-party tool involved in a consult — the question is always “who else can see this, and why?”
Cross-border disclosure (APP 8)
If your telehealth or storage provider sends personal information overseas — including to offshore servers or support teams — APP 8 is engaged, and you generally remain accountable for how that overseas recipient handles it (OAIC). This is a major reason clinics prefer Australian-hosted software. We cover it fully in telehealth data residency in Australia.
Security (APP 11)
You must take reasonable steps to protect health information from misuse, interference, loss, and unauthorised access, modification or disclosure (OAIC). For telehealth, “reasonable steps” points toward encrypted connections, access controls, and a considered choice of platform — not a consumer video app that happened to be free.
Access and correction (APP 12 and APP 13)
Patients can request access to their health information and ask for corrections. Because telehealth records live in your clinical system, keeping consult notes in your practice-management software (rather than scattered across a video tool) keeps this manageable.
Notifiable data breaches
If a data breach is likely to result in serious harm, the Notifiable Data Breaches (NDB) scheme requires you to notify affected individuals and the OAIC (OAIC). Health service providers are consistently among the most-reported sectors, so a breach involving telehealth data is a real risk to plan for. Have a data breach response plan, know your notification obligations, and understand where your telehealth data actually lives before something goes wrong.
Accountability inside the practice
The APPs are practice-wide obligations, not just an IT concern. In practice that means having a current privacy policy the whole team works to, being clear about who is responsible for privacy in the practice, and making sure everyone who runs telehealth understands the basics — how consent is handled, where consult data goes, and what to do if something goes wrong. Reception, nursing and administrative staff all touch health information, so training matters as much as technology. The OAIC’s Guide to health privacy is written for exactly this: helping a health service embed good privacy practice day to day, not just on paper.
What this means for choosing telehealth tools
Put the APPs together and a clear specification for telehealth software emerges. You want a tool that:
- keeps the connection secure (encrypted video),
- doesn’t collect more than necessary (no recording by default),
- stores data where you can account for it (ideally onshore), and
- keeps the clinical record in your own system, under your control.
That’s the niche MedCall is built for. It’s Australian-hosted, and calls are never recorded, with 1:1 video end-to-end encrypted; patients join by a texted link with no app or account; and your notes and billing stay in your existing practice software. It’s designed to help you meet your obligations rather than add to them. For a patient-facing explanation of the same ideas, see is telehealth private and secure?.
The bottom line
The Privacy Act treats telehealth health information exactly as it treats any other health information: it’s sensitive, your practice is accountable for it regardless of size, and the APPs — especially notice, security, cross-border disclosure and breach notification — all apply. Build your telehealth around tools and processes that make those obligations easy to meet, and document how you handle patient information. When in doubt, work from the OAIC’s Guide to health privacy and check the health records law in your state or territory.
Sources & further reading
This article is general information for Australian clinicians and patients and reflects the rules and sources current at the date of publication. It is not medical, legal or billing advice, and it is not a substitute for the official guidance of Services Australia, the Department of Health and Aged Care, AHPRA or your professional college. Always check the primary sources linked above for the current position.
The MedCall Team
MedCall is secure telehealth video software built and run by Telehealth Australia Group, a registered Australian telehealth practice. We write these guides for the clinicians who use MedCall every day.