Health data residency in Australia: why onshore hosting matters

Where your telehealth data is stored is a privacy question, not just a technical one. Under the Australian Privacy Principles, if patient health information is sent or made accessible overseas, your practice generally stays accountable for how it’s handled there. Keeping data onshore — hosted in Australia, under Australian law — is the simplest way to keep that responsibility manageable.

Here’s what data residency means for telehealth and why onshore hosting matters. This is general information, not legal advice.

Data residency and data sovereignty

Two terms come up together. Data residency is about where data is physically stored — which country’s data centres hold it. Data sovereignty is the related idea that data is subject to the laws of the country it sits in. If your patients’ health information is stored offshore, it may be reachable under another country’s laws, and your ability to control it can be weaker than if it never left Australia.

For health information — among the most sensitive categories the Privacy Act recognises — those questions carry real weight (OAIC).

APP 8: the crux of cross-border disclosure

The specific rule is Australian Privacy Principle 8. Before an entity discloses personal information to an overseas recipient, it must take steps that are reasonable in the circumstances to ensure the recipient doesn’t breach the APPs (OAIC). In practice that usually means an enforceable contractual arrangement requiring the overseas recipient to handle the information in line with the APPs.

What makes APP 8 sharp is what comes next: accountability doesn’t end once you’ve taken those steps. An organisation may be liable for the acts and practices of the overseas recipient — even where it has complied with APP 8.1, and even if the recipient breaches privacy accidentally or through a subcontractor (OAIC). You can outsource the hosting; you can’t outsource the responsibility.

The OAIC is explicit that an organisation might reasonably decide not to send personal information overseas at all, if the privacy and commercial risks are too great to mitigate. For health data, that’s a conclusion a lot of practices reach — and onshore hosting is how they act on it.

“Reasonable steps” scale with sensitivity

What counts as “reasonable” depends on the circumstances — including how sensitive the information is, the nature of the relationship with the overseas recipient, and the potential harm if it’s mishandled (OAIC). Because health information sits at the sensitive end of the scale, the bar for reasonable steps is correspondingly high. The more sensitive the data, the more you’re expected to do to protect it once it leaves the country — and the more exposure you carry if something goes wrong.

Does using an overseas cloud count?

This is where practices get caught out. If a telehealth or storage provider routes, stores or makes patient data accessible outside Australia — including offshore servers or overseas support and engineering teams who can access the data — APP 8 considerations are engaged. The legal analysis of exactly when an overseas transfer is a “disclosure” (versus a “use”) can be nuanced, and the OAIC’s guidance is the place to work through it (OAIC). But the practical point stands: once health data is capable of being handled offshore, you need to understand and manage that, and you retain accountability for it.

Many consumer video tools and general SaaS platforms are hosted overseas or spread across global regions by default. That’s a poor starting point for clinical data — see is Zoom compliant for telehealth? for more on why purpose-built matters.

Why Australian hosting matters

Onshore hosting doesn’t magically satisfy every obligation, but it removes a whole category of them, and it narrows the surface area you have to reason about when assessing risk. If patient health data stays in Australia:

• APP 8 cross-border disclosure is largely avoided for that data, along with the accountability tail that comes with sending it offshore.
• Data stays under Australian law, not exposed to foreign legal access regimes.
• Your risk assessment is simpler — you’re not trying to verify and contractually bind an overseas recipient’s privacy practices.
• It’s easier to explain to patients, who increasingly ask where their health information goes.

This is a deliberate design choice for Australian telehealth. MedCall is hosted in Australia (AWS Sydney) and never records consultations, with 1:1 video end-to-end encrypted and the patient joining by a texted link — no app, no account. Your notes and billing stay in your own practice software. The effect is that patient data stays onshore and under your control, rather than scattered across offshore infrastructure. For the wider privacy picture, see telehealth and the Privacy Act.

What to ask a telehealth vendor

Before adopting any telehealth or storage tool, get clear answers to:

• Where is our data stored — which country, which region?
• Is any data accessible from overseas, including by support, engineering or subprocessors?
• Are consultations recorded or retained, and if so, where and for how long?
• Is the connection encrypted, and what exactly is covered?
• What’s in the contract about APP compliance and cross-border handling?

If a vendor can’t answer the first two plainly, treat that as a finding in itself.

Two details are easy to overlook. The first is backups and disaster recovery — data can be stored in one region but replicated to another, so ask where copies live, not just the primary. The second is subprocessors: the analytics, transcription, support or infrastructure services a vendor relies on may each handle data in their own locations. Onshore hosting is most meaningful when it applies to the whole chain, not just the front-end video.

The bottom line

Health data residency matters because APP 8 keeps you accountable for patient information even after it leaves Australia — and health information demands the highest level of protection. The cleanest way to manage that is to keep the data onshore, hosted in Australia and under Australian law, so the cross-border question largely doesn’t arise. Ask any telehealth provider where your data lives and who can reach it, and read the OAIC’s guidance on sending personal information overseas before you decide.