Is Telehealth Private? How Your Health Information Is Protected in Australia
Telehealth consultations in Australia are subject to privacy and confidentiality obligations, just like other healthcare services. Private-sector health service providers are covered by the Privacy Act 1988, and registered health practitioners must also meet the professional standards that apply to their profession.
That does not mean every telehealth platform or situation carries no privacy risk. Providers need to handle health information appropriately, and patients can also take practical steps to protect privacy when using phone or video care.
For a broader introduction to virtual healthcare, read What Is Telehealth and How Does It Work in Australia?.
Key takeaways
• Private-sector health service providers in Australia are covered by the Privacy Act when they handle health information.
• Health information is treated as sensitive information and has additional privacy protections.
• Privacy requirements do not disappear because an appointment happens by phone or video.
• A provider should explain relevant information about how your data is collected, used and protected, and should have a privacy policy.
• If a telehealth consultation will be recorded or an AI scribe will be used, Ahpra says the practitioner should explain this and obtain informed consent.
• You can help protect your own privacy by using a private location, checking who you are speaking with and avoiding unsecured public Wi-Fi for video appointments.
Is telehealth private in Australia?
Telehealth is not outside Australia’s normal privacy framework. The same general privacy and information-security requirements that apply to healthcare also apply when care is delivered remotely.
The Australian Digital Health Agency states that the general privacy and information-security requirements for remote consultations are the same as those that apply to face-to-face consultations.
Ahpra also says patients using virtual care can expect registered practitioners to protect their privacy and right to confidentiality.
What counts as health information?
Health information can include more than a diagnosis or test result. It can include information about your physical or psychological health, medical history, symptoms, treatment, medicines and other details collected while providing a health service.
The Office of the Australian Information Commissioner (OAIC) describes health information as one of the most sensitive types of personal information and notes that the Privacy Act provides extra protections around how it is handled.
Which privacy laws apply to telehealth?
The exact legal framework can depend on the type of healthcare provider and where the service operates.
The OAIC explains that all private-sector health service providers in Australia are covered by the Privacy Act. Public hospitals and other state or territory public-sector health services are generally covered by relevant state or territory privacy laws instead.
In some jurisdictions, including New South Wales, Victoria and the ACT, private health service providers can also have obligations under state or territory health-privacy laws.
For patients, the practical point is that telehealth providers still have legal and professional obligations around the handling of health information.
What should a healthcare provider tell me about my information?
When a health service collects your health information, you should be given enough information to understand why it is being collected and how it will be handled.
According to the OAIC’s guidance on handling health information, a health service provider should make sure you understand why it is collecting your information, how it will store and protect it, and whether there are other parties it may disclose the information to.
Private health service providers must also have a privacy policy explaining how they manage personal information.
Who can access or receive my health information?
Health information is not necessarily limited to the practitioner you speak with. Other authorised people or organisations may need access to information to provide or support your healthcare.
For example, information may be used or disclosed for the purpose it was collected for, for a directly related purpose you would reasonably expect, where you agree, or where disclosure is authorised or required by law.
A provider’s privacy policy should explain the kinds of organisations or service providers that may receive personal information. If you are unsure who can access your information, you can ask before or during the consultation.
Can a telehealth consultation be recorded?
A phone or video consultation should not be assumed to be recorded simply because it takes place online.
Ahpra’s current guidance says practitioners should tell patients if a virtual consultation will be recorded or if an AI scribe will be used, and should obtain informed consent for these uses.
If you are unsure whether a consultation is being recorded, transcribed or processed by an AI tool, ask the practitioner before the consultation continues.
How should telehealth technology protect privacy?
Healthcare providers should understand how the technology they use captures, stores and transmits personal information.
Ahpra advises practitioners to understand how their telehealth platform captures and stores personal information and manages patient privacy. The technology should meet clinical needs and comply with relevant privacy and other legal requirements.
Under the Australian Privacy Principles, organisations covered by the Privacy Act must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
No online system can be described as completely risk-free, so it is more accurate to look for appropriate privacy and security safeguards rather than assume that any platform is automatically secure.
Can my health information be stored outside Australia?
Some healthcare and technology providers use cloud services or other systems that may store or process information outside Australia.
Ahpra notes that practitioners should be aware when patient information may be stored outside Australia and that additional privacy requirements can apply.
If overseas storage matters to you, check the provider’s privacy policy or ask where your information is stored and which service providers may handle it.
How can I protect my privacy during a telehealth appointment?
The healthcare provider has privacy obligations, but your surroundings and device also affect how private a remote consultation is.
The Australian Digital Health Agency’s cyber security guidance recommends practical steps including:
• verify that you are speaking with the healthcare provider before sharing sensitive information
• use a quiet and private location so other people cannot overhear the consultation
• use headphones if privacy is limited
• avoid free or unsecured public Wi-Fi for video consultations where possible
• use a secure home network or mobile data
• keep your phone, tablet or computer protected with a password, PIN or biometric lock
• keep your device and software updated
What if someone else is in the room?
A support person, family member, carer or interpreter may sometimes be present during a telehealth consultation.
Ahpra advises practitioners to consider whether anyone can overhear the consultation and to confirm that the patient agrees to this.
If someone else is with you, tell the practitioner at the beginning of the appointment. If you would prefer to speak privately for part of the consultation, you can ask.
Can I access or correct my health information?
Australian privacy law generally gives people the right to request access to personal health information held about them and to ask for incorrect information to be corrected.
The OAIC explains how to request access to your health information from a health service provider. The provider may ask you to make the request in writing and to verify your identity.
There are limited circumstances where access may be refused or restricted, so ask the provider about its process if you want a copy of your records.
What should I do if I have a privacy concern?
Start by contacting the healthcare provider and explaining your concern. Many organisations have a privacy contact or privacy officer who can review what happened.
If your concern involves a private-sector health service covered by the Privacy Act and you are not satisfied with the provider’s response, you may be able to make a complaint to the OAIC.
If the provider is a state or territory public-sector health service, such as a public hospital, a state or territory privacy regulator may be the appropriate body instead.
The OAIC’s privacy guidance explains these rights and complaint options in more detail.
Questions to ask a telehealth provider about privacy
You do not need to be a privacy expert to ask useful questions. Before using a telehealth service, you can ask:
• Where can I read your privacy policy?
• What personal and health information do you collect?
• Who can access my information?
• Will the consultation be recorded or transcribed?
• Will an AI scribe or similar tool be used?
• Which technology or platform is used for the consultation?
• Is any information stored or processed outside Australia?
• How can I request access to or correction of my health information?
• Who should I contact if I have a privacy concern?
Privacy is part of good telehealth care
Telehealth changes where a consultation takes place, but it does not remove the privacy and confidentiality obligations that apply to healthcare.
A good telehealth experience should include clear information about how your data is handled, appropriate safeguards for personal information, and an opportunity to ask questions about privacy, recording or technology.
Patients can also reduce avoidable privacy risks by choosing a private location, using secure devices and networks, and speaking up if they are unsure how their information is being used.
Learn more about Grove Health
Ready to learn more? Grove Health provides telehealth consultations with Australian healthcare professionals. Learn how Grove Health works and what to expect from your consultation.
This article provides general educational information and is not legal or individual medical advice. Privacy requirements can vary depending on the healthcare provider, jurisdiction and circumstances. If you have a privacy concern, contact the relevant healthcare service or privacy regulator.
Sources
• Office of the Australian Information Commissioner — Handling health information
• Office of the Australian Information Commissioner — State and territory privacy legislation
• Office of the Australian Information Commissioner — APP 11: Security of personal information
• Australian Health Practitioner Regulation Agency — Information for people about virtual care
• Australian Digital Health Agency — Cyber security for digital health privacy