HIPAA compliance in Australia is not a thing, and if a vendor has told you otherwise you should ask them what they meant. HIPAA is United States legislation. It has no force here, no Australian regulator enforces it, and a certificate saying your software is HIPAA compliant tells you nothing about whether your practice meets Australian law.
What governs an allied health practice in Australia is the Privacy Act 1988, the Australian Privacy Principles underneath it, and in Victoria a second Act that most practices have never been told about. Here is the substitution, obligation by obligation.
Does HIPAA apply in Australia?
No. HIPAA is a United States federal law and it does not reach an Australian practice treating Australian patients. There is no Australian equivalent that borrowed its structure either, so looking for “the Australian HIPAA” produces a shape that does not exist.
The search is still a reasonable one to make. It usually comes from a practice manager who has been handed a US-built practice management system, or has read an American article about patient privacy, and is trying to work out what the local version is. The answer is that there are two local versions, one federal and one state, and they are structured as principles rather than as a rulebook.
That difference matters more than the name. A rulebook tells you what to do. Principles tell you what outcome to achieve and leave the method to you, which is harder to buy off the shelf and easier to fail an audit on.
What actually applies to an Australian practice
The Privacy Act 1988 applies to you as a health service provider, and in Victoria the Health Records Act 2001 applies on top of it. Both are in force now, and they cover overlapping but different ground.
| What people search for | What actually governs you | Who enforces it |
|---|---|---|
| HIPAA compliance | Privacy Act 1988 and the Australian Privacy Principles | Office of the Australian Information Commissioner |
| HIPAA Security Rule | Australian Privacy Principle 11, reasonable steps to protect personal information | OAIC |
| HIPAA Breach Notification Rule | Notifiable Data Breaches scheme, Part IIIC of the Privacy Act | OAIC |
| Patient right to records | Health Privacy Principle 6 in Victoria, APP 12 federally | Health Complaints Commissioner in Victoria, OAIC federally |
| Minimum necessary standard | No direct equivalent. The APPs and HPPs regulate collection, use and disclosure separately | OAIC, Health Complaints Commissioner |
The turnover question comes up immediately, so deal with it first. The OAIC states that regardless of turnover the Privacy Act covers any business that is a health service provider. The three million dollar small business exemption that lets many small businesses out does not apply to a physiotherapy practice with two rooms and a receptionist.
What is personal information under the Privacy Act?
The OAIC defines it as information or an opinion about an identified individual, or an individual who is reasonably identifiable. The test is identifiability, not sensitivity, and it does not require a name to be attached.
Health information sits inside that definition and is also classified as sensitive information, which carries stronger handling requirements than ordinary personal information. For a clinic that means almost everything in the practice management system is in the highest category the Act has.
Practices routinely underestimate this. An appointment list with no diagnoses on it still reveals who is a patient of a mental health service, and that fact alone is health information. The common error is treating the clinical notes as the sensitive part and the scheduling system as administrative.
Victoria has a second Act, and it is not optional
If you handle health information in Victoria, the Health Records Act 2001 applies to you in addition to the Privacy Act. It is in force, currently in its version effective 1 May 2026, and it establishes Health Privacy Principles covering health information handled in Victoria across both the public and private sectors.
The reach is wider than most practices assume. The Victorian Department of Health explains that when an organisation provides a health, disability or aged care service, the HPPs apply to all identifying personal information collected in the course of providing that service, and all such information is health information. Not the clinical subset. All of it.
Two of the principles produce most of the day to day work. HPP 6 gives individuals a right of access to health information held by a private sector organisation, for information collected on or after 1 July 2002. HPP 11 gives them a right to request that their health information be transferred to another provider, and that one applies regardless of when the information was collected.
You can charge for access, within limits. The fee caps are expressed in fee units rather than dollars, with the value set each year by the Treasurer under the Monetary Units Act 2004, so a figure written into your practice policy three years ago is now wrong. Check the current value rather than quoting an old one.
Complaints go somewhere different too. Breaches of an HPP or of Part 5 of the Act are handled by the Health Complaints Commissioner, not the OAIC. A Victorian practice can therefore face two regulators over one incident, which is the practical reason the second Act is worth knowing about.
What a US-built system gets wrong here
Mostly it gets the defaults wrong rather than the security. American practice management software is often well built, and the gap is in where data lives, how long it is kept, and what the patient can demand.
Ask a vendor three questions before you believe a compliance claim. Where is the data stored, and if it leaves Australia, can you still meet your obligations over it. Can the system produce everything you hold about one patient, in a usable form, when someone exercises HPP 6 or APP 12. And can it hand a record to another provider on request, as HPP 11 contemplates.
Watch what happens to the second one. A system that cannot assemble a single patient’s full record turns a routine access request into a week of somebody opening folders, cross-checking the scheduling system and hoping nothing was missed, which is where the real cost of the wrong platform shows up long before any regulator hears about it.
The security half is more portable. Access control, patching and backups behave the same wherever the vendor is from, and the free Essential Eight Maturity Level 1 assessment scores those against the Australian baseline in about five minutes.
What to do this week
Delete the phrase “HIPAA compliant” from your internal documents and replace it with the obligation you actually hold. If a policy cites HIPAA, nobody reading it knows what standard the practice is being held to, including an auditor.
Work out whether the Health Records Act applies to you. If you handle health information in Victoria, it does, and your policies should name both Acts rather than only the federal one.
Test one access request on yourself. Ask your own system for everything it holds about a single patient and time how long it takes to assemble. That number is your real HPP 6 readiness, and it is usually a surprise.
Then check what happens when something goes wrong, because the breach obligation is the one with a clock attached. The Notifiable Data Breaches scheme runs on 30 calendar days for the assessment, not the 72 hours people borrow from overseas, and data security work is where the two halves meet.
If you want the technical baseline measured before the policy work starts, the free Essential Eight Maturity Level 1 assessment is the shortest way to a number you can act on.
Last reviewed: 4 October 2026.
This article is general information about Australian privacy obligations for health service providers. It is not legal advice. Confirm your own obligations with the OAIC, the Health Complaints Commissioner, or your own adviser, before acting on it.