Payroll Tax and Service Agreements – What Medical Practices Need to Know in 2026

Payroll Tax and Service Agreements – What Medical Practices Need to Know in 2026

Home » Health & Medical

Payroll Tax and Service Agreements - What Medical Practices Need to Know in 2026

}

3 min read

14 Oct 2026

Share:

  • r
    Key Takeaways
  • ࠂ
    Payroll Tax rules vary by State – Exemptions, concessions, thresholds and rates differ across Australia, making it essential for practices to understand their state or territory’s requirements.
  • ࠂ
    Service Agreements matter – Current, signed Service Agreements should accurately reflect practitioner arrangements, including billing, service fees and the flow of funds.
  • ࠂ
    Review & reduce risk – Practices should review agreements, payment arrangements and operational processes to identify potential payroll tax exposure and ensure they are appropriately structured and documented.

Stay Up-To-Date

Subscribe to receive updates specific to your preferences

Payroll tax remains a significant issue for medical, dental and allied health practices across Australia.

The application and enforcement of payroll tax varies between states and territories, as do rates, thresholds, exemptions and concessions. This can make it difficult for practices to understand their obligations and assess whether payments made to practitioners may attract payroll tax.

With Revenue Offices continuing to scrutinise practitioner arrangements, practices should understand the rules that apply in their jurisdiction and ensure their contractual, financial and operational arrangements are appropriately structured and documented.

Payroll Tax Relief for Medical Practices by State and Territory

Current as at September 2026. Payroll tax rules and Revenue Office guidance are subject to change.

Australian Capital Territory (ACT)

Annual Threshold: $1.75 million
Rate: 6.75% for annual wages from $1.75 million to $20 million (variable rates for annual wages exceeding $20 million)

GP Clinics:

From 1 July 2025, medical practices that engage general practitioners, or other contractors who perform medical services that are bulk-billed or certain services under the Veteran’s Entitlements Act 1986 (Cth) or under the Workers Compensation Act 1951, are exempt from paying payroll tax on wages for those services performed.

New South Wales (NSW)

Threshold: $1.2 million
Rate: 5.45%

GP Clinics:

From 4 September 2024, medical centres can claim a rebate of payroll tax for payments made to GP Contractors if they meet the relevant proportion of general practitioner services under the “prescribed billing arrangements” which are subject to the following thresholds:

  • Metropolitan Sydney: 80% of general practitioner services; and
  • Other areas: 70% of GP services

Suburb classification can be found on the Revenue NSW website.

The prescribed billing arrangements for general practitioner services include the following:

  • Bulk billing arrangement, where a person responsible for paying for the services assigns their right to a Medicare benefit for the service; and the general practitioner accepts the Medicare benefit as full payment for the service.
  • Veterans arrangement, for general practitioner services, refers to arrangements under which the general practitioner accepts full payment for services listed under the Department of Veteran Affairs and its relevant Acts of Commonwealth; or approved by the Chief Commissioner of Revenue NSW.

Queensland

Threshold: $1.3 million
Rate: 4.75% for annual wages below $6.5 million and 6.95% for annual wages more than $6.5 million

GP Clinics:

From 1 December 2024, wages paid to contracted GPs are exempt from payroll tax.

Dental Clinics:

An amnesty was provided for payments made to contracted and registered dentists from 1 July 2018 to 30 June 2025. There are currently no exemptions or amnesties available for dental clinics in Queensland.

South Australia

Threshold: $1.5 million (with up to $600,000 deduction)
Rate: 0%-4.95% (variable for annual wages between $0 to $1.7million)

GP Clinics: From 1 July 2024, an ongoing exemption applies to wages relating to bulk-billed services only.

The bulk-billing exemption applies to GP services and does not extend to other staff, pathology or allied health services.

Dental & Specialist Clinics:

Currently, no relief or exemptions apply after 1 July 2024.

Victoria

Threshold: $1 million
Rate: 4.85%

GP Clinics:

From 1 July 2025, a payroll tax exemption applies only to wages paid or payable by a general practice medical business to contractor GPs for medical services performed that are fully-funded consultations. This exemption does not apply to dental or allied health medical centres.

Western Australia

Threshold: $1 million
Rate: 5.5%

Western Australia assesses payroll tax based on a common law employer-employee relationship rather than extended contractor provisions. Doctors who run their own true businesses are generally not counted as taxable wages.

The $1 million payroll tax threshold is subject to a diminishing threshold for employers or groups with Australian taxable wages between $1 million and $7.5 million.

Medical Clinics:

WA does not apply payroll tax to payments made to contracted GPs or allied health practitioners.

Tasmania

Threshold: $1,250,001 million
Rates: 4% for annual wages between $1,250,001 million and $2 million. 6.1% for annual wages above $2 million.

Medical Clinics:

There are no exemptions or amnesties currently available.

Tasmania has not issued public guidance on how payroll tax applies to medical centres.

Northern Territory

Threshold: $2.5 million
Rate: 5.5% for annual wages less than $100 million, 6.5% for annual wages more than $100 million.

Medical Clinics:

There are no exemptions or amnesties currently available.

The Northern Territory has not issued public guidance on how payroll tax applies to medical centres.

Increased Scrutiny - Is your Practice Audit-Ready?

While greater certainty now exists in some jurisdictions, there is no single Australian payroll tax position for medical practices.

Revenue Office audit activity is continuing, with practitioner arrangements, contractor payments and the supporting financial and operational records of practices coming under scrutiny.

Practices that cannot rely on an exemption or concession should review their practitioner arrangements and supporting documentation to identify and address potential payroll tax exposure.

One of the key documents is the Service and Facilities Agreement (SFA).

What is a Service and Facilities Agreement?

An SFA governs the relationship between a practice and an independent practitioner operating their own medical or healthcare business.

Under a typical arrangement, the practice provides the practitioner with facilities and administrative services required to operate their business, and the practitioner pays the practice a service fee in return.

An SFA should clearly document the parties' respective rights and obligations, including the services and facilities provided, practitioner independence, service fees, billing and payment arrangements, patient records and termination arrangements.

Why Service Agreements Matter for Payroll Tax

A well-drafted SFA can help:

  • Clearly establish the intended legal and commercial relationship between the practice and practitioner;
  • Document how patient fees and service fees are collected and paid;
  • Support the practice's payroll tax position;
  • Ensure contractual arrangements align with the way the practice operates;
  • Reduce the risk of disputes during and after a practitioner's engagement; and
  • Support future restructuring, sale or succession.

However, simply having an SFA is not enough.

Revenue Offices may look beyond the title of an agreement when determining whether practitioner payments are subject to payroll tax. The terms of the agreement, the flow of funds between the patient, practitioner and practice, and the way the arrangement operates in practice can all be relevant.

Don't Overlook the Flow of Funds

How patient fees are collected and how service fees are paid can be particularly important.

Practices should review their banking and payment arrangements alongside their SFAs to ensure the documented arrangement is appropriately structured and accurately reflects the intended relationship between the practice and practitioner.

Changes to payment gateways, EFTPOS arrangements, bank accounts, billing systems or administrative processes should also prompt a review of the relevant SFA and payroll tax position.

Make sure your Agreements are Signed

An unsigned or expired agreement can create significant risk.

Practices should ensure SFAs are properly executed before a practitioner commences, rather than treating signatures as an administrative task to be completed later.

Electronic signing, central agreement registers, automated reminders and clear responsibility for practitioner onboarding can help ensure agreements do not remain unsigned or expire unnoticed.

What should Medical Practices do Now?

Medical, dental and allied health practices should:

  • Understand the payroll tax rules, rulings and exemptions that apply in their state or territory;
  • Assess whether practitioner payments may be subject to payroll tax;
  • Ensure every practitioner has a current and signed SFA;
  • Review the flow of funds and banking arrangements between patients, practitioners and the practice;
  • Check that SFAs accurately document the intended practitioner arrangements;
  • Review agreements when billing processes, ownership, structure or operational arrangements change; and
  • Seek legal and accounting advice where there is uncertainty or potential exposure.

How Hillhouse can help

Payroll tax and practitioner arrangements are complex, and the position continues to evolve.

Hillhouse Legal Partners works closely with medical, dental and allied health practices to provide practical, commercially focused advice on Service and Facilities Agreements, practitioner arrangements and payroll tax risk.

If your practice does not have current SFAs in place, your agreements have not been reviewed recently, or you are concerned about your payroll tax position, now is the time to act.

Our experienced Health & Medical legal team can help you identify potential risks, strengthen your agreements and implement practical solutions that work for your practice.

Contact Craig Hong, or Zach Sudiro on (07) 3220 1144 or email@hillhouse.com.au.

AI in Healthcare: Managing Privacy, Legal & Compliance Risks

AI in Healthcare: Managing Privacy, Legal & Compliance Risks

Home » Health & Medical

AI in Healthcare: Managing Privacy, Legal & Compliance Risks

Author: Craig Hong

}

3 min read

20 Aug 2026

Share:

  • r
    Key Takeaways
  • AI can improve efficiency and patient care, but healthcare professionals remain responsible for protecting patient information and meeting their legal and professional obligations.
  • Practices should understand how AI providers collect, store and use patient data, and ensure their privacy policies and patient consent processes reflect their use of AI.
  • AI should support, not replace, professional judgement, with appropriate governance, cybersecurity safeguards and oversight in place.

Stay Up-To-Date

Subscribe to receive updates specific to your preferences

"Artificial Intelligence is transforming healthcare, offering significant opportunities to improve efficiency and patient care. However, innovation must be supported by strong governance, robust privacy practices and sound clinical judgement. Understanding your legal obligations before implementing AI is essential to protecting your patients, your practice and your reputation."

Craig Hong - Director, Hillhouse Legal Partners

Artificial Intelligence (AI) is rapidly changing the way healthcare is delivered. From AI-powered clinical scribes and practice administration to diagnostic support and patient communications, AI is helping healthcare professionals improve efficiency, reduce administrative burden and enhance patient care.

However, these technologies also introduce important legal, privacy and compliance obligations. Healthcare professionals, practice owners and healthcare businesses remain responsible for protecting patient information, obtaining appropriate consent, complying with privacy legislation and ensuring AI supports, not replaces, professional judgement.

This fact sheet outlines the key legal considerations every healthcare professional should understand before implementing or expanding the use of AI.

How AI Is Being Used in Healthcare

AI is increasingly being integrated into both clinical and administrative functions, including:

Practice Administration

  • AI clinical scribes and consultation transcription
  • Appointment scheduling and workflow management
  • Billing and administrative support
  • Patient communications

Clinical Support

  • Diagnostic assistance
  • Clinical decision support
  • Identification of potential medication interactions
  • Medical imaging analysis

Research & Innovation

  • Clinical research
  • Drug discovery and development
  • Analysis of large health datasets

While AI can significantly improve efficiency, it also creates new legal, privacy and governance responsibilities for healthcare professionals and healthcare businesses.

Key Legal Considerations Before Introducing AI

Before implementing any AI platform, healthcare professionals and practices should carefully assess how the technology collects, stores and uses patient information.

Where Is Your Patient Data Stored?

Many AI providers process or store information using overseas servers. Before adopting an AI platform, healthcare professionals and practices should understand:

  • where patient information is stored;
  • whether information is transferred outside Australia;
  • whether overseas privacy protections are comparable to Australian standards; and
  • whether additional patient consent is required.

Does the AI Provider Use Your Data?

One of the most important questions to ask any AI supplier is whether uploaded information is used to train or improve its AI model.

Before engaging an AI provider, healthcare professionals and practices should understand:

  • whether patient information is retained;
  • whether information is anonymised;
  • whether data is used for ongoing AI development;
  • whether this can be contractually prevented; and
  • how information is permanently deleted when no longer required.

Healthcare professionals and practices should exercise particular caution when using free or consumer AI platforms, as patient information may be retained or used to improve the provider's AI model.

Review Your AI Supplier Agreement

Before purchasing or subscribing to an AI platform, carefully review the provider's terms and conditions. Key contractual issues include:

  • ownership of uploaded information;
  • confidentiality obligations;
  • cybersecurity standards;
  • data retention periods;
  • liability if the system fails;
  • termination rights; and
  • deletion of patient information when the agreement ends.

Understanding these contractual arrangements before implementation can help minimise legal, privacy and operational risks.

Privacy & Patient Consent

Patient health information is among the most sensitive forms of personal information protected under the Privacy Act.

If AI is used within your practice, patients should be informed: that AI is being used;

  • what information is collected;
  • how that information is used;
  • where it is stored;
  • whether information is disclosed overseas; and
  • whether any automated decision-making occurs.

Privacy policies and patient consent documentation should accurately reflect the use of AI within the practice.

Where appropriate, patients should also have the opportunity to ask questions and opt out of AI-assisted processes.

From 10 December 2026, organisations subject to the Privacy Act will also be required to disclose the use of automated decision-making processes involving personal information in their privacy policies.

AI Does Not Replace Professional Responsibility

AI is designed to support healthcare professionals, not replace them. Healthcare professionals remain responsible for:

  • exercising independent clinical judgement;
  • reviewing AI-generated information;
  • ensuring clinical decisions remain appropriate;
  • maintaining accurate patient records; and
  • meeting all professional and ethical obligations.

AI is a tool to support clinical decision-making, not replace it. Healthcare professionals remain legally responsible for patient care.

Medicare & Billing Considerations

Healthcare professionals and practice owners should also consider the Medicare implications of AI-assisted healthcare.

While AI may assist with documentation or clinical support, healthcare professionals remain responsible for ensuring Medicare billing requirements are satisfied.

Healthcare professionals should not assume services generated primarily through AI will qualify for Medicare benefits without appropriate clinical involvement.

Cybersecurity & AI

AI increases cybersecurity risks, making it essential that healthcare professionals and practices ensure AI providers meet appropriate security standards and patient information remains protected.

This includes:

  • multi-factor authentication;
  • secure user access controls;
  • encryption of patient information;
  • regular software updates;
  • incident response planning; and
  • ongoing staff training.

Healthcare continues to be one of Australia's most targeted industries for cyber incidents, making robust cybersecurity practices essential.

AI Governance Is Essential

As AI becomes more widely used across healthcare, practices should establish clear governance around its implementation, while healthcare professionals should understand their professional responsibilities when using AI to support patient care.

This may include:

  • an approved AI usage policy;
  • staff education and training;
  • documented approval processes for new AI tools;
  • regular review of AI outputs;
  • periodic supplier reviews; and
  • ongoing monitoring of legislative and regulatory developments.

Good governance helps ensure AI is used safely, ethically and in compliance with legal and regulatory obligations.

What Healthcare Professionals Should Do Now

To minimise risk and support compliance, we recommend:

  • understanding how AI is currently being used within your practice;
  • reviewing AI supplier agreements and licence terms;
  • confirming where patient information is stored and processed;
  • reviewing privacy policies and patient consent documentation;
  • ensuring appropriate cybersecurity safeguards are in place;
  • developing or reviewing internal AI governance policies;
  • providing staff education and training on the appropriate use of AI;
  • considering Medicare billing implications; and
  • obtaining legal advice before implementing new AI technologies.

How Hillhouse Legal Partners Can Help

Hillhouse Legal Partners has been supporting Australia's health and medical profession for over 30 years.

  • Our Corporate & Commercial team regularly advises healthcare professionals, practice owners and healthcare businesses on:
  • AI governance and implementation;
  • Privacy Act compliance;
  • patient consent documentation;
  • AI supplier and software agreements;
  • technology procurement;
  • cybersecurity and data governance;
  • medical practice risk management; and
  • regulatory compliance.

We understand the commercial realities of modern healthcare and provide practical, commercially focused advice to help our clients embrace innovation while managing legal and regulatory risk.

Need Advice on AI in Your Practice?

Artificial Intelligence is evolving rapidly, but your legal obligations remain.

Whether you are introducing AI for the first time or reviewing
existing systems, our experienced team can help you navigate
the legal, privacy and regulatory considerations with confidence.

This fact sheet provides general information only and should not be relied upon as legal advice. Specific legal advice should be obtained based on your individual circumstances.

The Cost of Poor Documentation to Medicos – Webinar with Hillhouse and Pilot Partners

The Cost of Poor Documentation to Medicos – Webinar with Hillhouse and Pilot Partners

Home » Health & Medical

The Cost of Poor Documentation to Medicos – Webinar with Hillhouse and Pilot Partners

Author: Craig Hong

}

54 min watch

5 May 2026

Share:

    Missed the live session? You can now watch the replay.

    With increased ATO scrutiny and recent court decisions placing medical practices under the spotlight, this practical webinar with Craig Hong (Hillhouse Director) and Tom Howard (Pilot Partners Associate Partner – Taxation) unpacks where practices are being caught out - particularly around documentation and intra-group arrangements - and what you should be doing now to reduce risk.

    Stay Up-To-Date

    Subscribe to receive updates specific to your preferences

    Fact Sheet: Service Agreements for Medical Practices

    Fact Sheet: Service Agreements for Medical Practices

    Home » Health & Medical

    FACT SHEET: Service Agreements for Medical Practices

    }

    3 min read

    2 Apr 2026

    Share:

    • r
      Key Takeaways
    • ࠂ
      Service and Facilities Agreements (SFAs) define the relationship between a medical practice and independent practitioners, outlining how facilities, services, fees, and responsibilities are managed.
    • ࠂ
      Well-drafted SFAs are critical for legal protection and compliance, particularly in reducing disputes, managing operational responsibilities, and supporting practice valuation or succession.
    • ࠂ
      Regularly reviewing SFAs is essential due to payroll tax risks and regulatory changes, ensuring agreements accurately reflect how the practice operates and protect the business from financial or legal exposure.

    Stay Up-To-Date

    Subscribe to receive updates specific to your preferences

    What they are, why they matter, and how to get them right

    Running a medical practice involves far more than delivering quality patient care. Behind the scenes, your legal and commercial arrangements play a critical role in protecting your business, managing risk, and ensuring compliance - particularly in today’s evolving regulatory environment.

    One of the most important (and often misunderstood) documents in any medical practice is the Service and Facilities Agreement (SFA).

    This fact sheet explains what an SFA is, why they matter, and why medical practices should be reviewing their agreements to remain compliant and protected.

    What is a SFA?

    A SFA (sometimes referred to as a Practitioner Services Agreement or simply a Service Agreement) governs the relationship between a medical practice and the practitioners who operate their own independent business utilising services offered by the medical practice.

    A common point of confusion for medical practices is the difference between the relationship between a practitioner engaged under an SFA and employed under an Employment Contract. Some of the key factors that distinguish an employment contract from an SFA include:

      Employment Agreement Service and Facilities Agreement
    Role and relationship of the parties The relationship is that of employer and employee.

    The practitioner is providing labor to the medical practice in consideration of the remuneration (e.g. wage, salary) paid to the practitioner.

    The relationship is that of service provider and practitioner.

    The medical practice is providing services and facilities necessary for the practitioner to operate their own independent medical business in consideration of the service fees payable to the medical practice.

     

    How are the practitioner and medical practice paid? The medical practice collects patient fees and then pays the practitioner a salary or other agreed remuneration. The preferred approach is for practitioners to collect fees into their own bank account and are invoiced by the medical practice for service fees, rather than the medical practice collecting fees on the practitioner’s behalf.

     

    Duties of each party and control over performance of work The medical practice determines the nature of the medical services available at the practice, and practitioner must comply with the policies and instructions of the medical practice while performing medical services. The practitioner has discretion as to the operation of their medical practice without rigorous oversight from the medical practice.
    Obligations regarding employee entitlements

     

    The medical practice is responsible for superannuation, annual leave, sick leave, long service leave, and other employee entitlements of the practitioner. The practitioner is responsible for superannuation, annual leave, sick leave, long service leave, and other employee entitlements.
    How patient records are handled The medical practice will claim control and ownership of patient records and other confidential information at all times. The medical practice does not control or own the patient records, except to the extent needed to provide the services to the practitioner.

     

    Does the practitioner represent him or herself as being part of the medical practice’s business? The medical practice is advertised as the provider of medical services and the practitioner is a part of the business. The medical practice is advertised as a place for patients to visit the practitioners.

    SFA’s typically set out:

    • how the practitioner uses the medical practice’s facilities and services;
    • how and when fees are collected and distributed;
    • what services the medical practice provides (rooms, staff, IT, equipment, administration);
    • what services the medical practice will not provide the practitioners (specialist equipment);
    • the obligations of each party;
    • insurance requirements of each party; and
    • termination and exit arrangements, including the handling of patient records.

    For many medical practices, and SFA underpins the entire business model.

    Why SFA’s Matter

    A well-drafted SFA helps to:

    • clearly define the legal relationship between the practice and practitioner;
    • support compliance with payroll tax and revenue laws;
    • reduce the risk of disputes during, and after, a practitioners engagement;
    • align operational, financial and regulatory obligations;
    • support practice valuation and future sale or succession; and
    • poorly drafted or outdated agreements can expose practices to significant financial and legal risk.

    Service Agreements & Payroll Tax - A Critical Connection

    Payroll tax has become one of the most significant issues affecting medical practices across Australia.

    Recent various state revenue rulings have made it clear that the substance of the relationship matters more than the label.

    Payroll tax risk may arise where:

    • patient fees are collected by the practice and later distributed to practitioners;
    • the medical practice controls billing, pricing or appointment systems;
    • practitioners are not operating independently, but rather for or on behalf of the medical practice; and
    • agreements do not reflect the reality of how a medical practice operates as a service entity.

    Even where practitioners are engaged as independent contractors, state revenue authorities may still treat payments as “wages” if the agreement and practice structure do not support genuine independence.

    Each state has its own payroll tax thresholds, exemptions, amnesty regimes, and reporting requirements, making regular review of Service Agreements essential. For more detailed information on a specific state’s requirements, please visit the Hillhouse website’s Knowledge Hub: https://hillhouse.com.au/knowledge/

    Key Elements Every Medical Service Agreement Should Address

    A well-drafted Service Agreement should clearly deal with:

    • Nature of the relationship - confirming the practitioner is an independent contractor, not an employee
    • Fee collection and payments - how patient fees are received, service fees calculated, and funds distributed
    • Services provided by the practice - rooms, reception, IT systems, nursing support, equipment and administration
    • Practitioner obligations - professional standards, compliance, insurances and use of practice systems
    • Leave, absence and locum arrangements - how absences are managed
    • Termination and exit - notice periods, handover obligations, restraint provisions and patient continuity
    • Data, records and confidentiality - ownership of records, privacy compliance and information security.

    Common Issues We See in Practice

    Some of the most common risks we encounter include:

    • outdated agreements that no longer reflect how the practice operates;
    • template agreements not tailored to medical practices;
    • inconsistencies between agreements and actual operational and billing arrangements;
    • poor alignment with payroll tax requirements;
    • unclear exit provisions leading to disputes; and
    • misalignment between Service Agreements and shareholder or lease arrangements.

    These issues often only come to light during:

    • payroll tax audits;
    • practice sales or restructures;
    • Partner or practitioner exits;
    • disputes between medical practices and practitioners; and
    • ATO or state revenue reviews.

    What Medical Practices Should Do Now

    To protect your practice, we recommend:

    • reviewing all current Service Agreements;
    • ensuring agreements reflect how the medical practice business actually operates;
    • assessing payroll tax exposure with legal and accounting input;
    • checking consistency across service, lease and shareholder documents;
    • updating agreements to reflect legislative and regulatory changes; and
    • reviewing agreements whenever there is a change in ownership, structure or billing practices.

    Proactive review is far more cost-effective than addressing issues after a problem arises.

    How Hillhouse Legal Partners Can Help

    Hillhouse Legal Partners has over 30 years’ experience supporting medical and healthcare practices across Australia. Our team regularly advises on the drafting and review of Service Agreements, payroll tax risk management, practice structuring and restructuring, medical practice compliance, and practice acquisitions and exits.

    We understand the commercial realities of running a medical practice and provide clear, practical advice focused on solutions - not legal jargon.

    Need a Service Agreement Review?

    If your Service Agreements haven’t been reviewed recently or if you’re unsure whether they align with current payroll tax and compliance requirements NOW is the time to act.

    Let our experienced team help ensure your agreements protect your practice, support compliance, and position your business for long-term success.

    Patient Confidentiality: Legal Obligations and Practical Actions for Doctors and Practices

    Patient Confidentiality: Legal Obligations and Practical Actions for Doctors and Practices

    Home » Health & Medical

    Patient Confidentiality: Legal Obligations and Practical Actions for Doctors and Practices

    }

    3 min read

    3 Sep 2025

    Share:

    • r
      Key Takeaways
    • Patient confidentiality is both a legal obligation and an ethical duty for all doctors and medical practices.
    • Clear agreements on patient record ownership prevent disputes when doctors move practices.
    • Privacy compliance requires informed consent, secure storage, and careful disclosure of patient information.
    • With the rise of AI in healthcare, practices must review consent processes and update privacy policies.

    Stay Up-To-Date

    Subscribe to receive updates specific to your preferences

    In today’s digitised healthcare environment, managing patient confidentiality goes far beyond professional courtesy—it’s a legal requirement. For Queensland doctors and practice managers, privacy compliance is central to both protecting patients and safeguarding practices from significant legal and reputational risks.

    This article breaks down key obligations under the Privacy Act and Australian Privacy Principles (APPs), while also providing practical steps you can take to strengthen compliance in your practice.

    Who Owns Patient Records?

    There is no universal rule on who owns patient records. Ownership usually rests with either the practice or the individual doctor, with the other party licensed to access them.

    The safest approach is to make ownership clear in practice agreements from the outset. This avoids disputes, especially when a doctor departs and patients follow. Without clarity, both legal and financial risks can quickly escalate.

    Collecting and Using Information

    Health information is among the most sensitive personal data. Under the Privacy Act and APPs, patient details must be:

    • Collected fairly and lawfully
    • Obtained with informed consent (particularly sensitive health data)
    • Used only for the purpose it was collected

    Practices must also take reasonable steps to protect patient information from misuse, unauthorised access, or disclosure. Training staff, restricting access, and maintaining strong cybersecurity protocols are essential safeguards.

    When Disclosure is Permitted

    Doctors and practices may disclose patient information only if:

    • It is directly related to the purpose of collection
    • The patient has consented
    • It is legally required
    • The patient would reasonably expect it

    Extra caution is required when responding to requests from spouses, parents, or insurers. For overseas disclosures, patients must consent, or the receiving organisation must comply with Australian privacy standards.

    Retention, Destruction, and Data Breaches

    Patient records must be kept for:

    • Adults: At least seven years from the last consultation
    • Children: Until the patient turns 25

    Once records are no longer needed, they must be securely destroyed or de-identified, with the process documented.

    Healthcare is also the most frequently reported sector for data breaches in Australia, commonly caused by phishing, ransomware, or human error. Every practice should have a breach response plan that includes:

    • Containing the breach
    • Notifying affected patients
    • Assessing whether to notify the OAIC under the Notifiable Data Breach scheme

    Third Parties, Consent, and AI

    Confidentiality extends beyond doctors to reception staff, nurses, IT providers, and contractors. Practices should regularly review contracts with third-party providers, especially if data is stored offshore.

    Informed consent remains central. Privacy policies must explain what data is collected, how it is used, whether it is stored overseas, and patients’ rights to access or correct information.

    With AI tools increasingly used for transcription, scheduling, and diagnostics, new challenges arise. Practices should ensure AI systems comply with privacy obligations, disclose their use to patients, and update privacy policies accordingly. From 10 December 2026, practices must also disclose if automated decision-making is used via AI.

    What to Do Now

    To strengthen confidentiality compliance, practices should:

    • Review privacy policies and consent forms
    • Confirm patient record ownership in contracts
    • Audit third-party service providers
    • Train staff in privacy and cyber-awareness
    • Have a breach response plan in place
    • Review AI systems in use

    Final Word

    Confidentiality is at the heart of patient trust—and compliance is the legal foundation that supports it. By reviewing agreements, policies, and systems now, Queensland doctors and practices can protect their patients, avoid risk, and operate with confidence.

    Need tailored advice? Hillhouse Legal Partners can assist with patient record ownership, privacy compliance, and AI use in your practice.

    Areas of Expertise