How CureCast supports
Australian requirements.
Built to support the 13 Australian Privacy Principles and the Notifiable Data Breaches scheme, for plastic surgery, aesthetic, dermatology and medical spa practices handling health information.
The regulation that applies to your practice
Australian healthcare practices, including plastic surgery, aesthetic surgery, dermatology, and medical spa practices handling patient data, are subject to the Privacy Act 1988 and its 13 Australian Privacy Principles (APPs), overseen by the Office of the Australian Information Commissioner (OAIC).
Health service providers are covered by the Privacy Act regardless of annual turnover. The small-business exemption that applies to some other sectors does not apply to practices handling health information.
What Counts as Sensitive Data Here
Health information, including patient photos, clinical notes, and any identifying information collected in the course of providing a health service, is treated as sensitive information under the Privacy Act, subject to stricter handling requirements than general personal information.
Australia’s Notifiable Data Breaches (NDB) scheme requires practices to notify both affected individuals and the OAIC when a data breach is likely to result in serious harm. An eligible data breach involves unauthorised access to, unauthorised disclosure of, or loss of personal information, where that risk hasn’t been prevented through remedial action. Practices generally have 30 days to assess a suspected breach, then must notify as soon as practicable once the breach is confirmed.
Data residency & Data Processing Agreement
CureCast hosts Australia data on AWS’s secure cloud infrastructure, encrypted at rest with AES-256 and protected in transit with TLS 1.3, with TLS 1.2 supported as a fallback.
The Australian Privacy Act doesn’t require patient data to stay within Australia for a platform like CureCast. A stricter residency rule does exist in Australia, but it’s scoped narrowly to the My Health Record national system under the My Health Records Act, which CureCast operates independently of. CureCast’s AWS infrastructure is built to support the Australian Privacy Principles’ cross-border disclosure requirements.
If your practice needs a specific regional hosting arrangement, our team can discuss it directly.
How CureCast supports Australia Requirements
Frequently asked Questions
Is CureCast compliant with the Australian Privacy Act?
CureCast supports Australian Privacy Act requirements. There is no official third-party certification against the Australian Privacy Act for software vendors. Each practice remains responsible for its own compliance.
Is patient data stored in Australia?
The Australian Privacy Act doesn’t require patient data to stay within Australia. CureCast hosts Australia accounts on AWS’s secure cloud infrastructure, encrypted at rest with AES-256. This is separate from the My Health Record system, which has its own, stricter residency rule under the My Health Records Act.
What counts as a data breach under the Australian Privacy Act?
An eligible data breach occurs when unauthorized access, disclosure, or loss of personal information is likely to cause serious harm to the individuals involved, and the risk can’t be remedied in time. Entities generally have 30 days to assess a suspected breach, and must notify the OAIC and affected individuals as soon as practicable once it’s confirmed.
Do I need a separate agreement with CureCast for Australia use?
An Australia-specific Data Processing Agreement is separate from any US-facing agreement. Contact CureCast to confirm the right agreement for your account.
How do patients send photos to CureCast securely in Australia?
Patients can upload photos through CureCast’s secure remote upload link. No app download or account creation is required on their end.
See How CureCast Fits Your Practice
Discuss how CureCast fits into your clinical photo workflow, from capturing and organizing patient photos to securely managing them across your practice.
Prefer email? [email protected]