Australian Privacy Act and patient photographs:
what clinics must do
Health service providers are covered regardless of turnover. Since June 2025 a patient can sue you directly. And Australia has the strictest before-and-after advertising rules of any English-speaking market.
Three things that surprise clinics
- →Turnover is irrelevant. The small business exemption does not reach health service providers. A clinic turning over $400,000 is fully covered.
- →Patients can now sue you directly. A statutory tort commenced 10 June 2025, separate from any complaint to the regulator.
- →Three states add a second statute on top of the federal Act. The other five do not.
This is not legal advice and it has not been reviewed by Australian counsel. It is a practitioner-facing summary with every source named so you can check it. The Privacy Act has been amended repeatedly since 2022, three states add their own health records statutes, and AHPRA's advertising rules sit on top of all of it. Have your own adviser review anything you intend to rely on.
The short version
If you provide a health service, the Australian Privacy Act 1988 applies to you no matter how small you are. The small business exemption that covers most Australian businesses under $3 million turnover specifically does not reach health service providers. This is the single most common misunderstanding in Australian aesthetics.
A patient photograph is health information, and health information is sensitive information under the Act. That is the most protected category there is, and it changes what you must do before you collect it.
Since 10 June 2025 a patient can bring a civil claim against you for a serious invasion of privacy. It does not depend on the regulator, and it does not depend on whether the Privacy Act binds you.
And there are two rulebooks. The Privacy Act governs the information. AHPRA and the Medical Board govern the advertising, and on before-and-after images they are stricter than any other market we sell into.
Who the Privacy Act covers
My clinic turns over less than $3 million. Am I exempt?
No. The small business exemption in the Privacy Act does not apply to businesses that provide a health service and hold health information. A single-room injector, a two-chair skin clinic and a mobile practitioner are all covered in full.
This catches people because the exemption genuinely does cover most Australian small businesses. A cafe or a plumber under $3 million is outside the Act. A clinic is not, and never was.
Whether the small business exemption survives at all is under active reform discussion, and commentary on its status is unreliable. As far as we can establish it remained in force through 2026. It makes no difference to a clinic either way, because the health service carve-out already applies, but do not take a vendor's word for the general position.
What counts as a health service?
The Act defines it broadly. It is not limited to medicine, and it reaches an activity performed to assess, record, maintain or improve a person's health, or to diagnose or treat an illness, injury or disability.
For aesthetics, the practical reading is that if a clinician is assessing a patient and performing a procedure on them, the clinic is providing a health service. Branding yourself as a salon rather than a clinic does not change the analysis, and the OAIC looks at what is done rather than what it is called.
Does my state add anything on top?
In three jurisdictions, yes. The federal Act applies everywhere. New South Wales, Victoria and the Australian Capital Territory each layer a health records statute on top of it for private providers.
| Where you practise | What applies |
|---|---|
| New South Wales | Privacy Act 1988 plus the Health Records and Information Privacy Act 2002 |
| Victoria | Privacy Act 1988 plus the Health Records Act 2001 |
| Australian Capital Territory | Privacy Act 1988 plus the Health Records (Privacy and Access) Act 1997 |
| Queensland | Privacy Act 1988 |
| South Australia | Privacy Act 1988 |
| Western Australia | Privacy Act 1988 |
| Tasmania | Privacy Act 1988 |
| Northern Territory | Privacy Act 1988 |
The state statutes mostly restate the same ideas in different words. Where they bite is retention, which is covered below, and in the access rights they give patients.
Patient photographs under the Act
Is a patient photograph health information?
Yes, and that makes it sensitive information, which is the most protected category the Privacy Act recognises. Health information attracts stricter collection rules, stricter use and disclosure rules, and a higher expectation of security than ordinary personal information.
A clinical photograph is also, obviously, identifying. A face is the most identifying thing a person has, and a before-and-after pair carries more identifying information than either image alone.
Does that change if I only use it internally?
No. The classification does not depend on what you do with it. A photograph is health information from the moment it is taken, which is why where it is stored matters from that moment too.
The common failure is not malice, it is the camera roll. A photograph taken on a staff member's personal phone has already left the record and entered a consumer cloud account the clinic does not control, and in most cases one that syncs offshore.
Capture goes directly into the clinic account. Photographs never enter a staff member's camera roll, so they never leave the practice's control in the first place.
What does APP 11 require me to do about security?
Take reasonable steps to protect information from misuse, interference, loss, unauthorised access, modification and disclosure. What is reasonable scales with the sensitivity of the information, and health information sits at the top of that scale.
It also requires you to destroy or de-identify information you no longer need, which sits awkwardly against the retention periods below. The resolution is that a retention obligation overrides the destruction duty for as long as it runs.
Consent to photograph and to publish
Do I need consent to take a clinical photograph?
Generally yes. Health information is sensitive information, and the Act requires consent to collect sensitive information unless an exception applies. The usual exception for a treating provider is collection reasonably necessary for providing a health service, with the patient's consent.
In practice this is part of the consent to treatment, and it is satisfied by telling the patient what the photograph is for and recording that you did.
Does that cover using the photograph in marketing?
No, and this is the distinction clinics most often collapse. Consent to collect a photograph for care is not consent to publish it. Use for a purpose other than the primary purpose of collection requires either the patient's consent or an exception, and advertising is not an exception.
Consent that would survive scrutiny is written, specific about which photographs and which platforms, time-limited or withdrawable, and documented.
What a patient photo consent form must contain →
What makes consent valid under the Act?
The OAIC's long-standing position is that valid consent has four elements, and a signature on a bundled form satisfies none of them well.
| Element | What it means for a photograph |
|---|---|
| Informed | The patient knows which images, for what, and where they will appear |
| Voluntary | Declining has no effect on their treatment, and they know that |
| Current and specific | Not open-ended, and not covering platforms you have not named |
| Given by someone with capacity | Including the position where a parent or guardian consents for a minor |
The OAIC treats bundling as a problem in its own right. A patient who cannot decline the marketing consent without appearing to decline the treatment consent has not given a voluntary one. Separate the two documents.
AHPRA, the Medical Board and before-and-afters
Australia regulates cosmetic advertising more tightly than any other market we sell into. This is a second rulebook, enforced by a different body, and consent from the patient does not satisfy it.
Can I use patient testimonials in advertising?
No. Section 133 of the Health Practitioner Regulation National Law prohibits advertising a regulated health service in a way that uses testimonials about the service or the practitioner.
This is broader than most clinics assume. It reaches reviews you solicit, quotes you publish and, in AHPRA's reading, content you control on your own channels. It does not reach what a patient independently posts on their own account.
What are the rules for before-and-after photographs?
The Medical Board's guidelines for practitioners who advertise cosmetic surgery require before-and-after images to be genuine, unedited, and taken under consistent conditions, and to avoid digital enhancement that could mislead.
| Requirement | What it means in practice |
|---|---|
| Genuine | Same patient, your patient, your result |
| Unedited | No retouching, smoothing, blemish removal or colour grading |
| No filters | Including beautification filters some phone cameras apply by default |
| Consistent conditions | Same lighting, same position, same framing, same distance |
| Results-vary warning | Prominent, on any advertisement using them |
AHPRA's guidelines for advertising higher-risk non-surgical cosmetic procedures, in effect since 2 September 2025, require a prominent warning that results vary on any advertisement using before-and-after images.
Why does "consistent conditions" matter more here than anywhere else?
Because it is the requirement a clinic is most likely to breach without knowing. Nobody edits a photograph by accident. Everybody takes the second one from a slightly different distance, in slightly different light, three months later.
An after photograph taken closer, or under a window instead of a ceiling light, flatters the result without anyone intending it to. The rule does not ask about your intent.
CureCast puts the earlier photograph over the live camera so the follow-up can be lined up against it, and records the lens, field of view, zoom and capture conditions with every image. That lets a practice demonstrate consistency rather than assert it. The image stored is the image captured, with no editing, filtering or retouching at any point.
Patients can now sue you directly
What changed on 10 June 2025?
A statutory tort for serious invasions of privacy commenced. An individual can now bring a civil claim in their own name, rather than complaining to the OAIC and waiting for the regulator to act.
The claim covers both intrusion upon seclusion and misuse of information about a person, where they had a reasonable expectation of privacy and the invasion was intentional or reckless.
Why does this matter for a clinic specifically?
Three reasons, and the third is the one that should change behaviour.
- It does not depend on the regulator. A patient who is upset does not need the OAIC to agree with them before anything happens to you.
- It applies regardless of turnover, and regardless of whether the Australian Privacy Principles bind the business at all. An exempt business is still exposed.
- A clinical photograph published without proper consent is close to the paradigm case. A patient has a reasonable expectation of privacy in an image of their own body taken during treatment, and publishing it is a misuse of information about them.
It is not a claim for every administrative slip. The threshold is a serious invasion, invaded intentionally or recklessly. But "we assumed the old consent form covered it" is closer to reckless than to careful, and that is the distance worth closing.
The Notifiable Data Breaches scheme
Do I have to report a data breach?
Yes, where it is an eligible data breach. The Notifiable Data Breaches scheme requires you to notify both the affected individuals and the OAIC when there is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm.
Health information raises the likelihood of serious harm, so a breach involving patient photographs will more often be notifiable than one involving, say, appointment times.
What has to happen, and how fast?
| Step | What is expected |
|---|---|
| Suspect a breach | Assess it expeditiously, and within 30 days |
| Confirm it is eligible | Notify the OAIC and affected individuals as soon as practicable |
| Remedial action | If you act fast enough that serious harm is no longer likely, notification may not be required |
Every step above depends on knowing what was accessed and by whom. A clinic that cannot answer that cannot assess the breach, cannot scope the notification, and cannot demonstrate remedial action. CureCast records every view, download and share against the staff member, device and timestamp. See how the audit trail works →
What a breach can cost
What are the maximum penalties?
For a serious or repeated interference with privacy, the maximum for a body corporate is the greatest of three figures.
or 30% of turnover
Whichever is greater. The turnover measure is adjusted turnover for the relevant period, which is what makes the regime bite on businesses far smaller than the headline figure suggests.
Lower-level failures attract infringement notices rather than civil penalties, and the published figures for those conflict across sources, partly because the penalty unit value changes. Check the current amount with the OAIC rather than relying on a figure from a blog, including this one.
Is a small clinic really exposed to this?
The 30% of turnover limb is the one that reaches you. The $50 million headline is designed for large corporations. A penalty calculated on a small clinic's turnover is proportionally just as serious, and the regime applies to you for exactly the same reason the Act does: you provide a health service.
How long records must be kept
How long must I keep patient records?
In New South Wales, Victoria and the Australian Capital Territory, the widely applied position is seven years from the last occasion of service for an adult, and for a child, until that person turns 25.
The source of the seven-year rule is not always the health privacy statute itself. In New South Wales, for instance, it has been attributed to the medical practice regulations rather than to the Health Records and Information Privacy Act. This matters when you are asked to point to the obligation, so confirm the instrument that binds you rather than citing the Act generally.
In the other five jurisdictions there is no equivalent statutory minimum for private providers. Professional indemnity insurers commonly advise using the seven-year and age-25 periods as the benchmark anyway, which is prudent rather than mandatory.
Photographs are part of the record. A practice that deletes images to save storage while keeping the notes has not retained the record.
APP 8 and cross-border disclosure
Does the Privacy Act require patient data to stay in Australia?
No. There is no data residency requirement in the Privacy Act. Several vendors imply otherwise, and some clinics assume it because the health sector feels like it ought to have one.
So what does APP 8 actually do?
It makes you accountable for what the overseas recipient does. This is a stronger mechanism than a residency rule, and it is widely misunderstood as a weaker one.
Before disclosing personal information overseas you must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles. And where the overseas recipient then does breach them, the Act can treat that as a breach by you.
A residency rule would tell you where to put the data. APP 8 tells you that wherever you put it, the consequences remain yours.
The practical effect for a clinic is that the contract matters more than the map. What you need from any vendor is a written commitment that binds them to Australian-equivalent handling, not a reassurance about a data centre.
What should I ask a vendor?
- Where is the data stored, and is any copy held elsewhere for backup or recovery?
- Which sub-processors touch it, and where are they?
- Does the agreement bind you to handle it consistently with the Australian Privacy Principles?
- Who can access patient images from outside Australia, under what circumstances, and can we refuse?
- What happens to the data when we leave?
A list that exists only on a web page is not a contractual commitment. Have the answers named in the agreement, because APP 8 leaves the accountability with you regardless of what you were told verbally.
What CureCast does, and does not do
CureCast is clinical photo management. It is not a practice management system, it does not hold your clinical notes, and it does not connect to My Health Record.
| Obligation | What CureCast provides |
|---|---|
| Keep health information out of personal devices | Capture goes directly into the clinic account. Photographs never enter a staff member's camera roll |
| Reasonable security steps under APP 11 | AES-256 encryption at rest, TLS in transit, and per-individual access |
| Assess and scope a data breach | Every view, download and share written to an audit trail |
| Restrict who sees what | Module and action-based permissions per staff member |
| Honour a patient's restriction | Confidential patient records, invisible to unauthorised staff |
| Unedited images, consistent conditions | No editing, filtering or retouching. Lens and capture conditions recorded with every image |
| Consent held with the record | Customisable consent forms, up to four signatures, stored as a PDF with the photographs |
| Retention | Photographs retained with the patient record rather than deleted to save space |
Make you compliant. Privacy Act obligations attach to the entity, not the vendor, and AHPRA's advertising rules attach to the registered practitioner. A system can make both achievable and evidenced. It cannot assume them.
Sources and what we could not verify
Primary instruments. Obtain current texts from the issuing authority rather than relying on this page.
- Privacy Act 1988 (Cth) and the Australian Privacy Principles, particularly APP 3, APP 6, APP 8 and APP 11
- Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, which raised the civil penalty maximums
- Privacy and Other Legislation Amendment Act 2024, including the statutory tort for serious invasions of privacy, commenced 10 June 2025
- Notifiable Data Breaches scheme, Part IIIC of the Privacy Act
- Health Practitioner Regulation National Law, section 133, on advertising and testimonials
- Medical Board of Australia, Guidelines for registered medical practitioners who advertise cosmetic surgery
- AHPRA, Guidelines for advertising higher-risk non-surgical cosmetic procedures, in effect 2 September 2025
- Health Records and Information Privacy Act 2002 (NSW)
- Health Records Act 2001 (Vic)
- Health Records (Privacy and Access) Act 1997 (ACT)
- Office of the Australian Information Commissioner, APP Guidelines and health information guidance
What we could not verify
Stated plainly, because a knowledge page that hides its gaps is not one.
- Infringement notice amounts. Sources conflict, and the penalty unit value changes. Check with the OAIC
- The current status of the small business exemption. Under active reform discussion and reported inconsistently. It does not affect clinics either way
- Which instrument sets the seven-year retention rule in each state. Commonly attributed to the health privacy statutes, and in at least one state it sits in medical practice regulations instead
- AHPRA and Medical Board guidance is revised frequently. We have named the instruments rather than reproducing their current text
Written by Vishal Parikh, Founder, CureCast. Last reviewed 11 October 2026. For clinics across Australia. Not legal advice, and not reviewed by Australian counsel. The Privacy Act has been amended repeatedly since 2022, three states add their own health records statutes, and AHPRA's advertising rules sit on top of all of it. Have counsel review anything you intend to rely on, and obtain current statutory text and current regulator guidance from the issuing authority rather than from any summary, including this one.
See How CureCast Fits Your Practice
Discuss how CureCast fits into your clinical photo workflow, from capturing and organizing patient photos to securely managing them across your practice.
Prefer email? [email protected]