The Privacy Act and your patients' data: a guide for psychologists

Clinical notes are among the most sensitive personal information a business can hold, and in Australia that's governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) it sets out. Here's what that actually requires of a psychology practice, in plain terms.

What the Privacy Act actually covers

The Privacy Act 1988 (Commonwealth) is Australia's principal privacy law, regulating how organisations — including most private psychology practices — collect, hold, use and disclose personal information. It sets out 13 Australian Privacy Principles (APPs) that apply across the information lifecycle, from the moment you first collect a client's details to how you eventually destroy or de-identify them.

Health information is sensitive information

Under the Privacy Act, health information — including psychological assessments, session notes and treatment records — is classified as "sensitive information," which attracts a higher standard of protection than ordinary personal information. In practice, that means clearer rules around consent, tighter restrictions on when you can use or disclose it, and a stronger expectation of security around how you store it.

Consent and lawful basis

Generally, you need a client's consent to collect and use their health information for the purpose of providing treatment, and you should be clear with them, ideally in writing at intake, about what you collect, how you'll use it, and who might see it (for example, in a supervision context, or if you need to share information with another treating practitioner with the client's consent). Consent given for one purpose doesn't automatically extend to a different, unrelated use.

Data security expectations

APP 11 requires you to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. For a psychology practice, that translates into practical measures: encrypted storage, access limited to people who need it, secure backups, and a clear process for what happens if a client's file needs to be transferred, exported or securely destroyed.

Your clients' rights over their own information

• Access. Clients generally have a right to request access to their own health information you hold.
• Correction. They can ask you to correct information that's inaccurate, out of date or incomplete.
• Complaints. If they believe their privacy has been breached, they can complain to you directly, and if unresolved, to the OAIC.

The OAIC is the regulator

The Office of the Australian Information Commissioner (OAIC) is the independent body that oversees compliance with the Privacy Act, handles complaints, and can investigate and take action over serious or repeated breaches. If you're ever unsure whether something you're planning complies, the OAIC's own guidance for health service providers is the authoritative place to check — not a general summary like this one.

Bringing it together

The Privacy Act 1988 and the Australian Privacy Principles set a clear, if detailed, standard for how a psychology practice needs to handle client information: informed consent, real security measures, a plan for breaches, and respect for a client's right to access and correct their own records. None of this needs to be intimidating — it mostly describes what careful clinical practice already looks like, formalised into law with the OAIC as the regulator that expects you to meet it.