Privacy Act Exemption? Health Clinics Never Got One

Key takeaways

• Health service providers are covered by the Privacy Act regardless of annual turnover, under section 6D(4)(b) of the Privacy Act 1988
• The general small business exemption threshold is $3 million annual turnover, set by section 6D(1)
• A gym or weight loss clinic becomes a health service provider the moment it collects health information, according to the OAIC
• 225 of the 1,205 data breach notifications reported to the OAIC in the 2025 calendar year came from the health sector, 19 percent of the total
• 716 of those 1,205 notifications were attributable to malicious or criminal activity, the OAIC’s July 2026 release shows
• Australian Clinical Labs was ordered to pay $5.8 million by the Federal Court on 17 October 2025 for failing to secure health records, the largest privacy penalty against an Australian health provider on record
• A separate proposal to remove the small business exemption for other industries has not been legislated as at August 2026. Keep it apart from the health provider carve-out, which is settled law
• A distinct, already enacted obligation commencing 10 December 2026 requires privacy policies to disclose automated decision-making, and it binds health providers who are already covered under 6D(4)(b)

The Short Answer

If your clinic provides a health service and holds health information, the Privacy Act 1988 applies to you no matter what your business turns over. This is not the general small business threshold at work, and it is not a proposal. Section 6D(4)(b) of the Act carves health service providers out of the small business exemption entirely, and that carve-out has stood for years. A solo cosmetic nurse turning over $150,000 a year carries the same Australian Privacy Principles obligations as a hospital network.

What the Privacy Act Actually Says

The Privacy Act 1988 (Cth) sets a general exemption at section 6D: an entity with an annual turnover of $3 million or less for a financial year is treated as a “small business operator” and sits outside most of the Act’s obligations, unless one of the exceptions in section 6D(4) to 6D(9) applies.

Section 6D(4)(b) is one of those exceptions. According to the OAIC’s Australian Privacy Principles Guidelines, Chapter B, the small business exemption does not apply to an entity that “provides a health service to another individual and holds any health information” other than in an employee record. There is no turnover figure attached to that sentence. It does not matter if you turn over $2,999 or $2.9 million.

The OAIC spells out the practical reach of this in its own guidance page, “What is a health service provider?”, which states plainly that an organisation providing a health service and holding health information is covered by the Privacy Act “even if they’re a small business or providing a health service is not their primary activity.” Its own example is a gym or a weight loss clinic, businesses that become health service providers the moment they collect a client’s health information, not because health care is their stated purpose.

Cosmetic injectable clinics and dental practices are squarely inside this. Consultation notes, medical history questionnaires, before and after treatment photos linked to a patient, and consent forms recording allergies or medications are all health information. Holding any of it, in any format, on any system, is enough.

Takeaway: the $3 million threshold in section 6D(1) never gets tested for a clinic, because section 6D(4)(b) removes the exemption before turnover is even asked about.

What This Means for the Build

Once you accept that coverage does not depend on revenue, three build decisions follow directly.

Privacy policy and collection notices. Australian Privacy Principle 1 requires an up to date, publicly available privacy policy describing what personal and health information you collect and why. A generic template downloaded once and never updated to match your actual intake form fields is a mismatch waiting to be found, either by a patient complaint or an OAIC spot check.

Intake and booking form design. Every field on a booking or intake form that captures health information (medical history, current medications, previous procedures, skin conditions) needs a collection notice at or before the point of capture, not buried three clicks away in a footer link. If your booking platform vendor controls the form markup, you still need to check what it actually asks for and whether your privacy policy names it.

Data breach notification duty. The Notifiable Data Breaches scheme applies to every entity bound by the Australian Privacy Principles, which includes every clinic covered under section 6D(4)(b) regardless of size. A breach involving patient records is not something a small clinic can treat as a private problem: it may trigger a formal notification obligation to the OAIC and to affected patients. The chart below shows why regulators are watching this sector specifically.

There is a second, separate obligation worth flagging while you are in the privacy policy anyway. From 10 December 2026, entities using automated decision-making that materially affects an individual (a triage chatbot scoring symptom severity, an automated lead-scoring tool ranking booking enquiries) must disclose that use in their privacy policy. This is covered in detail in our separate walkthrough of the ADM disclosure requirement; the point here is that it is an additional, already enacted duty layered on top of the coverage this post is about, not a replacement for it.

Are You Exempt? A Quick Decision Matrix

Turnover only matters once you know whether you hold health information as a principal, not as a data processor working under someone else’s instructions.

Takeaway: for a health service provider, the “holds health information” column is the only one that matters. The turnover column is decoration.

Two Clinics, Same Rule

These are illustrative worked examples with rounded figures, not audited financial data from named businesses.

Cosmetic clinic. A solo nurse-run cosmetic injectables clinic in Perth’s northern suburbs turns over roughly $180,000 in its first full year. The owner assumed she was exempt as a small business, having read that the Privacy Act “doesn’t apply under $3 million.” Her booking form collects medical history, current medications, and photographs linked to patient files. Because she provides a health service and holds health information, section 6D(4)(b) applies from her very first patient, at any revenue.

Cosmetic dentistry. A two-chair dental practice in a regional WA town turns over roughly $650,000. It runs its own practice management software holding treatment plans, X-rays, and Medicare claim details for existing patients. Same test, same result: turnover is not the relevant question, and it never was.

Both sit far under the $3 million line that would exempt an ordinary small business. Neither gets close to needing it.

What to Check on Your Own Site

• Privacy policy is published, current, and names the exact categories of health information your intake and booking forms actually collect
• A collection notice appears at or before the field that captures health information, not only in a linked policy page
• Data breach response steps are documented against the OAIC’s four-step containment, assessment, notification, and review model
• Your booking or practice management vendor’s data processing terms are on file, including where patient data is hosted
• Staff access to patient records uses individual logins with role restrictions, not one shared password
• A stated retention and deletion rule exists, and enquiries that never became patients are not held indefinitely by default
• If any part of your intake flow uses automated scoring or triage logic, note it now ahead of the 10 December 2026 disclosure deadline

The Penalty That Proves It Has Teeth

The clearest headline enforcement outcome in the Australian health sector to date is Australian Information Commissioner v Australian Clinical Labs Limited [2025] FCA 1224. On 17 October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million after it failed to take reasonable steps to secure health, contact, and credit card information for around 223,000 people, inherited through its acquisition of MedLab Pathology’s IT systems. The Court found breaches of Australian Privacy Principle 11.1(b) (reasonable security steps) and the timely breach assessment and notification requirements under the Notifiable Data Breaches scheme, reported by Clayton Utz’s analysis of the judgment.

Australian Clinical Labs is a large pathology provider, not a solo clinic, and this research pass did not find a published OAIC determination against a small cosmetic or dental practice specifically. That gap is worth stating plainly rather than papering over. But the obligations that ACL breached, reasonable security steps under APP 11 and timely notification under the NDB scheme, apply identically to a two-person clinic covered under section 6D(4)(b). Nothing in the Act scales the standard down for smaller revenue.

Takeaway: the largest privacy penalty in Australian health sector history landed on a big provider, but the rule it broke applies word for word to the smallest clinic on your street.

Where This Gets Hard

“Reasonable steps” under APP 11 is a fact specific standard, and it has mostly been tested against organisations with real security budgets and dedicated staff. What counts as reasonable for a solo practitioner running a website on a shared hosting plan and a booking widget from a third party vendor is genuinely less settled, and no regulator guidance sets a bright line by clinic size. The regulator says health service providers are covered regardless of turnover; the build consequence is that your privacy policy, intake forms, and breach response plan need to match what you actually collect and store; whether your particular arrangement discharges that obligation in your circumstances is a question for your medical defence organisation or your lawyer.

Separately, do not conflate this settled carve-out with the unrelated, unlegislated debate about removing the small business exemption for other industries generally. That is a live policy conversation, not a rule that applies to your clinic today, and it has no bearing on the analysis in this post either way.

Status

In force now, and has been for years. The health service provider carve-out in section 6D(4)(b) of the Privacy Act 1988 is settled law, not a proposal and not pending commencement. The separate, broader proposal to remove the small business exemption for other industries has not been legislated as at 15 August 2026: no Bill has passed and no commencement date exists. The automated decision-making disclosure obligation referenced above is enacted and commences 10 December 2026, a different and later date from anything discussed in this post’s main analysis.

Frequently Asked Questions

Does the Privacy Act small business exemption apply to cosmetic clinics?

No. Section 6D(4)(b) of the Privacy Act 1988 removes the exemption for any business that provides a health service and holds health information, regardless of annual turnover.

What turnover triggers Privacy Act coverage for other small businesses?

$3 million a year under section 6D(1). That threshold is irrelevant to health service providers, who are covered from the first patient record they hold, even at $0 turnover.

Is the government removing the small business exemption altogether?

Not yet. As at August 2026, no Bill removing the general small business exemption has passed and no commencement date has been set. This is a separate, unlegislated proposal and should not be confused with the health provider carve-out, which has applied for years.

Get Your Privacy Policy and Intake Forms Checked

If you want a second set of eyes on whether your privacy policy actually matches what your booking and intake forms collect, get in touch and RockingWeb will walk through it with you.

Sources

1. Federal Register of Legislation - Privacy Act 1988 (Cth), section 6D. Checked 15 August 2026.
2. OAIC - Australian Privacy Principles Guidelines, Chapter B: Key concepts (small business operator and health service provider definitions). Checked 15 August 2026.
3. OAIC - What is a health service provider? Checked 15 August 2026.
4. OAIC - Data breach notifications increase to all-time high in 2025, new NDB stats show, published 6 July 2026. Checked 15 August 2026.
5. OAIC - Notifiable Data Breaches scheme guidance. Checked 15 August 2026.
6. Clayton Utz - Landmark privacy penalty: what the ACL case means for data protection in Australia, covering Australian Information Commissioner v Australian Clinical Labs Limited [2025] FCA 1224, 17 October 2025. Checked 15 August 2026.

Last reviewed: 15 August 2026.