Skip to main content
← All articles

Privacy impact assessment for healthcare: a clinic guide

Hand-drawn clinic privacy title-card illustration

A privacy impact assessment (PIA) is a structured review of how a project handles personal information, what that does to patient privacy, and what you will change to reduce the risk. For an Australian allied-health clinic, it is the most practical way to check a new booking tool, intake form, telehealth setup or AI feature before patient data goes through it. This guide explains when to do one, what the law says, and how to run one in ten steps.

Meddle
Make Patient Booking More Privacy-Conscious
Meddle connects patients with healthcare providers through an encrypted platform, with AI-powered matching and appointment scheduling.

TL;DR

  • A PIA assesses a project’s effect on individual privacy and recommends how to manage, minimise or eliminate it. The OAIC encourages one for any project that handles personal information.
  • Private clinics are not legally directed to complete a PIA, but the Privacy Act 1988 still applies, and health information is sensitive information.
  • Start every project with a short threshold assessment. Only projects that clear the bar need the full process.
  • Map where patient information comes from, where it is stored, who can see it and where it goes next. Most clinic risks sit in those flows.
  • Treat the PIA as a living document: keep a copy, name an owner and review it when the project changes.

Table of Contents

What a privacy impact assessment is, and why it matters to a clinic

The Office of the Australian Information Commissioner (OAIC) describes a PIA as a systematic assessment of a project’s impact on individuals’ privacy that recommends ways to manage, minimise or eliminate that impact. It helps you build privacy into the design of a project and maintain patient trust.

The same guide lists what goes wrong without one: non-compliance with privacy law, loss of credibility, reputational damage, and risks found late, when fixing them costs more.

That last point matters for small practices. Changing an intake form before launch costs an afternoon. Changing it after six months of referrals have flowed through a shared inbox costs far more, and some of the damage cannot be undone.

The Office of the Victorian Information Commissioner suggests that the easiest way to win support for a PIA is to frame it as privacy by design: dealing with risk upfront is far less damaging than reacting to harm. That framing works well with practice owners who worry about paperwork.

What a privacy impact assessment is, and why it matters to a clinic — overview diagram

Is a PIA legally required for a healthcare practice?

Not for most private clinics, but it is still strongly recommended.

The OAIC strongly encourages entities to run PIAs as a matter of course for projects involving personal information, and recommends a threshold assessment for every such project. Australian Government agencies must conduct PIAs for high privacy risk projects, and the OAIC cannot direct a private organisation to conduct one.

The obligations that do bind your clinic sit elsewhere:

  • Privacy Act 1988 and the Australian Privacy Principles (APPs). Private health service providers must comply with the Act. Under it, health information is sensitive information, which carries stricter handling standards. The OAIC’s guide treats allied health practitioners as health service providers alongside GPs, specialists and pharmacists.
  • State and territory law. In NSW, Victoria and the ACT, private providers must also comply with state or territory privacy laws when handling health information. If you operate across borders, check each jurisdiction.
  • My Health Record rules. If your clinic is connected, misuse of the emergency access function may contravene the My Health Records Act 2012 and may be an interference with privacy under the Privacy Act.

A PIA is how you show, on paper, that you looked at these obligations before you launched something, not after a complaint arrived. If you are working from an APP-by-APP angle, our six clinic steps for meeting the Australian Privacy Principles is a good companion.

When to run one

Run a threshold assessment whenever you plan to change how personal information is collected, stored, used or disclosed. In an allied-health clinic that usually means:

  • Adopting or replacing a practice management system, booking tool or patient portal.
  • Starting telehealth, or changing the video platform you use.
  • Changing how referrals arrive, for example moving from fax and email to a web form or an automated intake process.
  • Introducing AI tools such as transcription, triage or matching.
  • Moving patient records to a new system.
  • Sharing data with a third party for analytics, marketing or a CRM.
  • Opening a new site, or starting NDIS or other funded programs with new reporting requirements.

The NSW Information and Privacy Commission stresses that a PIA is a process, not a one-off tool, and should start at the earliest project stages and continue through deployment. Begin before you sign a contract, not after go-live.

The ten OAIC steps, applied to a clinic

The OAIC’s guide sets out ten steps. It also offers a PIA tool to help with conducting and reporting, and encourages a flexible approach scaled to the project’s risk and complexity. A new reminder-SMS setting does not need the same depth as a new records system. For a deeper walk-through, see our post on the 10 OAIC PIA steps for privacy by design.

1. Threshold assessment

Ask a few quick questions. Does the project involve personal information? Does it include health information, children’s data or NDIS participant details? Does it add a new vendor, a new type of disclosure or automated decision-making? If the answers are mostly no, record that and stop. If yes, continue. Keep the one-page record either way.

2. Plan the PIA

Decide the scope, who leads, who contributes and how long it should take. A solo practitioner might finish in an afternoon. A group practice introducing a new platform may need a few weeks. Name one accountable person, usually the practice manager or privacy officer.

3. Describe the project

Write a plain description: what you are doing, why, what the system does, who the users are and what changes for patients. Include the vendor and any subcontractors you know about.

4. Identify and consult stakeholders

In a clinic that means reception and intake staff, clinicians, the practice owner, the IT provider and the vendor. Consider patients, carers and referrers, too. A short survey or a conversation with a few patients often turns up concerns no one on staff thought of. Reception teams in particular know where information really travels.

5. Map information flows

This is the core of a healthcare PIA. For each type of information, record:

  1. Where it is collected (web form, phone, GP referral, email, paper).
  2. What is collected, and whether each item is needed.
  3. Where it is stored and where that system is hosted.
  4. Who can access it, and how access is granted and removed.
  5. Where it is sent next (other clinicians, funders, referrers, vendors).
  6. How long it is kept and how it is destroyed.

Draw it as a diagram if you can. Gaps, such as an inbox forwarded to a personal phone, become obvious.

6. Privacy impact analysis and compliance check

Test each flow against the APPs and any state law. Typical questions: is collection necessary and is the patient told (APPs 3 and 5)? Is use limited to the purpose they would expect (APP 6)? Are overseas disclosures identified (APP 8)? Is the information secure, and destroyed when no longer needed (APP 11)? Can patients access and correct it (APPs 12 and 13)? Our guide to securing patient records and meeting APP 11 covers the security question in more detail.

7. Privacy management: address the risks

For each risk, decide whether to remove it, reduce it, transfer it or accept it, and record why. Typical controls include collecting fewer fields, role-based access, multi-factor authentication, staff training, contractual limits on vendors and clearer patient notices.

8. Recommendations

Turn the controls into a short action list with an owner and a due date for each item. Separate must-do items before launch from improvements afterwards.

9. Report

Compile the description, flow map, analysis, risks and recommendations into one document. Length should match the project. Four pages is fine for a modest change.

10. Respond and review

Implement the actions, record what was done and review the PIA when the project changes or at a set interval. Privacy officers should keep copies of completed PIAs and review them to check they identify risks and mitigations.

What a healthcare PIA should cover

The OAIC advises that a PIA should cover the whole project lifecycle: document the flows of personal information, analyse the impact on privacy and set out how to reduce or remove the risks. For an allied-health practice, check these areas.

Area What to check
Intake and referrals Which fields you collect, how referrals arrive, who opens shared inboxes, how consent is captured
Clinical records Where notes live, access by role, audit logging, retention and destruction
Booking and messaging What appears in SMS and email reminders, whether messages reveal the type of service
Telehealth Platform security, where sessions or recordings are stored, patient location and identity checks
Vendors and hosting Where data is hosted, subcontractors, what happens to data when the contract ends
AI and automation What data the tool uses, whether decisions affect patients, how errors are caught
Funding and reporting Information shared with NDIS, insurers or employers, and on what authority
Staff access Onboarding and offboarding, shared logins, device security

Digital platforms and AI

The Department of Health, Disability and Ageing’s review notes that the Privacy Act and the APPs govern AI use in healthcare, including training, testing and deployment. It also says data and consent risks should be managed across the AI lifecycle, with clear rules on data access and use, and governance covering bias, data accuracy and access.

The same report records that the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, amends the Privacy Act to increase transparency about automated decisions that use personal information. If a tool sorts, ranks or matches patients automatically, your PIA should record what it does and how you would explain it to a patient. Our six quick checks for algorithmic bias is a practical starting list, and our guide to aligning consent with OAIC rules covers the consent side.

Governance gaps the regulator has found

An OAIC assessment of GP clinics and pharmacies found a lack of oversight, governance and awareness of the My Health Record emergency access function. Fewer than 13% of surveyed providers reviewed system access logs, and fewer than half trained their staff. The lesson reaches beyond My Health Record: having a control on paper is not the same as using it. Build log review and staff training into your PIA actions with a named owner, and see our My Health Record compliance guide.

The OAIC’s investigation into the release of MBS/PBS data offers a second lesson. It found that inadequate de-identification and risk assessment created a risk of re-identification, even though the decision was made in good faith. If you plan to share de-identified data for research, reporting or analytics, assess the re-identification risk explicitly.

A worked example: replacing your intake process

Imagine a six-practitioner physiotherapy and psychology clinic that currently receives referrals by email, fax and a web form. Reception copies details into the practice management system by hand. The clinic wants a structured intake tool.

  1. Threshold: the project involves health information and a new vendor, so a full PIA is warranted.
  2. Flows: referral arrives, details are collected, patient is triaged, practitioner is allocated, appointment is booked, reminders are sent, notes are recorded. The map shows referrals also sit in three staff inboxes and a shared drive.
  3. Risks: over-collection on the form, reminders that disclose the service type, no clear deletion step for declined referrals, unclear hosting location.
  4. Actions: trim the form, change the reminder wording, set a retention rule for unactioned referrals, confirm hosting and subcontractors in writing, and close the shared inbox once the new flow is live.
  5. Review: three months after launch, check that the actions were done and that access logs are being reviewed.

The PIA does not slow the project. It produces the vendor questions and the staff training list you would otherwise have to improvise. For vendor due diligence, our security questionnaire for healthcare software gives you questions to send before you sign.

Our perspective

We see the same pattern in allied-health clinics. Referrals arrive through GPs, email and web forms, and each channel carries patient information into a different place. The privacy risk is rarely one dramatic failure. It is a dozen small gaps in how information moves between the front desk, the clinician and the next provider.

That is why we think a PIA is most useful when it starts from the patient’s journey, not from a software feature list. Follow the person from the first enquiry to the first appointment and ask at each handover: who sees this, why do they need it and what happens to it afterwards?

Our perspective — overview diagram

We also think clinics should expect clear answers from any platform they adopt. Where is patient data hosted? For Meddle, patient data is hosted in Sydney. What is collected, who can see it and how does a patient’s story travel with them so they do not repeat it at every handover? A vendor that cannot answer those questions plainly has given you a PIA finding.

Keep the document short, keep it honest and keep it current. A two-page PIA that is reviewed beats a thirty-page one that sits in a drive.

— Taylor

Where Meddle fits

Meddle turns referrals from GPs, email and web forms into structured intake, triage and practitioner matching on specialty, travel radius and appointment type. For clinics that makes the information flow easier to map: one structured path in place of several informal ones, with patient data hosted in Sydney.

Pricing is AA$40 per practitioner per month ex GST, with a A$250 minimum, and a free 30-day pilot lets you test the workflow against your own PIA before committing. Optional add-ons cover things like SMS notifications and CRM integrations. You can see how patients and referrers use the platform on our find care page and our page for referrers.

Meddle

Whichever platform you choose, run the PIA yourself and keep the record. A vendor can supply information, but responsibility for your patients’ information stays with your clinic. If you are also reviewing how you share documents, our 90 day plan for secure document sharing and our data governance pillars help you set the wider framework.

Documenting, approving and reviewing your PIA

A workable record includes:

  • Project name, date, author and approver.
  • The threshold assessment result.
  • The project description and information flow map.
  • Risks, ratings and the reasoning behind them.
  • Actions with owners and due dates.
  • A review date and the trigger events that would bring it forward, such as a change of vendor, a new data type or a privacy incident.

Have the practice owner or principal sign it off. Store it where the privacy officer can find it, and link it from your privacy policy review and your vendor files. When you migrate systems, revisit it; our guide to migrating patient records with OAIC privacy and FHIR lists the questions to add.

FAQ

Does my small clinic really need a PIA?

The OAIC cannot direct a private organisation to complete one, but it recommends a threshold assessment for every project that handles personal information. For a small clinic, the threshold step alone takes minutes and tells you whether to go further. Health information is sensitive information under the Privacy Act, so the bar for care is high.

Who should lead the PIA in a clinic?

Usually the practice manager or a nominated privacy officer, with input from reception, clinicians and the IT provider. The person leading should have the authority to change processes. The practice owner should approve the final recommendations.

How long does a PIA take?

It depends on the project’s scale and risk. A simple change might need a one-page threshold record and a short review. A new records system or AI tool can take several weeks because of vendor questions and stakeholder consultation. The OAIC encourages a flexible approach scaled to risk and complexity.

When should I update a PIA?

Whenever the project changes materially: a new vendor, a new type of data, a new disclosure, a new site or after an incident. Set a routine review date as well. The NSW Information and Privacy Commission describes a PIA as a process that continues through deployment, not a one-off exercise.

Next step

If you are weighing a new intake or matching workflow and want to see how it maps against your own PIA, book a 30-minute demo. We will walk through the information flow with you.

Sources

This article is general information for healthcare businesses and isn’t legal, clinical or privacy advice. Check current requirements with the relevant regulator or a qualified adviser.