Before anything else: this is general information written by people who install systems, not lawyers. It is a map of the questions, not advice on your situation. Get your own legal advice — and if it helps, we'll answer your lawyer's technical questions directly.
First, does the Privacy Act even apply to you?
Many small Australian businesses are exempt from the Privacy Act 1988 (Cth) if their annual turnover is $3 million or less. That exemption is narrower than people assume, and two of its exceptions cover a lot of our clients: businesses that provide a health service and hold health information are covered regardless of turnover, as are businesses that trade in personal information.
So a two-person physio practice turning over $400,000 is covered. A three-person conveyancer might not be — though professional obligations and client expectations usually get you to the same place anyway. In NSW, health information carries an additional layer under the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles.
Obligation one: consent to record
This one isn't in the Privacy Act at all, which is why it gets missed. In NSW, the Surveillance Devices Act 2007 makes it an offence to use a listening device to record a private conversation without the consent of the principal parties to it, with limited exceptions. Every state has an equivalent.
In practice: tell the person you'd like to record the consultation, say what it's for, and get a yes before you start. Note it in the file. Practices we work with build the sentence into the opening of the appointment, and put a line in the patient information sheet as well. Consent has to be real — the person needs to be able to say no and still get their appointment.
Obligation two: tell people what you're doing (APP 5)
Australian Privacy Principle 5 requires you to notify people about the collection of their personal information: what you're collecting, why, who you might give it to, and whether it's likely to go overseas. If a recording of the consultation is being sent to a vendor's servers, that belongs in your privacy collection notice, and if those servers are offshore, so does that.
Updating the notice is a twenty-minute job. Not updating it, and having a patient discover the arrangement later, is the kind of complaint that reaches the OAIC.
Obligation three: cross-border disclosure (APP 8)
This is the one that most affects your choice of tool. Before you disclose personal information to an overseas recipient, APP 8 requires you to take reasonable steps to ensure the recipient does not breach the APPs in relation to that information — and under the associated accountability provision, you can remain responsible for what the overseas recipient does with it.
What that means in daily practice:
- Know where the processing happens. Ask the vendor, in writing, which countries. Ask about sub-processors, because the speech and language models are often someone else's service.
- Read the contract for training rights. If your recordings can be used to improve the vendor's models, that's a disclosure with a very long tail.
- Keep the paperwork. "Reasonable steps" is a standard you meet with evidence, not intentions.
If the audio never leaves your building, APP 8 doesn't come into it at all. That's the structural reason clinics move to on-premise systems, and it's a much simpler position to hold than a well-managed offshore arrangement.
Obligation four: security and retention (APP 11)
You must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access — and to destroy or de-identify it when it's no longer needed for a permitted purpose. Note that health records carry their own minimum retention periods under state law, which sit alongside this, so "delete everything" isn't the answer either.
For a transcription workflow, three practical questions cover most of it:
- What happens to the audio after the note is written? Our default is to delete it once the note is approved, because a recording of a consultation is the most sensitive artefact in the chain and the least useful to keep.
- Who can reach the machine or the account? Per-user logins, not a shared password taped to the monitor. On our installs the assistant is reachable only from inside your network.
- What's the backup, and is it encrypted? An on-premise system moves this responsibility to you. That's a fair trade for the control, but it is a real responsibility and we set it up as part of the install.
The part the law doesn't cover
Two things sit outside privacy law and matter just as much.
The note is still yours. A transcript summarised by a model is a draft, and the clinician or practitioner signing it is the one responsible for what it says. Every workflow we build assumes a human reads and approves before anything is filed or sent. In the medical setting there's a further line we hold hard: these systems are administrative tools for documentation, not clinical decision tools, and we don't market them as anything else.
And your professional obligations may be stricter than the statute. Legal professional privilege, professional indemnity conditions, and the rules of your registration body can all set a higher bar than the Privacy Act. Check those before you check the legislation.
A short checklist
- Consent
- Told, asked, agreed, noted — before recording starts.
- Notice
- Collection statement updated, including offshore processing if it applies.
- Location
- Countries of processing and storage confirmed in writing, sub-processors listed.
- Training
- Contract says your content is not used to train models.
- Retention
- Audio deleted on approval; records kept for the period your profession requires.
- Access
- Individual logins, network-only access, encrypted backup.
If you'd like, bring your existing arrangement to a 20-minute call. Book a chat.