Health information and the Privacy Act: what to ask a software vendor

When a software vendor will store, host or access health information for you, the Privacy Act still treats that information as yours to protect. Health information is sensitive information, the Act covers health service providers whatever their size, and your vendor's practices become your risk. The quickest way to test a vendor is to ask questions tied to the Australian Privacy Principles (APPs) and compare the answers with what good looks like.

This post is part of our guide to healthcare software development in Australia. This article is general information, not legal advice.

How the Privacy Act treats health information#

Five points shape every vendor conversation.

1. Health information is sensitive information. The OAIC's key concepts guidance lists health information among the categories of sensitive information, which the APPs protect more strictly than other personal information, for example when it comes to secondary use.
2. Size does not exempt health providers. The Act generally covers organisations with annual turnover above A$3 million, but it also covers private sector health service providers regardless of turnover.
3. Outsourcing does not end your obligations. You "hold" information if you have possession or control of it, and the OAIC says an organisation that outsources storage but keeps the right to access and amend the information still holds it. Your APP 11 security duties continue.
4. Your vendor may not be bound directly. A small software business may fall outside the Act, so the contract must carry the protections you need.
5. Overseas access makes you accountable. Under APP 8 and section 16C, if you disclose personal information to an overseas recipient you generally remain accountable for how it is handled.

In NSW, Victoria and the ACT, private sector health service providers also have state or territory health records laws to comply with, so include those in your review.

The vendor due-diligence questionnaire#

Send these questions in writing before a demo turns into a contract, and ask for evidence rather than a sales call. Each row links a question to an APP.

A few rows deserve more explanation.

• APP 1 and automated decisions. From 10 December 2026, if a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect someone's rights or interests, your privacy policy must describe the kinds of personal information used and the kinds of decisions made. You cannot write that without the vendor's help.
• APP 5 notices. Collection notices must cover matters such as your identity, usual disclosures, and whether you are likely to disclose information overseas and to which countries. The vendor's answer to the APP 8 question feeds straight into your notice.
• APP 6 and AI. For sensitive information, a secondary use generally needs consent, or a directly related purpose the person would reasonably expect, unless another exception applies. The OAIC's guidance on commercially available AI products recommends checking whether a provider's terms let it use your inputs for further AI training.
• APPs 12 and 13. The OAIC treats 30 calendar days as a general guide for responding to access and correction requests. If the vendor's export takes a support ticket and a week, your timeframe is already under pressure.

Red flags in vendor answers#

Treat these as reasons to slow down:

• Reassurance without detail, such as "we take privacy seriously", with no policies, logs or architecture to show.
• No clear answer about which countries support staff or subcontractors work from.
• A plan to "anonymise" your data for the vendor's own use, with no detail on method or purpose.
• No breach notification commitment in the contract, or a commitment measured in weeks.
• Exports only as PDFs, only on request, or only for a fee.
• Data centre certificates presented as if they were the vendor's own.

Put the answers into the contract#

Good answers only protect you if they end up in the contract. Ask your lawyer to cover at least these points:

• The purposes for which the vendor may handle your information, and a ban on other uses, including AI training, without your written agreement.
• Where data may be stored and accessed, the approved subcontractors, and notice before either changes.
• The security measures promised in the questionnaire, and your right to evidence of them.
• A breach notification window, cooperation with your assessment, and who notifies individuals and the OAIC.
• Support for access and correction requests within agreed timeframes.
• Return and deletion of data, including backups, when the contract ends.

The NDB scheme lets one entity assess and notify on behalf of all entities that jointly hold the affected information, so decide in advance which of you will do it. Our data breach response plan guide covers what the first hours and days should look like.

Written instructions may matter even more in future. The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released on 31 August 2026, proposes "controller" and "processor" roles: a processor acting on a controller's documented written instructions would generally not itself breach the APPs (other than APPs 1 and 11), and the controller would be treated as having done the act. It is a draft and may change, but documenting your instructions to vendors is good practice either way.

How to run a vendor privacy review#

1. Map the data. List the health information involved, whose it is, where it comes from and which systems it passes through.
2. Send the questionnaire early. Ask for written answers before the final demo, not after the contract is drafted.
3. Ask for evidence. Policies, a data-flow or architecture diagram, a summary of recent security testing, and the list of subcontractors.
4. Check the contract matches. Every promise in the answers should appear in the agreement.
5. Update your own documents. Your privacy policy and collection notices may need new overseas countries or automated decision details.
6. Review each year. Re-ask the key questions annually and whenever the vendor changes subcontractors or hosting.

If the vendor will access data from outside Australia, read our explainer on APP 8 and offshore developers before you finalise the contract.

What to do next#

We expect to be asked these questions ourselves; our trust page sets out how we approach security and access. If you are weighing up a build or a vendor for health information, our healthcare page explains how we work with care providers.