The December 2026 Privacy Act Changes: What Allied Health Practices Using AI Need to Know

The new automated decision rule sounds like it's meant for banks and government agencies. It isn't only for them, and it applies to small clinics as well as large groups.

This is general information, not legal advice. For your own practice, talk to a privacy adviser.

Why it applies to your clinic

Most small businesses with turnover of $3 million or less are exempt from the Privacy Act. Health service providers are not. If you provide a health service and hold health information, the Australian Privacy Principles apply to you, whatever your size.

What changes on 10 December

The rule comes from the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent in December 2024. Most of that Act started straight away. The automated decision-making rules were given two years' lead time.

They add three new parts to APP 1, the principle about open and transparent privacy policies. The obligation applies when all three of these are true:

• You've arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
• The decision could reasonably be expected to significantly affect a person's rights or interests.
• Personal information about that person is used to do it.

Your privacy policy must then describe the kinds of personal information those programs use, the kinds of decisions made solely by a program, and the kinds where a program does something substantially and directly related to the decision.

What counts as a computer program

More than you'd think. The OAIC's guidance covers rule-based software, machine learning, generative AI and chatbots, and even spreadsheets when they drive a decision.

A person reviewing the output doesn't automatically take a tool out of scope. If the output is a key factor in the decision, it's likely to be caught. Genuinely meaningful review can matter, though: questioning the output, documenting when you depart from it and relying on other evidence.

Where to look in an allied health practice

The OAIC's examples of significant decisions include triaging access to health and disability services, screening job applicants, personalised pricing for essential services and deciding eligibility.

In a clinic, look hardest at tools that triage, prioritise, rank, price or screen: booking flows that decide who gets an urgent appointment, waitlist ranking, tools that recommend who should be offered a service, and recruitment software that filters applicants.

Tools that draft notes for a clinician to review and finalise are less likely to be making decisions about the patient. Don't assume, though. The test is whether the program's output substantially shapes a decision that matters to the person.

What to do before 10 December

List your tools. Include anything that touches patient, client or applicant information, including features built into your practice software, booking system and recruitment process.

Ask your vendors. The OAIC expects software providers to give clients clear, high-level information about how their tools are used in decisions. The legal obligation still sits with you.

Update your privacy policy. Describe the kinds of decisions and information in plain language, group similar things and call out health information clearly. Technical detail isn't required, and genuinely commercially sensitive details don't have to be disclosed.

Make human review real. Where someone reviews an AI output, make the review genuine and record it.

Check your consent and collection notices. If you've introduced AI scribes, patients should be told and asked, as Ahpra expects.

The bigger picture

The regulator has more ways to act than it used to. Since December 2024, the OAIC has been able to issue infringement notices for some privacy policy failures without going to court.

More importantly, patients care. A clear, honest privacy policy is one of the few places a clinic can show it takes their information seriously.

---

Running several sites? See how multi-site allied health groups should roll out AI.