What's in this template?
This privacy policy template is purpose-built for Australian general practices seeking accreditation under the RACGP Standards for General Practices (5th Edition). It maps directly to Criterion C6.3 — Confidentiality and privacy of health and other information.
The template covers 18 sections addressing every aspect of privacy management in a healthcare setting:
- About This Policy — scope, applicable legislation (Privacy Act 1988, APPs, My Health Records Act, NDB scheme, Healthcare Identifiers Act), and state-specific notes for NSW, Victoria, and ACT
- What Personal Information We Collect — categories of personal and health information collected in general practice
- How We Collect Your Information — direct collection, third-party sources, unsolicited information handling (APP 3–5)
- Why We Collect Your Information — primary purpose (healthcare), directly related secondary purposes, and lawful disclosures
- How We Store and Protect Your Information — physical security, electronic security, staff obligations, and retention/destruction requirements (APP 11)
- Who We May Disclose Your Information To — treating providers, pathology, pharmacies, insurers, government authorities, IT service providers
- Cross-Border Disclosure — overseas data storage obligations under APP 8, with space to list your cloud services
- My Health Record — participation statement, patient rights, and contact information
- Direct Marketing — confirmation that clinical recalls are not direct marketing (APP 7)
- Anonymity and Pseudonymity — patient rights under APP 2 with healthcare-specific qualifications
- Government-Related Identifiers — Medicare/IHI identifier handling under APP 9
- Accessing Your Health Information — access request process, timeframes, and refusal grounds (APP 12)
- Correcting Your Information — correction request process and statement-of-correction rights (APP 13)
- Telehealth and Digital Services — privacy protections for video consultations, SMS, and patient portals
- Data Breach Management — NDB scheme obligations, breach response steps
- Complaints — internal complaint process and escalation to OAIC, with state-specific complaint bodies
- Changes to This Policy — update and notification process
- Contact Us — privacy officer details
Editable placeholder fields
The template includes yellow-highlighted {{placeholder}} fields that you replace with your practice details:
{{practice_name}}— your practice's legal name{{abn}}— Australian Business Number{{practice_address}}— physical address{{phone}}— practice phone number{{email}}— general practice email{{privacy_officer_name}}— name of your designated privacy officer{{privacy_officer_email}}— privacy officer's email address{{review_date}}— date of last policy review{{next_review_date}}— scheduled next review date
RACGP accreditation requirement
Criterion C6.3 of the RACGP Standards for General Practices (5th Edition) requires that:
"The practice protects the confidentiality and privacy of health and other information"
To meet this criterion, your practice must demonstrate:
- A written privacy policy that is available to patients, staff, and other relevant parties
- Compliance with the Privacy Act 1988 and the Australian Privacy Principles
- Staff awareness of their privacy obligations
- Processes for handling access requests and complaints
- Appropriate physical and electronic security measures
This template addresses each of these requirements with dedicated sections and practical guidance.
Legislation covered
- Privacy Act 1988 (Cth) — the primary federal privacy legislation, including the 13 Australian Privacy Principles
- My Health Records Act 2012 (Cth) — requirements for participating in the national digital health record system
- Notifiable Data Breaches scheme — Part IIIC of the Privacy Act, mandatory breach notification obligations
- Healthcare Identifiers Act 2010 (Cth) — use and disclosure of Individual Healthcare Identifiers and Healthcare Provider Identifiers
- Health Records and Information Privacy Act 2002 (NSW) — state-specific privacy obligations for NSW practices
- Health Records Act 2001 (Vic) — state-specific privacy obligations for Victorian practices
- Health Records (Privacy and Access) Act 1997 (ACT) — state-specific privacy obligations for ACT practices
How to customise this template
- Download the Word document and open it in Microsoft Word or Google Docs
- Find and replace each yellow-highlighted
{{placeholder}}with your practice's details — use Edit → Find & Replace for efficiency - Review the state-specific notes (shown in grey italics) — add the relevant state legislation paragraph if your practice is in NSW, Victoria, or the ACT. Delete notes that don't apply
- Customise Section 7 (Cross-Border Disclosure) — list any cloud services or IT providers that store data overseas (e.g., Microsoft 365, clinical software providers)
- Customise Section 14 (Telehealth) — add details about your specific telehealth platform and patient portal if applicable
- Have your privacy officer and practice principal review the completed policy before adopting it
- Make it available — display at reception, include in new patient registration packs, and publish on your practice website
- Set a review date — the RACGP recommends reviewing policies at least annually or when legislation changes
Frequently asked questions
Is this template legally compliant?
This template is based on the requirements of the Privacy Act 1988, the Australian Privacy Principles, the My Health Records Act 2012, and the RACGP Standards for General Practices (5th Edition). It is designed as a comprehensive starting point. We recommend having your completed policy reviewed by your medical defence organisation or legal adviser to ensure it meets your specific practice circumstances.
Do I need a different policy for each state?
No. The Privacy Act 1988 and the APPs apply nationally. However, practices in NSW, Victoria, and the ACT are also subject to state-specific health records legislation. This template includes notes indicating where you should add state-specific references. Practices in Queensland, South Australia, Western Australia, Tasmania, and the Northern Territory are covered by the federal legislation alone.
How often should I review my privacy policy?
The RACGP recommends reviewing all practice policies at least annually or whenever there is a significant change in legislation, practice operations, or technology. Record the review date and next review date on the policy itself.
Can I use this for AGPAL or QPA accreditation?
Yes. Both AGPAL and QPA assess against the RACGP Standards for General Practices (5th Edition). This template is aligned to Criterion C6.3 and is suitable for use as accreditation evidence with either accrediting body.
What about the new Privacy Act reforms?
The Australian Government has been progressing reforms to the Privacy Act, including the introduction of a statutory tort for serious invasions of privacy (effective from December 2025) and a Children's Online Privacy Code. This template will be updated as reforms are finalised. In the meantime, the current APPs remain the foundation of healthcare privacy compliance.
Do I need a separate data breach response plan?
Yes. While Section 15 of this privacy policy describes your NDB scheme obligations at a high level, the RACGP recommends having a separate, detailed data breach response plan that includes specific roles, escalation procedures, and notification templates. We offer a separate template for this — see our full template library.