The Exemption You Do Not Have
Australian privacy law contains a small business exemption. Broadly, organisations with an annual turnover at or below $3 million are not bound by the Australian Privacy Principles. It is the reason a great deal of small business guidance treats privacy compliance as something to worry about later, at a larger size.
Clinics do not get it. Organisations that provide a health service and hold health information, other than in an employee record, are covered by the Privacy Act whatever their annual turnover.
So a sole-practitioner podiatrist, a two-chair dental surgery, a small psychology practice and a large hospital operator are bound by the same principles. There is no threshold to fall under and no size at which the obligation begins.
And you are in the strictest part of the Act
The Privacy Act treats health information as sensitive information and applies additional protections to how it is collected, used, disclosed and secured. So a clinic is not simply inside the regime with everyone else — it is inside the tier that carries the most obligations. The sentence “we’re only a small practice” has never had any work to do here.
There is a small mercy in this, which is worth naming. A lot of ink has been spilled in the last two years over whether the small business exemption is being removed from the Privacy Act generally, and the position is genuinely unsettled. You do not need to follow that debate. However it resolves, it does not change your obligations, because you were never relying on the exemption in the first place. That is one uncertainty a clinic can simply ignore.
Six Places Your Phone System Holds Health Information
Practices tend to think of health information as living in the clinical software. It also lives in the phone system, and that half is usually unmapped. Here is the audit, and it takes about twenty minutes to complete for your own practice.
| # | Where it lives | The questions to answer |
|---|---|---|
| 1 | Voicemail — a patient describing a symptom, chasing a result, asking about medication | Who can listen? Is it forwarded to an email inbox, and whose? How long is it kept, and who actually deletes it? Most practices have never set a retention period at all |
| 2 | Call recordings, if you record | Stored where, in which country, for how long, retrievable by whom? Consent is separate and covered below |
| 3 | AI transcripts and call summaries | A transcript of a clinical conversation is health information from the moment it exists. Which service processes the audio, and where does that processing happen? |
| 4 | Two-way SMS threads with patients | A reply saying why they need to reschedule is health information. Does that thread reach the patient's file, or does it sit in a messaging tool nobody governs? |
| 5 | Call notes written during or after a call | These belong in the clinical record. The risk is the parallel systems — the shared spreadsheet, the notebook by the phone, the sticky note |
| 6 | Staff mobiles taking practice calls | The most common weak point in Australian clinics, and the subject of its own section below |
Two questions are worth putting to any phone provider in writing before you sign, and both are entirely reasonable for a healthcare customer to ask.
"Where is this data stored?"
For a clinic, “in our global cloud” is not an answer. You need to know the jurisdiction, because that determines who can compel access to it. See why we own the network.
"Who can access it?"
Including the provider's own staff. “Our support team as required” is a real answer to a real question and you are entitled to know what controls sit around it.
"How long is it kept?"
Default retention is often indefinite because nobody chose otherwise. Indefinite retention of clinical voicemail is a decision, and you should make it deliberately rather than by omission.
"How do we delete something?"
If a patient asks you to remove a recording, can you? Find out before someone asks, not during the conversation where you have to answer them.
The Recording Sentence That Works Everywhere
Call recording is genuinely useful in a clinic — for training, for resolving disagreements about what was said, and as evidence if a complaint arises. The complication is that there is no single national rule.
Recording a private conversation is governed mainly by state and territory surveillance devices legislation, and the approaches split.
| Approach | Jurisdictions | Principal legislation |
|---|---|---|
| All-party consent | NSW, ACT, SA, WA | Surveillance Devices Act 2007 (NSW); Listening Devices Act 1992 (ACT); Surveillance Devices Act 2016 (SA); Surveillance Devices Act 1998 (WA) |
| Participant recording generally not caught by the state offence | VIC, QLD, TAS, NT | Surveillance Devices Act 1999 (Vic); Invasion of Privacy Act 1971 (Qld); Listening Devices Act 1991 (Tas); Surveillance Devices Act 2007 (NT) |
Two qualifications that matter. Even where a participant may lawfully record, using or disclosing that recording is separately restricted — lawful to make is not the same as free to share. And the federal Telecommunications (Interception and Access) Act 1979 sits above all of it, while your privacy obligations apply to the recording as health information wherever you are. This is orientation, not legal advice.
The practical answer: one sentence, used everywhere
Do not attempt to run different rules for different states. Announce it on every call, in every location: tell the caller at the start that the call may be recorded, say briefly why, and offer a real alternative if they would rather not be recorded. That satisfies an all-party jurisdiction, is comfortably more than required in the others, and is also the approach best aligned with the transparency the APPs expect of you. The cost is one sentence. The alternative is maintaining a compliance matrix.
The same logic applies to AI. If you use transcription or automatic summaries on clinical calls, the transcript is health information the instant it is generated, and where the audio is processed is a question you should be able to answer. AI call transcription and notes covers how it works; the clinic-specific requirement is knowing the processing location and telling patients you do it.
The Weakest Point Is a Personal Phone
Every clinic has some version of this. A practitioner takes calls on their own mobile because it is easier. A receptionist texts a patient from her phone because the system does not do SMS. A principal returns a results call from the car.
Each of those is convenient and each creates health information on a device the practice does not control, does not back up, cannot audit and cannot wipe.
What actually goes wrong
The staff member leaves, and a year of patient conversations leaves with them. The phone is lost, and it was unlocked. A patient rings the personal number back at 10pm, because now they have it. There is no record of the call in the clinical file, so when a complaint arrives eighteen months later the practice cannot show what was said or that contact was even attempted. None of these are exotic scenarios — they are the ordinary consequence of an arrangement nobody decided on.
The fix is not a policy telling staff to stop, which fails because the underlying need is real. It is giving them a way to do the same thing inside the practice’s system.
- Put the practice number on their device, not their number. A softphone app means calls made from a personal phone present the practice number and are logged by the practice system. The patient never sees a personal number, so they cannot call it back at 10pm.
- Give reception practice SMS. Staff text patients from their own phones because there is no alternative. Provide two-way SMS from the practice number and the behaviour stops on its own.
- Make the call reach the file. If the call is logged against the patient record automatically, the documentation problem solves itself rather than depending on someone remembering.
- Then write the short policy. One paragraph: practice calls and patient messages go through practice systems. It works now, because you have removed the reason to break it.
Access Is an Obligation Too
Privacy is the half of this that practices worry about. Access is the half that gets assessed at accreditation, and it is equally a phone-system question.
General practices assessed against the RACGP Standards for general practices (5th edition) face criteria that speak directly to telephone arrangements.
| Criterion | The expectation | The usual gap |
|---|---|---|
| C1.2 Communications | Patients receive open, timely and appropriate communication about their care, with documented arrangements for what the team can and cannot advise by phone or electronically | The practice has a shared understanding but nothing written. The criterion is about documentation, and writing it takes an hour |
| C1.4 Interpreter and other communication services | Patients needing an interpreter or other communication support can get it | Access exists on paper but only one staff member knows how to use it. If she is on leave, the practice does not have interpreter access that day. Test it and pin the instruction at the desk |
| GP1.3 After-hours care | “Our patients can access after-hours care” | Covered in the next section. This is the one most often quietly non-compliant |
Worth noting for allied health and dental readers: you are not assessed against the RACGP Standards, and your own accreditation framework will differ. But the substance of C1.2 — having written down what your front desk may and may not say — is good practice in any clinical setting, and it is the best induction document a new receptionist will ever be handed.
Why a Voicemail Box Is Not After-Hours Care
Criterion GP1.3 says “our patients can access after-hours care”, and an interim amendment sharpened what that means in a way that lands squarely on your closed-hours recording.
Where a practice cannot provide after-hours care itself and cannot secure a formal arrangement with an after-hours provider, it must inform patients how to access synchronous care delivered by clinicians who meet Australian health professional obligations while the practice is closed.
“Synchronous” is the whole point. A voicemail box that will be checked in the morning is asynchronous, and so is an email address. Neither one tells a patient at 9pm how to see a clinician.
The distinction most after-hours messages miss
So what should the closed-hours recording contain, and in what order?
- The emergency instruction, first. If this is an emergency, hang up and call triple zero. Before opening hours, before anything else. A caller in trouble should not have to listen through thirty seconds of Monday-to-Friday times.
- The after-hours pathway, named clearly. Whatever real-time service your patients should use, said slowly enough to be written down, with the number repeated.
- When you reopen. Then, and only then, opening hours.
- How to do non-urgent things without you. Online booking, if you have it. This deflects a substantial share of after-hours voicemail.
Two failures worth checking today
The stale message. Almost every practice has an after-hours greeting. A great many name an arrangement that changed, or a number that no longer answers. Put a six-monthly calendar reminder on re-recording and re-verifying it — it is the cheapest risk reduction available to you. Public holidays. Practices get weeknights right and then play the ordinary weekday greeting on Anzac Day. Configure holidays once as a calendar rather than relying on someone remembering the night before.
Then do the thing nobody does: ring your own practice from a mobile at 7:30pm and again on a Sunday. Listen the way a worried patient would. Practices are regularly surprised by what their own message actually says.
Designing for the Morning Peak
Now the operational half. Clinic call volume is not spread across the day — it is concentrated in the first twenty minutes after opening, because patients wake up unwell, wait for you to open rather than calling at 7am, and know that same-day appointments are finite.
The consequence that matters is not the length of the queue. It is who leaves it. A patient booking a routine review six weeks out will wait on hold indefinitely. A patient who is unwell, or frail, or ringing from work with three minutes, hangs up. The morning wall filters out the callers you most need to reach.
20 min
Where most of a clinic’s daily call pressure lands
4
Distinct call types arriving in one undifferentiated queue
1
Group that must always reach a human: urgent or uncertain callers
6 mth
How often to re-verify the after-hours greeting
Four call types arrive in that one queue, and separating them is the highest-leverage change available.
Bookings and cancellations
The biggest group and the one least needing a human. Online booking plus a phone path that can take a straightforward booking or cancellation removes most of the wall. Easy cancellation is revenue, because it is a slot you can refill.
Results and script requests
Substantial and genuinely time-insensitive. A defined return-call window moves these out of the peak entirely, and patients accept it when the reason is explained.
Clinical third parties
Pathology, imaging, specialist rooms, insurers. These should never queue behind patients. A separate path means a registrar returning a result does not wait eight minutes.
Urgent or uncertain
Small in number, largest in consequence, and the reason for all of the above. Every other decision exists to keep this group in front of a person quickly.
Measure first
Get call volume and abandonment by half-hour for two weeks before changing anything. Most practices have never seen this, because legacy systems cannot report it — and the data ends internal arguments about rostering.
Keep the menu short
Two or three options in plain language, with an obvious route to a person. Elderly and distressed callers do not navigate deep menus, and they are precisely the callers you cannot afford to lose.
If you also connect the phone system to your practice software, the desk gets faster still: the patient record opening as the phone rings, return calls dialled from the file rather than keyed in, and the call logged against the record automatically. Australian practices run a well-defined set of systems, so the fair question to a provider is “show me this working with the software we actually use” rather than accepting a logo. Where no native connector exists, an open API generally does — see integrations and open APIs and the Australian SaaS directory.
Reminders, No-Shows and What Not to Put in a Text
A patient who does not arrive is a committed slot that cannot be resold. Reminders are the standard remedy and nearly every practice sends them, so the remaining value is in four details.
| Detail | Do this | Because |
|---|---|---|
| Make it two-way | Let patients cancel or confirm by replying | A one-way reminder informs. A repliable one converts a no-show into a slot you can refill. This is the change with the largest return |
| Have somewhere for the slot to go | Keep a short-notice list of patients wanting an earlier appointment | A cancellation only becomes revenue if someone fills it. Without the list, you have simply been told about the gap earlier |
| Use an identifiable sender | Send from a registered, recognisable business sender identity | Health messages from an unknown number get ignored or reported as scams. Sender identity now sits inside a regulated system — see the SMS Sender ID Register |
| Keep clinical detail out | Time, place, practice name. Nothing about why | Someone else may read the message. The discipline of the appointment type or the specialist's field is not information you should put on a lock screen |
| Time it for cancellation | Usually the previous day | A reminder two hours out cannot be refilled. Far enough ahead to be useful, close enough to be remembered |
| Log the thread | Get the SMS conversation into the patient's file | A reply explaining why they cannot attend is health information. It belongs in the record, not in a messaging app nobody governs |
The mechanics are in business SMS from your phone system.
The Line Automation Must Not Cross
Any article recommending automation inside a clinic owes the reader an unambiguous boundary, so here it is with no qualifications attached.
Never
Triage. Nothing automated assesses how sick a patient is or how urgently they need to be seen. That is clinical judgement, made by a clinician. Clinical advice. Nothing automated answers a question about symptoms, medication or the meaning of a result. Emergencies. Any indication of an emergency reaches a human or the emergency instruction immediately, with no menu in the way. Distress. An upset caller gets a person, and the route to one must be obvious and short.
Inside that boundary the ground is wide and entirely administrative: routine booking, rescheduling and cancellation, opening hours, location and parking, billing enquiries, the after-hours pathway, and routing to the right part of the practice. High volume, low judgement, and currently occupying your front desk during the precise window when an unwell patient is trying to get through.
Which is the argument that persuades a cautious principal, and it is not a cost argument: automating the routine is how you free a human to answer the person who needs one. Which calls to automate works through the general boundary, and AI versus human receptionist is honest about where the human wins.
A Staged Plan That Fits a Running Practice
Nobody can pause a clinic for a technology project. This order front-loads the cheap, high-risk items and defers everything that needs a vendor.
This week — costs nothing
Ring your own after-hours message from a mobile and listen as a patient would. Check whether the pathway it names still exists. Re-record it with the emergency instruction first. Then complete the six-place health information audit and write down, for each, who can access it and how long it is kept.
This month — an hour each
Write the C1.2 policy: what your team can and cannot advise by phone. Test the interpreter pathway with someone other than the person who normally does it, and pin the instructions at the desk. Set the recording announcement as standard on every call in every location. Configure public holidays as a calendar. Start measuring call volume and abandonment by half-hour.
This quarter — needs a provider
Split patient, clinical third-party and callback traffic into separate paths. Get staff off personal mobiles by putting the practice number on their devices via an app. Connect the practice software for screen pop and automatic call logging. Make reminders two-way and build the short-notice fill list. Confirm data location, access and retention in writing.
Notice what is in the first column. The two most likely non-compliances in an Australian clinic today — a stale after-hours message and an unmapped set of health information stores — both cost nothing to fix and need no vendor, no budget approval and no project. They need an afternoon.
And the principle underneath all of it, which is what makes automation defensible in a clinical setting at all: a clinic’s phone system exists so that the person who most needs to be heard is the one who gets answered. Any change that fails that test should not be made, whatever it saves.
Frequently Asked Questions
Is a small clinic really covered by the Privacy Act?
Yes, and there is no size at which the obligation begins. Australian privacy law contains a small business exemption that generally releases organisations with an annual turnover at or below $3 million from the Australian Privacy Principles, which is why so much small business guidance treats privacy as a problem for later. Clinics do not get it. Organisations that provide a health service and hold health information, other than in an employee record, are covered regardless of annual turnover. A sole-practitioner podiatrist, a two-chair dental surgery, a small psychology practice and a large hospital operator are bound by the same principles. Health information is also treated as sensitive information and attracts additional protections, so a clinic sits in the strictest tier of the Act rather than merely inside it. One useful side effect: there has been ongoing debate about whether the small business exemption is being removed from the Privacy Act generally, and clinics can simply ignore that debate, because however it resolves it does not change obligations you were never relying on the exemption for.
Where does a phone system actually hold health information?
In six places, and most practices have mapped none of them. Voicemail, where patients describe symptoms, chase results and ask about medication. Call recordings, if you record. AI transcripts and call summaries, which are health information from the moment they are generated. Two-way SMS threads, because a reply explaining why a patient needs to reschedule is health information. Call notes, where the risk is the parallel systems such as a shared spreadsheet or a notebook by the phone rather than the clinical record. And staff mobiles taking practice calls, which is the most common weak point in Australian clinics. For each one you should be able to answer four questions: where is it stored and in which country, who can access it including the provider's own staff, how long is it retained, and how would you delete a specific item if a patient asked. Default retention is frequently indefinite simply because nobody chose otherwise, and indefinite retention of clinical voicemail is a decision worth making deliberately.
Can we record patient calls, and does the answer change between states?
It does change, which is exactly why a single national policy is safer than following eight. Recording a private conversation is governed principally by state and territory surveillance devices legislation. New South Wales, the ACT, South Australia and Western Australia take an all-party consent approach under their respective Surveillance Devices and Listening Devices Acts. Victoria, Queensland, Tasmania and the Northern Territory generally do not catch a participant recording their own conversation under the state offence. Two qualifications matter: even where making a recording is lawful, using or disclosing it is separately restricted, and the federal Telecommunications (Interception and Access) Act 1979 applies over the top while your privacy obligations attach to the recording as health information wherever you are. The workable answer is to announce on every call in every location that it may be recorded, say briefly why, and offer a genuine alternative for a caller who declines. That satisfies an all-party jurisdiction, is more than sufficient elsewhere, and matches the transparency the APPs expect. This is orientation rather than legal advice.
Our practitioners use their own mobiles for patient calls. What is the actual risk?
That health information is being created on devices the practice does not control, cannot back up, cannot audit and cannot wipe. The failure modes are ordinary rather than exotic. A staff member leaves and a year of patient conversations leaves with them. A phone is lost and it was unlocked. A patient rings the personal number back at 10pm because they now have it. And there is no record of the call in the clinical file, so when a complaint arrives eighteen months later the practice cannot demonstrate what was said or even that contact was attempted. A policy telling staff to stop does not work, because the underlying need is real. The fix is to make the compliant path the easy one: put the practice number on their device through a softphone app so calls present the practice number and are logged by the practice system, give reception two-way SMS from the practice number so nobody texts patients personally, and ensure calls log against the patient record automatically. Then write the one-paragraph policy, which will hold because you have removed the reason to break it.
What does the after-hours criterion require our closed-hours message to say?
Criterion GP1.3 of the RACGP Standards fifth edition states that our patients can access after-hours care, and an interim amendment sharpened the expectation. Where a practice cannot provide after-hours care itself and cannot secure a formal arrangement with an after-hours provider, it must inform patients how to access synchronous care delivered by clinicians who meet Australian health professional obligations while the practice is closed. Synchronous is the operative word: a voicemail box that will be checked in the morning is asynchronous and so is an email address, and neither tells a patient at 9pm how to see a clinician. Order the message accordingly: the emergency instruction to call triple zero first, then the after-hours pathway named clearly and slowly with the number repeated, then your reopening hours, then how to do non-urgent things such as online booking. The two failures worth checking today are a stale message naming an arrangement that has changed or a number that no longer answers, and public holidays playing the ordinary weekday greeting. Set a six-monthly reminder to re-record and re-verify, and ring your own practice from a mobile at 7:30pm and on a Sunday to hear what patients hear.
How do we stop losing the patients who most need us in the morning rush?
By recognising that the problem is not queue length but who leaves the queue. Clinic calls concentrate in the first twenty minutes after opening because patients wake up unwell, wait for you to open rather than calling at 7am, and know same-day appointments are finite. Someone booking a routine review six weeks out will hold indefinitely, while a patient who is unwell, frail, or calling from work with three minutes hangs up, so the morning wall systematically filters out the callers you most need to reach. The remedy is to separate the four call types arriving in one undifferentiated queue. Bookings and cancellations are the largest group and need a human least, so online booking and a phone path handling straightforward bookings and cancellations removes most of the wall. Results and script requests are genuinely time-insensitive and belong in a defined return-call window. Clinical third parties such as pathology, imaging and specialist rooms should never queue behind patients. That leaves urgent or uncertain callers, who are few in number and largest in consequence, reaching a person quickly. Measure volume and abandonment by half-hour for a fortnight before changing anything, and keep any phone menu to two or three plain-language options with an obvious route to a person.
Should a clinic use AI on its phones at all?
For administration yes, for anything clinical never, and the boundary deserves stating without qualification. Nothing automated should perform triage, meaning assessing how sick a patient is or how urgently they need to be seen, because that is clinical judgement belonging to a clinician. Nothing automated should answer a question about symptoms, medication or what a result means. Any indication of an emergency must reach a human or the emergency instruction immediately with no menu in the way. And a caller in distress needs a person, with a short and obvious route to one. Inside that boundary the useful ground is wide and entirely administrative: routine booking, rescheduling and cancellation, opening hours, location and parking, billing enquiries, the after-hours pathway, and routing to the right part of the practice. These are high-volume, low-judgement calls that currently occupy the front desk during exactly the window when an unwell patient is trying to get through. That is the argument that persuades a cautious principal, and it is not about cost: automating the routine is how you free a human to answer the person who needs one.
