Privacy Act 2025 Compliance

The Privacy Act 2025 introduces significant new obligations for Australian healthcare providers, most notably the right to erasure for Australian citizens. Praxi implements these requirements through structured workflows, encryption, consent tracking, and automated retention management to help your practice remain compliant.

Right to Erasure

The Privacy Act 2025 grants individuals the right to request that their personal information be erased. For healthcare practices, this right must be balanced against mandatory clinical record retention obligations.

Erasure Request Workflow

Praxi manages erasure requests through a structured workflow:

Stage	Description
Pending	Request received and awaiting review
Approved	Request reviewed and approved for processing
Partially approved	Some data approved for erasure; the rest retained (with reason)
Rejected	Request declined with a documented reason
Processing	Data erasure in progress across all relevant systems
Completed	Erasure complete, confirmation sent to the requestor
Failed	Erasure hit an error and needs attention

A partial approval is common in healthcare: non-clinical data can often be erased while clinical records stay under mandatory retention (see exceptions below).

Submitting an Erasure Request

Clients can submit an erasure request through:

1. The Client Portal -- a self-service erasure request form
2. Written request to the practice (entered by staff into Praxi)
3. Contact with Praxi support for platform-level requests

Reviewing an Erasure Request

Practice owners review erasure requests as they arrive (each request raises a notification):

1. Open the pending erasure request
2. Review the scope of data the client has requested to be erased
3. Check for erasure exceptions (see below)
4. Approve or reject the request with a documented reason
5. If approved, Praxi begins the automated erasure process

Erasure Exceptions

Certain records are exempt from erasure during mandatory retention periods. Praxi automatically identifies and tracks these exceptions.

Exception type	Legal basis	Retention period
Clinical records	State health records legislation	7 years from last contact (adults)
Minor records	State health records legislation	Until age 25, or 7 years (whichever is later)
Medicare claims	Health Insurance Act 1973	2 years from claim date
Financial records	Tax legislation	7 years

Each exception is tracked per entity with a specific legal basis citation. When a record is exempt from erasure, the client is informed of the reason and the date the exemption expires.

warning

Do not manually delete clinical records to fulfil an erasure request. Always use the erasure request workflow, which correctly identifies exemptions and ensures compliance with both the Privacy Act 2025 and clinical record retention obligations. :::

What Gets Erased

When an erasure request is processed and no exceptions apply, the following data is removed:

• Personal contact details (address, phone, email)
• Non-clinical notes and administrative records
• Marketing and communication preferences
• Portal account credentials
• Any data not subject to a retention exemption

What Is Retained

Records subject to retention exemptions are retained but may be anonymised where possible:

• Clinical notes and treatment records (7-year minimum)
• Medicare and DVA claim records
• Audit log entries (immutable, 7-year retention)
• Financial records and invoices

Document Encryption

All clinical documents stored in Praxi are encrypted at rest using AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode).

Component	Detail
Algorithm	AES-256-GCM
Initialisation vector	Unique IV per document
Authentication tag	GCM authentication tag for tamper detection
Key management	Keys managed via secure key management infrastructure
In-transit	TLS 1.3 for all data transmission

This encryption ensures that even in the event of unauthorised access to storage, document contents remain unreadable without the correct decryption keys.

Client Consent Management

The Privacy Act 2025 reinforces the requirement for informed consent when sharing client information. Praxi tracks consent at the individual client level.

What Praxi Records

Detail	Purpose
Consent status	Whether the client has consented to information sharing
Consent recorded date	When the consent was recorded

Consent Workflow

1. During client intake, present the consent form explaining what information may be shared and with whom
2. The client provides consent (digitally or on paper, recorded in Praxi)
3. Consent status is tracked in the client record
4. Document sharing features check consent status before allowing transmission
5. Consent can be withdrawn at any time by the client

info

Document sharing via healthcare messaging networks (Medical-Objects, HealthLink, Argus) requires documented client consent. Praxi will prevent sending clinical correspondence if consent has not been recorded for that client. :::

Minor Consent

Consent rules for minors follow the Family Law Act 1975:

Age group	Consent requirement
0-13	Guardian consent only
14-17	Both client and guardian consent
18+	Client consent only

Data Retention

Praxi automatically manages data retention in accordance with Australian healthcare requirements.

Retention Periods

Record type	Minimum retention
Adult clinical	7 years from date of last contact
Minor clinical	Until age 25, or 7 years (whichever is later)
Medicare claims	2 years from claim date
Financial records	7 years
Audit logs	7 years (immutable)

Automated Retention Management

• Records approaching their retention expiry are flagged in the compliance dashboard
• No clinical records are automatically deleted -- practice owners review and approve disposal
• Retention schedules are applied automatically based on record type and client age
• Disposal actions are logged in the audit trail

Third-Party Disclosure Register (APP 6)

The Privacy Act 1988 (APP 6) requires that disclosures of personal information to third parties are tracked and justified. Praxi includes a built-in disclosure register that records every instance of information sharing.

Recording a Disclosure

When you share client information with a third party:

1. Go to the client's record and open the Disclosure Register tab, or access the register from Legal & Records
2. Click Record Disclosure
3. Enter:
   • Recipient -- name, type (referrer, insurer, employer, legal, government, research, health service, or other), and contact details
   • Data disclosed -- select the types of information shared (personal details, clinical notes, assessment results, treatment plans, invoices, referral information, appointments, Medicare information, or contact details)
   • Legal basis -- select the APP 6 exception that authorises the disclosure (consent, related purpose, serious threat, law enforcement, legal proceedings, health service, or research)
   • Consent reference -- link to the client's consent record if disclosure is based on consent
   • Purpose -- a brief description of why the information was shared
   • Method -- how the information was transmitted (email, post, fax, phone, electronic transfer, or in person)
4. Save the disclosure

Client Notification

After recording a disclosure, you should notify the client:

1. Open the disclosure record
2. Click Mark Client Notified
3. Praxi records when the client was notified

Disclosures where the client has not yet been notified appear under Pending Notifications for follow-up.

Disclosure Statistics

Generate compliance reports on disclosure activity:

• Total disclosures by recipient type, legal basis, and method
• Client notification rate
• Unique clients affected
• Disclosure trends over a date range

Compliance Report

For audit purposes, generate a formal disclosure compliance report covering a specific date range. The report includes aggregate statistics and a list of recent disclosures with full details.

Data Residency and Cross-Border Disclosure (APP 8)

APP 8 requires that before disclosing personal information to an overseas recipient, you must take reasonable steps to ensure the recipient complies with the APPs, or obtain the individual's informed consent.

Praxi enforces data residency through a policy-based system.

Data Residency Policy

Each organisation has a data residency policy that controls:

Setting	Default	Description
Data residency enabled	Yes	Enforce geographic storage restrictions
Allowed countries	Australia only	Countries where data may be stored or transferred
Primary storage region	ap-southeast-2	AWS region for primary data storage (Sydney)
Cross-border transfers	Disabled	Whether cross-border transfers are permitted at all
Explicit consent required	Yes	Whether client consent is required for each transfer

Cross-Border Transfer Requests

If cross-border transfers are enabled, each transfer must go through a request and approval workflow:

1. Create a transfer request with the destination country, recipient, purpose, data types, and number of affected individuals
2. Praxi automatically assesses the risk level (low, medium, high, or critical) based on the destination country's privacy protections, data sensitivity, transfer scale, and contractual protections
3. A practice owner reviews and approves the transfer
4. If consent is required and not yet obtained, the transfer cannot be approved
5. Approved transfers are tracked with full audit detail

Adequate Protection Countries

Praxi maintains a list of countries recognised as having adequate privacy protection, including Australia, New Zealand, EU/EEA countries (GDPR), the United Kingdom, Canada, Japan, South Korea, and Singapore. Transfers to countries not on this list carry higher risk assessments.

Where Everything Lives

Task	Where
Your own privacy data, consents, data export, deletion request	Settings > Privacy
Client disclosure register	The client record, or Legal & Records
Compliance-related audit log entries	Monitoring > Audit Trail
Data breach management	Settings > Compliance > Data Breaches

Audit Trail

All privacy-related actions are recorded in the immutable audit trail:

• Erasure requests (submitted, approved, rejected, completed)
• Consent changes (granted, withdrawn)
• Document access and sharing events
• Data export events
• Retention policy changes

Audit records are retained for a minimum of 7 years and cannot be modified or deleted.

Best Practices

1. Review erasure requests promptly -- respond within the timeframes specified by the Privacy Act 2025
2. Document exceptions clearly -- when records cannot be erased, ensure the legal basis is recorded
3. Keep consent current -- review and refresh client consent regularly, particularly for ongoing clients
4. Train your team -- ensure all staff understand the right to erasure and consent obligations
5. Monitor the compliance dashboard -- check weekly for pending requests and expiring retention periods
6. Use the workflow -- never manually delete records; always use the erasure request workflow for compliance and auditability

Related

• Compliance Overview
• Data Retention
• Audit Logs
• AHPRA Compliance

Was this page helpful?