Health sector faces new privacy obligations

Healthcare organisations must update their privacy policies by 10 December if they use artificial intelligence (AI) or a computer program to make decisions that could significantly affect an individual’s rights or interests using personal information.

The requirement, under the Privacy and Other Legislation Amendment Act 2024, will apply to certain uses of automated decision-making, including AI-assisted diagnosis or treatment and decisions relating to life insurance policies, among other uses. The Office of the Australian Information Commissioner (OAIC) has released an Issues Paper on the Automated Decision-Making Transparency Obligation.

The change comes as the Federal Government considers further reforms to Australia’s privacy laws. An exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 was released on 31 August 2026, with consultation closing on 18 September 2026.

For the health sector, three proposed changes stand out.

The definition of ‘personal information’ would be broadened to cover information that ‘relates to’ an individual who is identified or reasonably identifiable. The reforms would also expressly classify ‘genomic information that relates to an individual’ as sensitive information.

Consent requirements would also become more stringent. Consent would need to be voluntary, informed, current, specific, and unambiguous, making broad or ‘bundled’ consents and opt-out approaches more difficult to rely on. Pre-ticked boxes would not satisfy the new requirements, although implied consent could remain available in some circumstances.

For health and medical research, the existing exceptions would be replaced with a single research exception covering organisations. Ethically reviewed, approved and monitored human research could proceed without consent satisfying the ‘current’ or ‘specific’ requirements, provided the proposed safeguards are met.

The exception would apply to ‘human research’, defined as research conducted with or about individuals that involves personal information. Researchers would need to comply with the National Statement on Ethical Conduct in Human Research and future human research guidelines issued by the Privacy Commissioner. The proposed framework is intended to balance privacy protections with the public interest in socially beneficial research, while giving the Privacy Commissioner power to impose additional safeguards for research presenting heightened privacy risks.

For health and life sciences organisations, the immediate focus is the 10 December 2026 automated decision-making deadline. Organisations should be taking practical steps to identify decisions that affect clients and employees, review and update privacy policies, assess responsibility for third-party systems, and strengthen internal governance.

In reimagining healthcare across the entire patient journey, Health Industry Hub^TM is the only one-stop-hub uniting the diversity of the Pharma, MedTech, Diagnostics & Biotech sectors to inspire meaningful change.

The Health Industry Hub^TM content is copyright protected. Access is available under individual user licenses. Please click here to subscribe and visit T&Cs here.