Healthcare Compliance in Australia

The Australian market is open to online healthcare. There is no separate telehealth licence: the practitioner needs registration with the relevant National Board through the Australian Health Practitioner Regulation Agency (Ahpra), and the service must meet the Medical Board's telehealth guidelines, Medicare billing rules and the Privacy Act.

The principal authorities are the Department of Health, Disability and Ageing, Services Australia (which runs Medicare and the Healthcare Identifiers Service), the Medical Board of Australia with Ahpra, the Australian Digital Health Agency, the Therapeutic Goods Administration and the Office of the Australian Information Commissioner.

The biggest obstacle for a new entrant is not identity proofing itself but the national digital health plumbing: healthcare identifiers, conformant e-prescribing software and My Health Record connections are each gated by their own registration and conformance steps.

1. Who regulates this sector

Commonwealth law governs Medicare, the Pharmaceutical Benefits Scheme (PBS), healthcare identifiers, My Health Record, therapeutic goods and privacy; practitioner registration runs under the Health Practitioner Regulation National Law in each state and territory.

State and territory law governs prescribing (including real-time prescription monitoring) and health records retention (section 7); the Medical Board expects compliance in both the prescriber's and the patient's jurisdiction.

2. Licensing and authorisation

There is no telehealth operator licence. Authorisation attaches to the people and the software:

• Practitioner registration. The Medical Board's Guidelines: Telehealth consultations with patients (effective 1 September 2023) expect any doctor consulting patients who are in Australia to be registered with the Board, with professional indemnity insurance covering those patients, whatever the doctor's own location.
• Healthcare identifiers. Under the Healthcare Identifiers Act 2010 (Compilation No. 22, 19 September 2026), the service operator (the Chief Executive Medicare, s 6) assigns identifiers to individual providers (HPI-I), provider organisations (HPI-O) and patients (IHI) (s 9). An organisation may not ask the service operator to disclose identifiers until its responsible officer and organisation maintenance officer have passed an evidence of identity process (Healthcare Identifiers Regulations 2020 s 11, Compilation No. 4, 5 May 2026).
• Prescribing software. Electronic prescriptions require conformant software (section 7).
• My Health Record. Organisations and app operators connect only after registration with the System Operator, which is the Australian Digital Health Agency (My Health Records Regulations 2026 s 10, from 1 April 2026): healthcare provider organisations under s 44 and portal operators (an "electronic interface that facilitates access" to the system) under s 49 of the My Health Records Act 2012 (Compilation No. 18, 1 July 2026). Since 1 July 2026, proprietors of pathology laboratories and diagnostic imaging premises that are corporations are prescribed organisations that must register (s 41A; My Health Record (Share by Default) Rules 2025).
• Medical device approval for some apps. Software meeting the medical device definition in s 41BD of the Therapeutic Goods Act 1989 needs inclusion in the Australian Register of Therapeutic Goods unless one of 15 excluded software categories applies (section 7).

3. Identity framework (AML rules do not apply)

Healthcare providers are not reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Compilation No. 63, 1 October 2026). None of the six tables of designated services in s 6 covers providing healthcare, so a health business has no customer due diligence or suspicious matter reporting duty unless it separately provides a designated service, such as a payment product.

Identity obligations come instead from four health-specific sources:

Professional standards

The Medical Board expects doctors to confirm, "to the best of your ability", the identity of the patient and anyone else present at each telehealth consultation; Ahpra's virtual care guidance asks practitioners in every registered profession to confirm the patient's identity at the start of each telehealth consultation.

Healthcare identifiers

The Act sets "strict rules" on verifying identity before an identifier is assigned (s 3A). A patient's identifying information includes whether their identity was verified, the identity document or verification-service response used, and whether the IHI is only provisional (Healthcare Identifiers Regulations 2020 s 8(3)).

My Health Record

The System Operator may register a patient only if satisfied that the patient's identity "has been appropriately verified" (s 41(1)), and may cancel registration if it is no longer satisfied (s 51(2)(b)).

Prescriptions and medicines

Registration for the Active Script List (ASL), the national list of a patient's electronic prescriptions, requires documented proof of identity under the Department's privacy framework.

4. Identity verification and onboarding

Patients

For a telehealth consultation, the Medical Board's standard sets an outcome (confirming identity to the best of the doctor's ability) rather than a method. Document checks, face matching and liveness detection are design choices that evidence it. The national systems set more specific rules:

• Individual Healthcare Identifier. Anyone with a Medicare or Department of Veterans' Affairs (DVA) card already has an IHI. Others can apply through myGov using details from a passport with a valid Australian visa or an Australian driver licence, or by paper form with other identity documents; Services Australia requires applicants to be in Australia so it can verify their identity.
• Active Script List registration. Through a pharmacist or prescriber, photo ID plus a Medicare or DVA card is sufficient; otherwise a 100-point check applies. Patients regularly taking or prescribed Schedule 8 medicines (controlled drugs) generally need a 100-point check. App self-registration [Adopted, start date not yet set] is covered in section 5.
• Government document checks. Private organisations can check identity documents against the issuing agency through the Document Verification Service (DVS) via an approved gateway service provider. Participation agreements must require a privacy impact assessment and the individual's express consent (Identity Verification Services Act 2023 s 9(2)), and the Attorney-General's Department advises that the DVS should not be the sole basis for a decision.

Practitioners

Platforms should confirm each clinician on the Ahpra register and record the HPI-I and HPI-O that will appear on prescriptions. Each request for an identifier must, where reasonably practicable, name the individual making it; otherwise the organisation must keep a retrievable record of who did (Healthcare Identifiers Regulations s 12). Clinicians' Provider Digital Access (PRODA) accounts are verified against three Australian Government identity documents.

5. Digital channels: what's different

Bottom line: online care is lawful and needs no separate licence, but a telehealth consultation carries three duties an in-person visit does not: confirm identity at every consultation, prescribe only after real-time contact, and meet Medicare's eligibility and location tests before billing.

Real-time contact before prescribing

The Medical Board states that prescribing without a real-time direct consultation, in person, by video or by telephone, "is not good practice and is not supported by the Board". This includes asynchronous requests by text, email, live chat or online questionnaire where the doctor has never spoken with the patient. Ahpra's guidance for all professions (reviewed 29 October 2026) adds that the Boards "do not consider an online chat to be a synchronous (in real time) consultation". A prescriber must be able to justify any such prescribing.

Medicare eligibility and location

Most MBS telehealth services by non-specialist doctors and nurse practitioners are payable only if performed by the patient's "eligible telehealth practitioner": one who, or whose practice, provided an in-person service to the patient in the past 12 months, or the patient's MyMedicare practice (Health Insurance (Section 3C General Medical Services – Telehealth Attendances) Determination 2021 s 7(5) to (7)). Earlier video or phone consultations do not count. Exemptions (for example, children under 12 months or people experiencing homelessness) must be documented in the clinical notes with the clinical justification (s 7(6C)). The Department's guidance states that telehealth items are not available when the patient or the provider is overseas.

Remote registration for prescriptions

The Healthcare Identifiers Regulations now authorise patients to self-register for the Active Script List through a mobile prescription app connected via a mobile intermediary (s 9A). The Department states it is "not available yet as identity verification is still being finalised" (page updated 9 July 2026), so registration still runs through a pharmacist or prescriber.

6. Data protection and biometrics

The Privacy Act 1988 (Compilation No. 104, 4 June 2026) applies to every provider of a health service that holds health information, whatever its turnover: the small business exemption does not apply to them (s 6D(4)(b)). Health information is sensitive information, and so is "biometric information that is to be used for the purpose of automated biometric verification or biometric identification" and any biometric template (s 6).

The distinction matters for onboarding. Health information needed for a health service may be collected without consent where the conditions in s 16B(1) are met. A selfie and face template captured to verify identity are not health information; they are biometric sensitive information and may be collected only with consent and where reasonably necessary, unless an exception in APP 3.4 applies (APP 3.3). The OAIC's guide Facial recognition technology: a guide to assessing the privacy risks (July 2026) expects a privacy impact assessment before deployment and valid consent where collection rests on consent.

Two health-specific rules sit on top. Information obtained from the My Health Record system may be collected, used or disclosed only as the Act authorises (My Health Records Act s 59), and registered portal and repository operators must not hold or process its records outside Australia (s 77). Patients' and individual providers' healthcare identifiers are government-related identifiers under the Privacy Act (Healthcare Identifiers Act s 9(6)) and may be used only for authorised purposes.

From 10 December 2026, APP 1.7 requires privacy policies to describe computer programs that make, or substantially and directly inform, decisions that could significantly affect individuals.

7. Sector-specific obligations

Electronic prescriptions

A PBS prescriber writing an electronic prescription must include the software's conformance identifier and a unique prescription identifier in the metadata, and state the prescriber's HPI-I (if any) and the HPI-O of the linked organisation (PBS Regulations s 41A). The prescription may also include the patient's date of birth (s 41B). Since 15 August 2026, authorised nurse prescribers are also PBS prescribers and are allotted PBS prescriber numbers.

Sharing by default to My Health Record

From 1 July 2026, proprietors of pathology laboratories and diagnostic imaging premises must upload pathologist and radiologist reports to My Health Record within 24 hours of the report reaching the requesting or treating practitioner, whether or not Medicare pays for the service (My Health Records Act s 78A; My Health Record (Share by Default) Rules 2025, Compilation No. 1). Exceptions include patients who object or are not registered.

State and territory requirements

Health apps as medical devices

Telehealth platforms that only carry communications are excluded from TGA regulation under item 14F of the Therapeutic Goods (Excluded Goods) Determination 2018, provided every feature meets the exclusion. Features that diagnose, monitor, predict or recommend treatment fall outside the exclusion and generally require inclusion in the Australian Register of Therapeutic Goods unless an exemption applies.

8. Risk indicators and red flags

Identity and fraud indicators in online healthcare

• Questionnaire-only scripts: medication requests by form, chat or email with no real-time consultation.
• Unknown patient seeking Schedule 8 medicines: controlled drugs requested without 100-point identification.
• Identity not visible: a patient who will not use video, or unidentified people present during the consultation.
• Overseas location: a patient or clinician outside Australia while a Medicare telehealth item is claimed.
• Missing eligibility: telehealth billed with no face-to-face service in 12 months, no MyMedicare registration and no documented exemption.
• Unverified IHI requests: callers seeking a patient's healthcare identifier without verifying who they are.
• PRODA credential phishing: texts or calls asking clinicians to "update or verify" PRODA details through a link.
• Out-of-purpose access: My Health Record use unrelated to care.

9. Enforcement and penalties

Commonwealth penalties are set in penalty units, currently A$364 each (Crimes Act 1914 s 4AA; Crimes (Amount of a Penalty Unit) Instrument 2026, for offences from 1 July 2026). Civil penalties under the My Health Records and Healthcare Identifiers Acts are enforced under the Regulatory Powers (Standard Provisions) Act 2014, which allows a court to order a body corporate to pay up to five times the stated amount (s 82(5)). The civil figures below show the maximum for a body corporate; offence figures are for individuals.

Privacy civil penalties are assessed per contravention. In the first civil penalty order under the Privacy Act, Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 (8 October 2025), the Federal Court ordered A$5.8 million over a 2022 cyberattack on the Medlab Pathology business affecting more than 223,000 people: A$4.2 million for failing to take reasonable steps to protect personal information (APP 11.1), A$800,000 for failing to assess the suspected breach promptly (s 26WH(2)) and A$800,000 for late notification to the Commissioner (s 26WK(2)).

10. Recent changes and what to watch

• 10 December 2026[Adopted, effective 10 Dec 2026] Automated decision-making disclosures in privacy policies (APP 1.7 to 1.9). Map automated identity and triage decisions now.
• 7 December 2026[Proposed, consultation closes 7 Dec 2026] TGA review of the exclusion for certain digital mental health tools. Some consumer mental health apps may need ARTG inclusion.
• December 2026[Adopted, applications from Dec 2026] Private-sector relying parties, including health services, may apply to join the Australian Government Digital ID System (Digital ID Act 2024 s 61(d)); participating services must still offer a non-Digital ID alternative (s 74).
• 1 November 2026[In force] New MBS phone items for GP chronic condition management plans, and inpatient telehealth psychiatry items made permanent.
• 19 September 2026[In force] Healthcare Identifiers Act amendments (Regulatory Reform Omnibus Act 2026) let authorised disclosures to health administration entities extend to their employees and contracted service providers (new s 36AB).
• 15 August 2026[In force] Authorised nurse prescribers become PBS prescribers. Platforms must support their prescriber numbers and identifiers.
• 1 July 2026[In force] Pathology and diagnostic imaging reports must be shared to My Health Record by default within 24 hours.

11. What this means for identity verification

• Outcome, not method. No healthcare rule mandates a specific remote identity method, so a document check with face match and liveness is a defensible way to meet the duty to confirm identity, provided the evidence is kept with the clinical record for the state retention period (7 years after the last service in NSW and Victoria, longer for children).
• Verify more than once. The expectation applies at each consultation, so returning patients need a lighter re-check, such as a face match against the onboarding image.
• Accepted documents. The national systems rely on Australian passports, driver licences, visas on foreign passports and Medicare cards; a Medicare card is not photo identification.
• Step up for controlled drugs. Treat Schedule 8 prescribing as a trigger for 100-point identification, consistent with the Active Script List framework.
• Consent and minimisation. Obtain consent for facial biometrics, complete a privacy impact assessment and keep My Health Record data onshore.
• Plan for Digital ID, with a fallback. Private services can apply to use the national Digital ID system from December 2026, but a participating service must keep a reasonably accessible alternative for patients who do not use Digital ID.