HIPAA compliance in Australia: which laws apply to health software
HIPAA is a US law, and it does not apply in Australia on its own. Health software used in Australia follows the Privacy Act 1988 and its 13 Australian Privacy Principles, the Notifiable Data Breaches scheme and, depending on the product, state health records laws, the My Health Records Act and the medical device rules of the Therapeutic Goods Administration (TGA). HIPAA reaches an Australian company through US health data, usually under a business associate agreement.
If your product has to meet both sets of rules, the work shows up in the product itself: consent screens, where the data is stored, who can open it and what happens after a breach. With us, a custom healthcare app built to these requirements starts at $30,000 for one client platform, with a timeline of at least 10 weeks; meeting both Australian and US rules in the same product adds compliance work that we quote in the same estimate.
This guide is for companies that build health software for Australia, the US or both, and want to know what to plan before they hire a team for healthcare software development.
Does HIPAA apply in Australia?
Not by itself. HHS, the US agency behind HIPAA, says the HIPAA Rules apply to covered entities and business associates, and an entity that is neither of these “does not have to comply with the HIPAA Rules”. Covered entities are health plans, health care clearinghouses and health care providers, such as clinics or pharmacies, that send health information electronically in standard transactions. An Australian clinic or health app does not become one just by handling health data.
HIPAA still matters for an Australian company in two cases:
- You work for a US covered entity. If your team handles protected health information (PHI) on its behalf, for example by running its patient portal or storing its records, you are its business associate. The covered entity must sign a written business associate agreement (BAA) with you, and you can be held directly liable yourself for breaking some HIPAA requirements.
- You sell one product in both countries. If the product handles PHI for US customers that are covered entities, each of them signs a BAA with you, and the same code has to meet HIPAA for that PHI. If the Privacy Act covers your company, the Act applies to personal information about any person, US patients included.
There is no official HIPAA certification, in Australia or in the US. In an answer on certification, HHS says no standard requires a covered entity to “certify” compliance and that it “does not endorse or otherwise recognize” private certifications regarding the Security Rule. What the Security Rule does require is a periodic evaluation of your security measures, done by your own team or an outside firm. Our overview of US healthcare laws covers the HIPAA rules in more detail.
What is the Australian equivalent of HIPAA?
The closest equivalent is the Privacy Act 1988, which sets out 13 Australian Privacy Principles (APPs) and is enforced by the Office of the Australian Information Commissioner (OAIC). It is not a health law. It covers Australian Government agencies, larger businesses and some smaller ones, and treats health information as sensitive information, with stricter rules for collecting and using it.
Two points matter most for health businesses:
- Health service providers are covered at any size. Most small businesses, with an annual turnover of A$3 million or less, are outside the Privacy Act. The OAIC says the Act covers health service providers regardless of turnover, and its health privacy guide counts doctors, private hospitals, allied health professionals, pharmacists, gyms and weight loss clinics among them.
- Consent comes first. Under APP 3, an organization may collect health information only when the person consents and the information is reasonably necessary for its work, unless one of the exceptions in the law applies.
Whether your app makes your company a health service provider is a question for your lawyer. For product planning, it is safer to build as if the APPs apply.
HIPAA vs Australian healthcare laws: key differences
HIPAA covers a defined group of health businesses and the vendors that work for them. The Privacy Act also covers organizations outside health and adds stricter rules for health information. The table compares the parts that shape a product.
| Topic | HIPAA (US) | Australian law |
|---|---|---|
| Main rules | HIPAA Privacy, Security and Breach Notification Rules | Privacy Act 1988 and the 13 APPs |
| Who must comply | Covered entities (health plans, clearinghouses and providers that send standard electronic transactions) and their business associates | Australian Government agencies, organizations with turnover above A$3 million, all private sector health service providers and some other small businesses |
| Health data | Protected health information (PHI) | Health information, a type of sensitive information |
| Security | Administrative, physical and technical safeguards for electronic PHI | Reasonable steps to protect personal information under APP 11 |
| Breach notice | The covered entity notifies affected people within 60 days of discovering a breach of unsecured PHI, plus HHS, and the media when more than 500 residents of a state are affected; a business associate notifies the covered entity within 60 days | Reasonable steps to assess a suspected breach within 30 days; affected people and the OAIC are notified when serious harm is likely |
| Regulator | HHS Office for Civil Rights | OAIC; some states and territories add their own health records laws |
A screening aid for product planning, not legal advice.
Health service providers report more breaches than any other sector. In the OAIC's figures for 2025, they made 225 of the 1,205 breach notifications.
Under section 13G of the Privacy Act, a serious interference with privacy can cost a company up to the greatest of A$50 million, three times the benefit gained or, when that benefit cannot be valued, 30% of adjusted turnover. Since 10 June 2025, people can also go to court under a statutory tort for serious invasions of privacy.
Other Australian rules that can apply to health software
The Privacy Act is the base. Which other rules apply depends on where your product is used, which systems it connects to and what it does for the patient.
- State health records laws. In NSW, Victoria and the ACT, private sector health service providers follow both the Privacy Act and a state or territory law when they handle health information. In NSW, that law is the Health Records and Information Privacy Act 2002.
- My Health Record. If your company registers as a repository operator, a portal operator or a contracted service provider for the national My Health Record system, section 77 of the My Health Records Act 2012 forbids holding those records, or processing information about them, outside Australia. Breaking this rule is a criminal offense punishable by up to five years in prison, and it also carries a civil penalty.
- TGA rules for medical devices. Software that meets the legal definition of a medical device must be included in the Australian Register of Therapeutic Goods (ARTG) before it is sold, unless it is excluded or exempt. The TGA lists 15 categories of excluded software, and a product qualifies only if every one of its functions meets the exclusion criteria. Our medical device software guide shows how the same line is drawn under FDA and EU rules.
What building to these laws changes in your product
Most of the work is design decisions made before the build. Australian law and HIPAA both touch each decision below, so one design can be planned for both markets.
- A data map. Every field that holds health information is listed with where it is stored and which roles can see it. The privacy policy, the consent screens and the access rules are built from this list.
- Consent records. The app asks for consent before it collects health information and stores what the person agreed to, and when. When the consent text changes, the app knows who agreed to which version.
- Hosting and vendors. Every service that touches the data, including email, analytics and crash reports, goes on the map. Disclosing data to an overseas recipient brings in APP 8 and can keep you accountable for what the recipient does. The OAIC's guidelines on APP 8 add that storage with an overseas cloud provider, under a binding contract that limits how it handles the data, may count as a use rather than a disclosure.
- Access control. Staff see only what their role needs, admins sign in with a second factor, and idle sessions end on their own. One access model is designed to cover the HIPAA safeguards and the reasonable steps of APP 11.
- Breach response. Monitoring and alerts help you find a breach early. A written plan names who assesses a suspected breach and who notifies the OAIC and affected people, so that the deadlines in the table above are met. For PHI you handle under a BAA, the plan also names who notifies the covered entity.
- Retention and deletion. APP 11 also asks you to destroy or de-identify personal information you no longer need and no law requires you to keep. The app needs retention periods and a way to handle deletion requests.
“From the first release, tag every record with the clinic it belongs to and the agreement that covers it, even if you launch only in Australia. When a US clinic signs a BAA later, the app can add the HIPAA duties to that clinic's records instead of someone sorting old data by hand.”
Alexander Storozhevsky, Lead developer at Ronas IT
How we build health software to HIPAA requirements
Our closest public example is a web platform for analyzing lab test results. We built it so that patients could upload lab files themselves or receive results from a laboratory automatically, read reports on topics such as sleep or nutrition, and let a doctor or health coach view the results and comment on the reports. We built its security controls to HIPAA requirements, on Laravel and Angular.
The security and privacy work on that project included:
- Two-factor sign-in. We set up codes from an authenticator app, not from SMS or email.
- Session limits. Automatic logout after a period of inactivity and updated lifetimes for authorization tokens.
- Monitoring and backups. Alerts on system events and database backups with a longer retention period.
- Data deletion. Users could delete their lab files, and admins could help users delete their data from the admin panel.
After the first version went live, we spent four years adding features and maintaining the platform for the client. Nothing in that list is specific to the US: an Australian product needs the same kinds of controls when it takes reasonable steps to protect health information under APP 11.
On new projects, we describe the infrastructure as code in Terraform, so each environment is versioned and changed through review. We also prefer managed cloud services, because they shorten the preparation for an outside assessment such as a SOC 2 audit or a review of your HIPAA safeguards.
Our engineers build with AI agents. If your contracts or your health data rules limit which outside services may see your code, documents or test data, tell us before the build starts; our guide to choosing a software development company lists what to ask any vendor about AI.
How much it costs to build health software for Australia and the US
Building a custom healthcare app with the security and privacy features described above starts at $30,000 for one client platform: a web app, or one app for iOS and Android. Design, the backend, the admin panel, project management and the links to your lab or practice systems are included, and the estimate grows with each system you connect. Before the build, an optional analysis phase can turn the laws your lawyer confirms into features, a budget and a timeline; a rough estimate is free.
| Work | Starting price | Timeline |
|---|---|---|
| Optional analysis phase before the build | $1,000-$2,000 | At least 1 week |
| Custom healthcare app for patients, clinics or staff, one client platform | From $30,000 | At least 10 weeks |
| Each extra client platform, such as a web portal next to the mobile app | From 50% of the first | Estimated with the scope |
| Support and maintenance of the app with its backend after launch | From $1,000 per month; from $2,000 with web and mobile apps | Ongoing |
Cloud hosting is billed to your own cloud account, and legal advice on which laws apply comes from your lawyer, not from us.
What to do next
- Ask your lawyer two questions. Are you a health service provider under the Privacy Act, and will you handle PHI for a covered entity in the US?
- List the data your app collects. Mark each field that holds health information.
- Decide where the data will be stored. Write down every vendor that will see it.
- Check the TGA rules. If the app meets the medical device definition, confirm that every function fits an exclusion, or plan for an exemption or the ARTG.
- Ask for an estimate. For a written scope, budget and timeline before the build, add an analysis phase.
First published 2025-09-24 by Alexander Storozhevsky, Lead developer at Ronas IT. Rewritten by Evgeny Leonov.
Frequently Asked Questions (FAQs)
Does HIPAA apply in Australia?
Not on its own. HIPAA applies to covered entities, such as health plans and health care providers that send standard electronic transactions, and to their business associates. An Australian company takes on HIPAA duties when it handles protected health information for a US covered entity, usually under a business associate agreement.
What is the Australian equivalent of HIPAA?
The Privacy Act 1988 and its 13 Australian Privacy Principles. Unlike HIPAA, it is a general privacy law, not a health law, and it sets stricter rules for health information. The Office of the Australian Information Commissioner (OAIC) enforces it, and NSW, Victoria and the ACT add their own laws for private health service providers.
Is there a HIPAA certification in Australia?
No. HHS, the US agency behind HIPAA, does not recognize private certifications of Security Rule compliance. Firms that sell them offer an outside evaluation of your security measures. That can help you prepare, but it does not replace your legal duties or stop HHS from finding a violation later.
Do small health businesses in Australia have to follow the Privacy Act?
Yes, if they provide a health service. The exemption for small businesses, those with a turnover of A$3 million or less, does not apply to health service providers: they are covered whatever their size, from private clinics to gyms and weight loss clinics. Whether a software company counts as one is a question for a lawyer.
Does health data have to be stored in Australia?
The Privacy Act allows data to go overseas: before you disclose it to an overseas recipient, you take reasonable steps to make sure the recipient follows the APPs, and you can remain accountable for its mistakes. The strict rule is for My Health Record: registered operators may not hold those records, or process information about them, outside Australia.
How fast must a health data breach be reported in Australia?
Under the Notifiable Data Breaches scheme, once you suspect an eligible data breach, you take reasonable steps to assess it within 30 days. If it is likely to cause serious harm, you notify the OAIC and the affected people as soon as practicable. Under HIPAA, covered entities notify affected people no later than 60 days after they discover a breach of unsecured protected health information.
When is a health app a medical device in Australia?
When it fits the legal definition of a medical device. It escapes TGA registration only if all of its functions fall under the TGA's software exclusions or an exemption covers it; otherwise it needs an ARTG entry before sale.
How much does it cost to build a health app for Australian and US privacy rules?
With us, a custom healthcare app costs from $30,000 and takes at least 10 weeks for one client platform, such as a web app or one iOS and Android app, with its design, backend and admin panel included. Each extra platform costs from 50% of the first. Serving both countries in one product adds compliance work, quoted in the same estimate.
