Privacy Policies For Psychology Clinics

Yes, your psychology or counselling clinic almost certainly needs a privacy policy. In Australia, private health service providers are generally covered by the Privacy Act 1988 even if your turnover is under $3 million, because you're handling health information.

But a privacy policy is only one piece of the puzzle. Mental health clinics collect some of the most sensitive information a person can share, often through intake forms, referrals, telehealth sessions, reports, insurer requests and school communications. So your documents and day-to-day consent process need to match how your clinic actually works.

The good news is that this doesn't have to become a mountain of paperwork. If you get the basics right early, you can protect your clients, your clinicians and your business without making every appointment feel like a legal exercise.

Do Psychology And Counselling Clinics Need A Privacy Policy?

Yes, if you run a psychology, counselling or mental health clinic in Australia, you should have a clear health service provider privacy policy that explains how you collect, use, store and disclose client information.

Under the Privacy Act 1988, organisations that provide a health service and hold health information are generally covered by the Australian Privacy Principles, even if they're small businesses. Health information is also treated as sensitive information, which means there are stricter rules around consent, collection and disclosure.

Your privacy policy should be easy for clients to find and understand. For example, you might include it:

• On your website
• In your online booking system
• With your intake form
• In your client welcome email
• At reception, if you run an in-person clinic

A privacy policy is different from a confidentiality statement in your client agreement. Your privacy policy explains your clinic's overall information handling practices. Your client agreement or consent form usually explains the client relationship, fees, cancellations, confidentiality limits and treatment consent.

For a psychology practice privacy policy, the wording needs to be more specific than a standard website privacy policy for sensitive information. A basic template might talk about names, emails and analytics, but miss the more sensitive parts of your clinic, like GP referral letters, Medicare information, clinical notes, risk assessments, school reports or insurer communications.

What Privacy Laws Apply To Mental Health Clinics In Australia?

The main law is the Privacy Act 1988, including the Australian Privacy Principles, but state and territory health records laws may also apply depending on where your clinic operates.

The Australian Privacy Principles cover things like:

• Being open and transparent about how you handle personal information
• Only collecting information you reasonably need for your services
• Getting consent to collect sensitive information, unless an exception applies
• Telling clients why you're collecting their information
• Using and disclosing information only for allowed purposes
• Keeping information secure
• Giving clients access to their personal information, subject to legal limits
• Correcting inaccurate information

Health information includes more than clinical notes. It can include any information about a person's health, disability, expressed wishes about health services, or health service provided to them, where they're identified or reasonably identifiable.

In practice, your clinic may hold health information such as:

• Mental health history
• Diagnosis, treatment plans and progress notes
• Medication information
• Risk information, including self-harm or safety concerns
• Referral letters from GPs, psychiatrists, schools or insurers
• Medicare, NDIS or private health insurance details
• Emails and messages about appointments or treatment
• Telehealth recordings and health app data, if you ever record sessions or use an app

Some states and territories also have specific health records laws. For example, Victoria has the Health Records Act 2001 and New South Wales has the Health Records and Information Privacy Act 2002. These laws can add extra rules around health information handling, access requests and records management.

If you're a registered psychologist, your professional obligations through AHPRA and the Psychology Board of Australia also matter. These sit alongside your privacy obligations and can affect how you handle confidentiality, record keeping and client communications.

What Should Your Psychology Practice Privacy Policy Include?

Your privacy policy should explain, in plain English, what information you collect, why you collect it, how you use it, who you may disclose it to and how clients can access or correct it.

For a psychology or counselling clinic, it's worth covering the following areas clearly.

What Information You Collect

Your policy should identify the types of personal and health information your clinic collects. This may include:

• Client name, date of birth, contact details and emergency contacts
• Medical and mental health history
• GP, psychiatrist or other treating practitioner details
• Medicare, private health fund, NDIS or insurer details
• Referral letters and reports
• Clinical notes, assessments and treatment plans
• Payment and billing information
• Website, booking and telehealth information

Why You Collect It

Clients should understand why you're asking for sensitive details. For example, you may collect information to:

• Assess whether your services are suitable
• Provide psychology, counselling or allied health services
• Manage appointments and billing
• Communicate with other treating professionals, where appropriate
• Prepare reports requested by the client, insurer, school or referrer
• Meet legal, professional and insurance obligations

Who You May Share Information With

This is one of the most important parts for mental health clinics. Your policy should explain the categories of people or organisations you may disclose information to, such as:

• GPs, psychiatrists and other treating health professionals
• Administrative staff and contractors who help run your clinic
• Medicare, private health insurers or NDIS plan managers, where relevant
• Schools, employers or insurers, if the client consents or the law allows it
• Cloud software providers, booking systems, health data sharing platforms or telehealth platforms
• Professional advisers, insurers or regulators, where needed

You don't need to list every individual recipient, but you should be specific enough that a client isn't surprised by where their information goes.

How Clients Can Contact You About Privacy

Your policy should give clients a practical way to ask questions, request access, seek corrections or make a privacy complaint. This is usually an email address and postal address, plus a short explanation of how you'll respond.

For access requests under the Privacy Act, organisations must respond within a reasonable period. Many clinics aim to respond within 30 days, and some state health records laws may set their own timeframes, so it's sensible to build a process around that.

Do You Need Consent Before Collecting Health Information?

Yes, in most cases you'll need consent before collecting a client's health information, because health information is sensitive information under the Privacy Act.

Consent can be express or implied, but for a psychology or counselling clinic, it's usually better to get express consent through your intake and onboarding process. That way, there's a clear record that the client understood what they were agreeing to.

Your consent process, including any allied health consent forms, should cover:

• Collection of health information through intake forms and sessions
• Use of information to provide treatment and manage the client relationship
• Disclosure to agreed third parties, such as a GP or referrer
• Any limits to confidentiality, such as serious risk of harm or legal obligations
• Telehealth and digital communications, if you use them
• Fees, cancellation policies and administrative communications, if included in the same onboarding pack

Say Priya runs a small counselling clinic in Melbourne. Her online intake form asks clients about trauma history, medication, GP details and emergency contacts. If her form simply says, "I agree to the privacy policy", that may not be enough to show the client understood how their sensitive health information would be handled.

A better approach would be for Priya's intake process to clearly explain what information she collects, why she needs it, how it will be used for counselling services, when it may be shared with a GP or emergency contact, and the situations where confidentiality may be limited. The client can then tick a box or sign a form confirming they understand and consent to that collection and use.

This doesn't mean every single disclosure needs a separate signature. Some uses and disclosures are part of providing the service and can be explained up front. But if you're sending a detailed report to an insurer, employer, school or lawyer, it's usually best to get specific written consent that identifies what will be shared and with whom.

How Should You Handle Access, Storage And Security?

Your privacy policy should match the practical systems you use day to day. If your policy promises one thing but your clinic operates another way, that can create confusion and risk.

Start with storage. Many clinics use a mix of practice management software, telehealth platforms, email, cloud folders, payment systems and paper files. You should know where client information sits, who can access it, and what happens when a clinician, contractor or admin team member leaves.

Good privacy processes for a mental health clinic often include:

• Unique logins for staff and clinicians, rather than shared passwords
• Multi-factor authentication for cloud systems where possible
• Clear rules about taking client files offsite or downloading them to personal devices
• Written contractor obligations for receptionists, virtual assistants and associate clinicians
• A process for responding to lost devices, misdirected emails or suspected data breaches
• Regular reviews of who has access to your systems

You should also think carefully about email and SMS. Appointment reminders can be helpful, but some clients may not want sensitive details sent to a shared phone or email account. Your onboarding documents can ask clients for their preferred communication method and explain that electronic communications carry some privacy risks.

Access requests are another area where clinics need a clear process. Clients generally have a right to request access to their personal information, but there can be limits, especially if giving access would pose a serious threat to someone or unreasonably impact another person's privacy. Your policy should tell clients how to make a request and who will handle it.

For children, young people and family matters, privacy can become more complex. You may need to consider the client's capacity, parental responsibility, court orders, safety issues and professional obligations before sharing records. Your policy can set out the broad approach, while your internal process guides clinicians on what to do when a difficult request comes in.

What Documents Should Work Alongside Your Privacy Policy?

Your privacy policy is important, but it shouldn't carry the whole load. For most psychology and counselling clinics, it works best as part of a small set of client and business documents.

These may include:

• A client agreement or terms of service, covering fees, cancellations, scope of services and client responsibilities
• An informed consent form, covering treatment consent, privacy consent and confidentiality limits
• A telehealth consent form, if you provide online sessions
• Contractor or employment agreements for clinicians and admin staff, including confidentiality and privacy obligations
• Website terms and booking terms, if clients book or pay online
• A data breach response plan, so your team knows what to do if something goes wrong

The most useful documents are the ones your team can actually follow. Keep them clear, consistent and practical. If your intake form, consent form and privacy policy all say slightly different things about confidentiality or reports, clients and clinicians can end up unsure about what applies.

It can also help to review your documents when your clinic changes. For example, you may need updates if you add telehealth, bring on contractors, start working with schools, accept NDIS clients, use a new booking platform, or begin preparing medico-legal or insurer reports.

Key Takeaways

• Psychology and counselling clinics in Australia generally need a privacy policy because they handle sensitive health information.
• Your policy should explain what you collect, why you collect it, how you use it, who you may share it with, and how clients can access or correct it.
• Express consent through your intake process is usually the safest approach for collecting and using health information.
• Your privacy policy should work alongside your consent forms, client agreements, telehealth terms and staff or contractor obligations.
• Storage, access, email, SMS, cloud software and data breach processes all need to reflect the privacy promises you make to clients.

If you'd like help with privacy policies, consent forms and client onboarding documents, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.