What changes on the 10th of December for health and care providers

From Thursday the 10th of December 2026, if software helps make a decision that could significantly affect one of your clients, your privacy policy has to say so.

Most Australian businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. Health service providers that hold health information are not, whatever their size. A three-clinician practice is covered. The café next door usually is not.

This article sets out what the new rule says, what kinds of systems it can catch and six things to do before December.

What the rule actually says

The change comes from the Privacy and Other Legislation Amendment Act 2024. It adds new requirements to Australian Privacy Principle 1, the principle that covers privacy policies. The rule applies when three things are true:

• Your organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision
• The decision could reasonably be expected to significantly affect a person's rights or interests
• Personal information about that person is used by the program to do it

When all three are true, your privacy policy must describe:

• The kinds of personal information used by those programs
• The kinds of decisions the programs make on their own
• The kinds of decisions where a program does something substantially and directly related to the decision, such as recommending or guiding what a person decides

It applies to decisions made after the 10th of December 2026. That includes decisions made by systems you already run, using information you collected before that date.

It is a disclosure requirement. It is about what your privacy policy says, and getting it wrong has consequences. The Act makes this requirement a civil penalty provision, which means compliance notices, infringement notices and civil penalties are all available to the regulator. The Office of the Australian Information Commissioner (OAIC) is also already checking privacy policies. Its first privacy compliance sweep began in January 2026.

Why this catches you

The Privacy Act's small business exemption covers most businesses with an annual turnover of $3 million or less. It does not cover an organisation that provides a health service and holds health information. The OAIC's guidance for small business is clear that health service providers are covered regardless of turnover.

Depending on the services you deliver and the information you hold, that can include physiotherapy, psychology, speech pathology, occupational therapy, podiatry, dental and general practices, residential aged care and home care providers and many NDIS providers.

Confirm your own position with your lawyer or accountant rather than assuming, particularly if you are an NDIS provider that does not hold health information.

What counts as software making a decision

This is the part most people will misjudge. The examples below are the kinds of systems we think are worth checking. They are our own reading of the rule, not a list of what is definitely in scope.

In a practice

• Referral triage that sorts, scores or routes incoming patients
• Waitlist ranking
• Online booking rules that decide who gets which appointment type or clinician
• Automated recall rules that decide who gets contacted
• Automated fee, discount, cancellation or debt decisions

In aged care or home care

• Intake and eligibility screening
• Assessment scoring that shapes a care plan or package level
• Rostering or allocation logic that decides which client gets which service or worker
• Automated decisions to reduce, pause or withdraw a service

Two points matter more than the rest.

It does not have to be AI

The rule is written around a 'computer program', not around AI. The Explanatory Memorandum to the Act says the term takes its ordinary meaning and includes pre-programmed rule-based processes as well as AI and machine learning. The OAIC's issues paper on the obligation gives the example of a Microsoft Excel formula used to score and triage people, where the score was a key factor in what a person then decided. A spreadsheet with rules in it can count.

A person approving the output is not automatically enough

The rule covers software that does something substantially and directly related to a decision, not only software that decides on its own. The Explanatory Memorandum says this reflects that a program may be used to recommend a decision to a person or to guide them. If a system ranks or scores people and that is a key factor in what a person then decides, it can still be in scope.

What "significantly affect" means

A plain test: would this person's access to care, their money or their rights change because of what the software worked out?

The Act gives examples, including a decision that affects a person's access to a significant service or support. The Explanatory Memorandum says this may include access to healthcare services.

Beyond that, the lines are not settled. The OAIC consulted on guidance in May and June 2026 and, at the time of writing, has not published it. That guidance is what will draw the lines, so whatever you publish in December may need revising once it lands.

Six things to do before December

1. 1.List every piece of software that touches decisions about your clients. Include your practice or care management system, booking tools, spreadsheets and anything a vendor has switched on recently.
2. 2.For each one, write down what personal information goes in and what decision comes out.
3. 3.Mark the ones where the outcome could significantly affect the person.
4. 4.Note where a person reviews the output, and what that person can actually change.
5. 5.Give that list to whoever maintains your privacy policy.
6. 6.Diarise a review for 2027, because both your systems and the guidance will move.

Pay particular attention to features a vendor has switched on in an update. They are the easiest to miss.

What this is not

It does not ban automated decisions or require you to stop using any tool.

It is not the AI legislation in the news. That work is about national standards for large data centres and AI infrastructure. National Cabinet backed the plan in August 2026 and the Prime Minister has said the standards will be legislated early next year, as reported by ABC News.

It does not ask you to name your software vendors or explain how your software works internally. It asks for the kinds of information and the kinds of decisions involved.

Where we can help

Holosity can map where software shapes decisions about people in your organisation and document it, so your adviser has what they need to write the policy. The wording of the policy itself belongs with your lawyer or privacy adviser.

If you would like to talk it through, book a free Clarity Call.

Sources

• Privacy and Other Legislation Amendment Act 2024, Schedule 1, Part 15. Federal Register of Legislation.
• Australian Privacy Principles guidelines, Chapter 1: APP 1. OAIC.
• Automated Decision-Making Transparency Obligation (APP 1) issues paper. OAIC, May 2026. Quotes the Explanatory Memorandum at paragraphs 336, 337 and 343.
• Consultation on guidance for transparency in automated decision making. OAIC.
• Small business and the Privacy Act. OAIC.
• Privacy compliance sweep to put privacy policies under the spotlight. OAIC, December 2025.
• National Cabinet report. ABC News, 26 August 2026.

Sources last checked on the 25th of September 2026. We will update this article when the OAIC publishes its guidance.