Emailing patient records: privacy questions answered
Sending patient records by email? Protect them before you press Send. Short answers first, then the detail, with links to the official sources.
Why it matters
Practices regularly need to give sensitive records to insurers, lawyers, specialists and other authorised recipients. Even when a recipient asks for an ordinary email attachment, the practice still has to consider its own privacy and security obligations.
Australian privacy law generally requires reasonable safeguards for personal and health information. Regulators and healthcare guidance recognise the risks of unprotected email, and support suitable safeguards such as encrypted attachments, secure portals and secure messaging.
SendRight helps a practice follow the same protection steps every time, without each staff member making a new security decision for every email.
Important: a secure way of sending doesn't replace checking the recipient, confirming the authority to disclose, sending only the records needed, and following practice policy.
Frequently asked questions
Can a medical practice email patient records without encryption?
There's no single Australian rule that makes every unencrypted email with patient information illegal, but the practice must take reasonable steps to protect it.
Covered healthcare providers must take reasonable steps to protect personal information under Australian Privacy Principle 11 (APP 11). In NSW, the Health Records and Information Privacy Act 2002 also sets security obligations for health information. The right safeguards depend on how sensitive the records are, the risks of disclosure and the controls available. Sending full medical records as an unprotected attachment can be hard to justify when suitable secure alternatives are readily available.
Sources: OAIC: APP 11, security of personal information; IPC NSW: Health Privacy Principles
Can an insurance company demand unencrypted medical records?
An insurer can ask for a particular delivery method, but its preference doesn't remove the practice's obligations.
The practice can offer an encrypted PDF, a secure transfer portal or another approved method. If the insurer can't process encrypted attachments, ask it to nominate a suitable secure alternative, and refer the decision to the practice manager or privacy officer.
Does patient consent mean we can email records without protection?
Not necessarily. Authority to disclose the records and reasonable security for sending them are separate questions.
Consent doesn't automatically waive the practice's security obligations. Confirm the scope of the consent, who the recipient is and which records are needed before sending.
Does APP 11 specifically require password-protected PDFs?
No. APP 11 requires reasonable steps, not a particular technology.
APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It doesn't prescribe a password-protected PDF for every situation. Encryption and other technical safeguards are recognised options, and whether they're appropriate depends on the circumstances.
Sources: OAIC: APP 11, security of personal information; OAIC: Guide to securing personal information
What does NSW law require?
For organisations it covers, NSW law requires reasonable security safeguards for health information. It doesn't require a password on every emailed attachment.
The Health Records and Information Privacy Act 2002 (NSW) includes Health Privacy Principle 5 (HPP 5), on the retention and security of health information. HPP 5 is not a blanket rule that every outgoing email must have password-protected attachments.
Sources: IPC NSW: Health Privacy Principles
Does the NSW Health Privacy Manual apply to private GP practices?
Not automatically. It's operational guidance for NSW Health organisations.
The NSW Health Privacy Manual for Health Information is written for NSW Health organisations. Its discussion of external email risks and how to protect against them is a useful public-sector example, but it isn't binding on every private practice. Private practices should base their position on the laws that apply to them and their own documented security procedures.
Sources: NSW Health: Privacy Manual for Health Information (PDF)
Does Queensland Health publish similar guidance?
Yes. Sunshine Coast Hospital and Health Service's guidance on releasing information by email says emails must be encrypted.
This shows how one Queensland public health service approaches it. It isn't a legislative rule for all Queensland private practices, and the wording alone doesn't mean every PDF needs its own password. Queensland Health also publishes guidance on digital communication and information about its information security policy.
Sources: Sunshine Coast Health: Release of Information via email; Queensland Health: Use of digital communication (PDF); Queensland Health: Information security policy
What do RACGP standards say about emailing patient information?
The RACGP supports a risk-managed approach to electronic communication. It doesn't impose a single rule that every emailed document must be password protected.
RACGP standards and related guidance cover confidentiality, secure communication, practice procedures and the appropriate handling of patient information. Check the edition that currently applies to your practice, and any accreditation transition arrangements, before relying on a particular criterion.
Sources: RACGP: Standards for general practices; RACGP: Using email in general practice
Is ordinary email secure because Microsoft 365 uses TLS?
TLS protects a message between mail systems. It doesn't protect the attachment itself.
Transport Layer Security (TLS) can protect messages in transit between mail systems when it's negotiated correctly. Once delivered, an unprotected attachment can be opened by anyone with access to the mailbox or a forwarded copy. Encrypting the attachment adds protection beyond the transport, but password handling, device security and checking the recipient still matter.
Is a password-protected PDF enough?
It's a useful control when done properly, but not a complete security solution on its own.
Use strong PDF encryption, a unique, strong passphrase, a separate channel for the passphrase, a checked recipient and a record of what was sent. A weak password, a password in the same email or a wrongly addressed message can undo the protection. Consider a secure portal where stronger access controls, expiry or revocation are needed.
Should the password be sent in the same email?
Generally, no. Send it a different way.
A separate channel, such as a verified phone number for a call or SMS, reduces the risk that someone who gets into the email also gets the passphrase. The separate channel should itself be verified and suit the recipient and the risk.
What if the insurer can't accept encrypted PDFs?
Ask for a secure alternative, record the request, and don't lower security just for convenience.
Ask the insurer for an approved secure portal, secure messaging or another protected transfer method. Record the request and the alternative you offered. Don't downgrade security for administrative convenience without an authorised, documented risk assessment.
Sources: OAIC: Guide to securing personal information; Australian Digital Health Agency: Secure messaging
What if records are accidentally sent to the wrong recipient?
Follow your practice's incident response procedure straight away.
Contain the disclosure where you can, keep the evidence, assess the information and the people affected, and work out whether you must notify anyone. Depending on the circumstances, the Notifiable Data Breaches scheme under the Privacy Act, or state requirements, may apply. Encryption can reduce the harm, but the incident still needs assessing.
Sources: OAIC: Notifiable Data Breaches
Does using SendRight automatically make a practice compliant?
No. A document protection tool is one control in a wider privacy and security program.
Compliance also depends on lawful disclosure, consent or other authority, checking the recipient, staff training, retention, access controls, incident response and your practice's policies.
Can we send records to lawyers, insurers and other third parties?
Possibly, where there's a proper legal basis and only the information authorised or required is sent.
The kind of recipient doesn't remove the need for reasonable security safeguards. Follow your practice's approved process for disclosing and sending records.
A recommended way to send records
Verify authority
Confirm the patient's consent or another lawful basis, and the scope of the records requested.
In SendRight: The Files step asks why the records can be released, and asks you to confirm approval for anyone other than the patient or a treating provider.
Verify the recipient
Independently confirm the receiving organisation, the email address and the separate channel for the passphrase.
In SendRight: You tick that you've checked the address, and the mobile number for an SMS, against the patient file or signed request.
Minimise the disclosure
Include only the records relevant to the authorised request.
In SendRight: You choose the files. SendRight never adds anything else.
Choose the protection
Use secure messaging, an approved secure portal or a properly encrypted attachment.
In SendRight: Every file gets AES-256 protection the best way for its type before it leaves the PC.
Separate the credentials
Send the passphrase by a verified channel, apart from the documents.
In SendRight: The Password step gives it by SMS, an expiring link in a separate email, phone or in person. Never in the document email.
Record the action
Log who authorised and sent the records, to whom, when and how, without copying clinical details.
In SendRight: SendRight produces a disclosure record to paste into the patient's file.
Escalate exceptions
Refer any request to remove protection to the practice manager or privacy officer for a documented assessment.
In SendRight: Use template E below, and the staff privacy guide's scripts.
When a recipient asks for records without protection, use the email templates for record requests.
Sources
Official sources, and what kind of source each one is. Check the current version before relying on any of them.
| Source | Kind | Applies to |
|---|---|---|
| OAIC: APP 11, security of personal information | Law, and the regulator's interpretation | APP entities, including private health service providers |
| OAIC: Guide to securing personal information | Regulator guidance | Not itself a legal requirement to encrypt |
| OAIC: Notifiable Data Breaches | Law, and regulator guidance | APP entities |
| IPC NSW: Health Privacy Principles | NSW law, with official guidance | Check whether your organisation is covered |
| NSW Health: Privacy Manual for Health Information (PDF) | NSW Health operational policy | NSW Health organisations, not all private practices |
| Sunshine Coast Health: Release of Information via email | Hospital and Health Service guidance | Not a general Queensland rule for private practices |
| Queensland Health: Use of digital communication (PDF) | Queensland Health guidance | Check its scope and current status |
| Queensland Health: Information security policy | Queensland Health public information | Detailed controls may not be public |
| RACGP: Standards for general practices | Professional and accreditation standards | Check the edition and criteria that apply |
| RACGP: Using email in general practice | Professional guidance | General practice |
| Australian Digital Health Agency: Secure messaging | Sector guidance | Secure messaging between providers |
This is general information for Australian practices, not legal advice. It separates laws from regulator guidance, professional standards and public-sector policy. Check which laws apply to your practice and its state, and follow your own privacy policy and procedures. SendRight helps with secure document handling, but doesn't replace professional judgement, legal advice or your privacy obligations, and can't guarantee compliance or prevent every breach.
Try SendRight free during the preview
SendRight is in preview for Australian practices. Ask for a copy and we'll help you set it up, usually in a few minutes per PC.