Ask an allied health practice owner which body accredits their IT and records, and you’ll usually get a guess rather than an answer — RACGP gets named by people who’ve heard of it from a GP friend, AHPRA gets named because it’s the one everyone’s registered with, and sometimes NDIS Practice Standards gets named because a client mentioned it. None of those guesses is quite right, and the actual answer is less tidy than any of them: there is no single allied health practice accreditation scheme. What binds you is a handful of separate obligations that apply whether or not you ever sit an audit.
This guide sets out what those obligations actually are, which ones are compulsory regardless of your practice’s size, what changed under the Privacy Act reforms working through 2025 and 2026, and where the My Health Record system adds a specific written policy most practices don’t know they need.
No. General practice has RACGP accreditation, aged care has the Aged Care Quality Standards, and NDIS providers have the NDIS Practice Standards — each a defined scheme with a named auditor and a certificate at the end. Allied health has nothing equivalent that applies across the board. Physiotherapy, occupational therapy, podiatry, psychology, speech pathology and the other AHPRA-registered professions each have a National Board and a Code of Conduct, but those govern the individual practitioner’s registration, not a practice-level audit of your IT systems.
Some professions have optional, voluntary quality accreditation programs that a practice can choose to pursue — usually because a referrer, insurer or corporate contract asks for it — but none of them is a legal requirement to operate, and they vary practice to practice rather than being a WA-wide standard. If someone has told you your allied health practice is “not accredited” and therefore non-compliant, that’s the same confusion we see with the Essential Eight in general practice: a real framework, misapplied as a mandatory one when it isn’t.
Four things, and none of them requires you to have chosen a specific accreditation scheme first:
The first two apply to every allied health practice in WA without exception. The second two are conditional, but common enough that most practices reading this will be caught by at least one.
Every National Board’s Code of Conduct treats health records the same way in substance: records need to be accurate, contemporaneous, factual and legible, created at the time of the consultation or as soon as practical afterward, and free of anything prejudicial or irrelevant to care. That’s a clinical documentation standard first, but it has a direct IT dependency — a system where a note can be backdated without a trace, or where yesterday’s version and today’s are indistinguishable, doesn’t support a practitioner in meeting it.
The Codes also require records to be held securely, with unauthorised access prevented, and require practitioners to check available electronic sources like My Health Record when taking a patient’s history. What they don’t do is specify a retention period or a technical control — that detail sits in the Privacy Act and in state and Commonwealth record-keeping obligations, not in the AHPRA guidance itself. The practical retention benchmark most practices in Australia work to is seven years from the last consultation for an adult, and until a child turns 25 — worth confirming against your own professional indemnity insurer’s requirements, since some set a slightly longer minimum.
Yes, and this is the fact that catches out sole practitioners and small clinics more than any other. The Privacy Act’s small business exemption — which excuses most businesses under $3 million annual turnover from the Australian Privacy Principles — has a specific carve-out for organisations that provide a health service and hold health information. That carve-out means an allied health practice is bound by the full Privacy Act from day one, at any size, including a sole trader working from a single consulting room.
In practice, that means the Notifiable Data Breaches scheme applies to you, APP 11’s requirement to take “reasonable steps” to protect personal information applies to you, and a privacy policy describing how you collect, use and store health information isn’t optional paperwork — it’s a legislated obligation you already have, whether or not anyone’s ever pointed it out to you.
The reforms working through this period tighten what “reasonable steps” under APP 11 is understood to mean, moving it toward an explicit expectation of documented technical and organisational security measures — access controls, encrypted backups, staff training and a written incident response procedure, rather than a general assurance that data is “kept safe.” A statutory tort for serious invasions of privacy also came into effect, giving individuals a direct right to sue over a serious breach, separate from any OAIC investigation.
There’s also a disclosure obligation worth knowing about even if it rarely applies directly to clinical care: from 10 December 2026, an entity using automated decision-making that significantly affects an individual needs to describe that in its privacy policy. Most allied health practices won’t be using AI in a way that triggers this, but if you’re using AI-assisted transcription, triage or scheduling tools that materially affect how a patient is treated or prioritised, it’s worth checking your privacy policy actually says so before that date.
None of this changes what your practice was already supposed to be doing under the Privacy Act. It raises the cost of not doing it, and it’s a reasonable prompt to check your privacy policy and security measures haven’t gone stale since they were last written.
This is the specific, checkable obligation most allied health practices haven’t heard of, and it applies the moment your practice registers to access My Health Record — including a sole trader, and regardless of how often you actually use it.
Rule 42 of the My Health Records Rule 2016 requires every registered healthcare provider organisation to hold a written Security and Access Policy covering six things:
| Policy area | What it needs to cover |
|---|---|
| Access authorisation | Who can access My Health Record, and how access is suspended or deactivated |
| Staff training | Training before first access, and refreshed at least annually |
| Identity verification | How you confirm who's requesting access before it's granted |
| Physical and information security | Passwords, multi-factor authentication for remote access, screen privacy, account lockouts |
| Risk mitigation | How you review audit logs and respond to suspected unauthorised access |
| Assisted registration | How you handle helping a patient self-register, or a statement that you don't offer it |
A policy document that exists but was never actually followed doesn’t satisfy Rule 42 — the Australian Digital Health Agency and OAIC both expect it to be communicated to and followed by everyone with access, including a sole practitioner acting as their own only user. If you’ve registered for My Health Record and never written this policy, that’s a same-day fix rather than a project: the Agency and OAIC both publish free templates built for exactly this, including a version scaled for sole traders.
Then the NDIS Practice Standards apply on top of everything above, and which pathway depends on your registration group. Most sole allied health practitioners and small teams sit on the verification pathway, which is a document review of qualifications, insurance, worker screening and written policies — not a full on-site audit — but it does specifically ask about your information management and incident response arrangements. If your NDIS work is a larger part of your practice, or falls into a higher-risk registration group, the full Core Module applies, including the Information Management and Risk Management outcomes we’ve covered in detail in our guide to the IT requirements under the NDIS Practice Standards.
The practical upshot is the same either way: a practice already meeting AHPRA, Privacy Act and Rule 42 obligations properly is most of the way to satisfying the NDIS side as well, because the underlying controls — access management, secure records, a tested backup, a documented incident response — are the same controls doing the work in both places.
Nowhere by name, in the same way it doesn’t for general practice or NDIS providers — there’s no sector-specific Essential Eight equivalent written into AHPRA’s Codes or the Privacy Act. What you have instead is APP 11’s “reasonable steps” requirement and Rule 42’s explicit security controls if you’re registered for My Health Record, both of which point at the same practical measures: multi-factor authentication on your practice management system and email, current patching, restricted administrative access, and backups that have actually been tested. If your practice hasn’t looked at Essential Eight uplift before, our guide to Essential Eight for general practice walks through the same eight strategies, and the sequencing translates directly even though the accreditation context is different.
Cliniko, Splose and Penelope — the three platforms we see most often in WA allied health practices — each handle a meaningful share of this by default: individual logins, role-based access and encrypted hosting are built in rather than something you configure from scratch. What still sits with the practice is the human side: who actually has an account, whether former staff still do, and whether your Rule 42 policy and privacy policy describe what the software is actually doing.
In this order, because it deals with the obligations that already legally apply before the conditional ones:
Allied health doesn’t get the tidiness of a single accreditation body to aim at, and that’s exactly why it’s easy for a practice to assume it’s covered when it isn’t — there’s no audit forcing the question. What actually protects your practice and your patients is the same regardless: your AHPRA obligations, your Privacy Act obligations, and your My Health Record obligations if they apply, all genuinely operating rather than sitting as an unread policy document.
Bluebird IT supports allied health practices across the Peel region and greater Perth on the platforms this sector actually runs — Cliniko, Splose and Penelope — including telehealth and Medicare claiming connectivity, alongside the Microsoft 365 environment most practices rely on day to day. We’re a local WA team, not an overseas call centre, so when a Rule 42 policy needs writing or an access review needs doing before your indemnity renewal, it’s a conversation rather than a ticket into a queue. You can read more about our IT support for WA allied health practices.
If you’d like an honest read of where your practice sits against your Privacy Act, AHPRA and (if it applies) Rule 42 obligations, we can work through it with you.
We'll learn about your organisation, your clinical systems, and what's keeping you up at night.
If we're the right fit, you'll select the IT service agreement that best suits your organisation.
With Bluebird IT managing your technology, your team can do what they do best — delivering outstanding care to your patients.
