A medico-legal file under the Privacy Act: health information with a legal context layered on top.

A medico-legal brief is about as sensitive as a document gets: twenty years of GP notes, a psychiatric history, imaging, payslips and sometimes surveillance footage, assembled into one file about one person. It reaches the practice from an insurer or a law firm rather than from that person, who did not choose the examiner and may never meet anyone else in the practice. None of that changes the starting point, because the Privacy Act applies to the file in full.

The useful question for a practice is which obligations attach, and what each one looks like on an ordinary day of opening briefs, booking examinations and sending reports. The answers are more specific than "keep it confidential", and several of them turn on choices a practice makes about software.

The brief is health information, and the small-business exemption does not reach it

The OAIC treats all personal information collected in the course of providing a health service as health information, and health information is sensitive information, which attracts the stricter rules in the Act. A health service includes an activity intended to assess, maintain or improve an individual's health, and an examination whose purpose is to assess a claimant's condition sits comfortably within that wording.¹

Small practices sometimes assume they fall under the small-business exemption for businesses with an annual turnover of $3 million or less. The Act closes that door for health: an operator is not a small business operator if it provides a health service to another individual and holds any health information other than in an employee record.² A sole examiner working from a home office is therefore likely to be bound by the Australian Privacy Principles in the same way as a national network.

The claimant did not hand you the records

The APPs assume that personal information is usually collected from the person it describes, and APP 3.6 requires exactly that unless it is unreasonable or impracticable.³ A medico-legal practice is the standing exception, because its file arrives from the referrer. That is lawful, but it shifts weight onto the other collection rules. Sensitive information may be collected only where it is reasonably necessary for the practice's functions and the person consents, or where an exception applies, such as collection required or authorised by an Australian law or a court or tribunal order.³

"Reasonably necessary" bites harder than it looks. A brief for a lumbar injury may carry decades of unrelated records, including sexual health consultations or a teenage mental health admission, because the referrer copied the whole GP file. The practice will hold all of it, but the report should carry only what bears on the questions asked, and nothing irrelevant should be repeated simply because it was supplied.

APP 5 then requires the person to be told certain things at or before collection, or as soon as practicable afterwards.³ For an examination, that notice belongs in the appointment letter and in the explanation at the start of the consultation, and it should cover:

• the fact that records were collected from someone other than the claimant, and from whom;
• the purpose of the collection, which is the report requested by the referrer;
• who the report and information are usually disclosed to;
• whether the information is likely to be disclosed to overseas recipients, which depends on the practice's software as much as its correspondence.

The report is the purpose, and everything else is a secondary use

Under APP 6, information collected for a primary purpose may not be used or disclosed for another purpose unless an exception applies. For sensitive information, the main exception requires the secondary purpose to be directly related to the primary one and within the person's reasonable expectations.³ The primary purpose of a medico-legal file is the report the referrer asked for, so most other uses fall outside the exception unless the claimant has agreed to them.

The uses that cause trouble are rarely malicious. They include a striking case reused for a teaching talk, a de-identified report shown to a prospective client as a sample, or a batch of finished reports loaded into a tool so that it can learn the practice's style. De-identification reduces the risk in each case without removing it, because a medico-legal history is distinctive enough that a determined reader can sometimes recognise the person behind it.

Litigation adds a second layer on top of privacy. Material produced under compulsion in proceedings carries the implied (Harman) undertaking not to use it for purposes outside those proceedings. The Personal Injury Commission's direction on generative AI says that such material, and material produced under a notice to produce, must not be entered into a generative AI program unless the information stays within a controlled environment, is used only for the proceeding, and is not used to train any large language model.⁴

Where the file is processed is a legal decision

Before disclosing personal information to an overseas recipient, a practice must take reasonable steps to ensure the recipient does not breach the APPs.³ Section 16C makes that obligation concrete: if the overseas recipient then does something that would breach the APPs, the act is treated as the practice's own act and its own breach.⁵

Most medico-legal practices never send a file overseas deliberately. The exposure comes through software, because document storage, text recognition, transcription and generative AI each move the file to wherever the vendor runs them, and a single offshore step is enough. A vendor's privacy page rarely answers the question directly, so it is worth asking in writing.

Not every offshore arrangement counts as a disclosure. The OAIC's guidelines treat giving information to an overseas provider as a use rather than a disclosure where a binding contract limits the provider to handling it for that limited purpose, requires its subcontractors to agree to the same terms, and leaves the practice in effective control of how the information is handled.⁶ Whether that holds turns on contract terms most practices never read, which is why the questions above are worth asking.

Onshore processing is therefore a choice a practice can insist on, and it is the simplest way to keep the APP 8 analysis short. Every component that stays in Australia is one fewer overseas recipient to vet, contract with and answer for.

Security now has a statutory shape, and deletion has a legal exception

APP 11 has always required reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. Since 11 December 2024, APP 11.3 states that those steps include technical and organisational measures.⁷ For a medico-legal practice, the technical side means encryption, multi-factor sign-in and access limited by role. The organisational side means knowing who opens which file, never sending a brief as an email attachment, and training the administrative staff who handle the most documents.

APP 11.2 then requires a practice to destroy or de-identify information it no longer needs for any purpose. The OAIC's guidelines note that the obligation does not apply where an Australian law or a court or tribunal order requires the information to be retained.⁷ A practice needs a written answer to how long each kind of file is kept and why, because "we keep everything" fails APP 11.2 as surely as early deletion fails a retention obligation.

When something goes wrong, the Notifiable Data Breaches scheme requires the practice to notify affected individuals and the OAIC where a breach is likely to result in serious harm.⁸ Health is where breaches concentrate: in 2025 health service providers were the most commonly affected sector, with 225 of the 1,205 notifications the OAIC received.⁹ A brief that reaches the wrong person combines several of the factors that make serious harm likely, so the default assumption should be that it is notifiable until the assessment shows otherwise.

Access requests run into the litigation

Claimants sometimes ask the examiner directly for a copy of their file or report. APP 12 gives individuals a right of access, subject to listed exceptions, and the one practices tend to reach for is narrower than it looks. It allows refusal where the information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by discovery in those proceedings.³

The words "between the entity and the individual" matter. In most claims the dispute is between the claimant and an insurer or employer, and the examiner is not a party to it, so the exception may not fit at all. A practice should decide its approach with its own legal adviser and the referrer before the first request arrives, rather than improvising a refusal when one does.

Handle the brief as a file held for one purpose

Every obligation above follows from the same fact: a medico-legal practice holds someone else's health history, gathered by someone else, for one stated purpose. A practice that can say where each file is stored and processed, who has opened it, what it was used for, and when it will be destroyed has met the core of what the APPs ask, and can show it when the OAIC, a court or the claimant asks.

Trenthos IME is built around that requirement. It turns a brief into a page-referenced chronology on infrastructure Trenthos controls in Australia, with text recognition and AI inference run onshore, so building the chronology never sends the file offshore and no case content is used to train AI models. The examination, the opinion and the report stay with the doctor. The Trenthos IME documentation sets out how files are handled.