A client joins your video call from a shared kitchen table. A family member is visible in the background, and the connection keeps dropping every few minutes. You proceed with the session. But if a complaint landed on your desk months later, could you show that this client consented to telehealth, understood its limits, and had a suitable environment to participate in?
It’s questions like these which prove that telehealth compliance in Australia is now a permanent part of daily operations, not a leftover from the pandemic years. The obligations are just as real as they are for in-person care, spread across AHPRA standards, the Privacy Act, and Medicare requirements.That may sound like a lot to hold in your head between clients. But the good news is that it becomes manageable once you understand your core obligations and build a few reliable workflows around them.
The core legal framework of telehealth
Telehealth carries exactly the same compliance obligations as in-person care. There's no reduced standard because the client is on a screen. Every registration, professional, privacy, and record-keeping duty that applies in your treatment room applies to your video call. Those obligations sit across four pillars:
- AHPRA and professional board standards: Your registration, your scope of practice, and your professional conduct requirements travel with you into the virtual room.
- The Privacy Act 1988 and the Australian Privacy Principles: How you collect, store, and protect client information doesn't change because the session is online.
- Medicare and referral requirements: Valid referrals, eligible items, and correct billing all still apply to telehealth items.
- Clinical record-keeping duties: Your notes must meet the same clinical standard, with a few telehealth-specific additions.
Consider a physiotherapist running a video consultation for a client managing lower back pain. That practitioner still needs to confirm the client's identity, obtain informed consent, deliver assessment within their competence, document the session to the usual standard, and bill the correct Medicare item if one applies. In this scenario, only the mode of delivery changes while the duty of care stays consistent [4].
Many practitioners moved sessions online during COVID and just stayed there, without ever going back to check the setup properly. With telehealth now a permanent fixture, treating it as a lighter-touch service is a genuine compliance risk. The rest of this guide walks through each pillar so you can build workflows that hold up under scrutiny.
AHRPA telehealth requirements for Allied Health practitioners
AHPRA and the individual professional boards expect the same standard of care from virtual appointments as from in-person ones. There's no separate, softer rulebook for telehealth [4]. Three requirements sit at the centre of what AHPRA expects from practitioners providing virtual care.
- You must practise within your competence
- Telehealth may not be appropriate for presentations that need hands-on assessment
- You must be able to identify the client
- You must apply the same clinical standards remotely as you would in person
Beyond those shared expectations, several boards have profession-specific guidance. The Physiotherapy Board, the Psychology Board, the Occupational Therapy Board, and Speech Pathology Australia have all published positions relevant to remote delivery, and these are updated periodically [5]. A speech pathologist assessing paediatric articulation via video, for example, works under different practical considerations than a psychologist delivering a therapy session.
Check your own board's current position statement rather than assuming a blanket rule covers you. It takes ten minutes, and it's the clearest way to confirm your telehealth practice sits inside your professional obligations. Bookmark the page and revisit it when your board flags an update.
What telehealth consent must cover and how to document it
Valid telehealth consent is informed, voluntary, and documented. That's the standard, and it's the piece most practices don’t spend enough time and resources to build into their systems. For consent to be genuinely informed, the client needs to understand what they're agreeing to. Your consent process should cover:
- Your identity and registration status so the client knows who is treating them and that you're a registered practitioner.
- The nature and limitations of telehealth, including what can and can't be assessed remotely.
- The privacy and security risks of virtual delivery, such as the possibility of a connection over public Wi-Fi being less secure.
- The client's right to decline telehealth or switch to in-person care at any point, without penalty.
- Any third-party presence on either end of the call, whether that's a carer, an interpreter, or a supervisor [1].
Is verbal consent enough, or does it need to be written? Verbal consent can be valid. But written or electronically acknowledged consent is far easier to defend if a complaint ever lands. The practical answer is to capture consent in writing at onboarding and then note in the clinical record that consent to telehealth was confirmed for each relevant session.
In a well-run practice, this looks simple. The client receives a telehealth consent form as part of intake, acknowledges it electronically before their first video session, and the practitioner adds a short line to the progress note confirming consent was in place.
Telehealth privacy obligations under the Privacy Act 1988 and Australian Privacy Principles
Your privacy obligations for telehealth flow from the same Privacy Act 1988 and Australian Privacy Principles (APPs) that govern all your health records. Four APPs are most directly relevant to virtual care.
- APP 1 (open and transparent management) requires you to have a clear, current privacy policy that explains how you handle client information, including telehealth data.
- APP 6 (use and disclosure) limits how you can use the information collected during a session to the purpose for which it was gathered.
- APP 11 (security of personal information) requires you to take reasonable steps to protect client data from misuse, loss, and unauthorised access. This is the one that keeps practitioners up at night, because "reasonable steps" isn't a fixed checklist and it's rarely obvious where the line sits.
- APP 8 (cross-border disclosure) becomes relevant the moment you use a platform that stores data offshore, because you remain accountable for how that overseas provider handles the information [1].
During a telehealth session you may collect video, audio, clinical observations, and any files the client shares. All of it must be stored securely and only for as long as your retention obligations require.
So what are the privacy requirements for telehealth Allied Health in Australia, in practical terms? Your privacy policy must tell clients what you collect, how you store it, and whether any data leaves the country. The safest position is to choose a platform that stores data within Australia or under adequate data protection arrangements, so you're not carrying unnecessary APP 8 exposure. The Australian Telehealth Standards and ISO 27799 are useful reference points when you assess a provider.
Understanding encryption, data sovereignty, and appropriate use
A secure telehealth platform needs three things: strong encryption, appropriate data handling, and a design built for clinical use. When it comes to secure video, most of us have wondered whether the tool we're using actually meets the requirements or whether we're just assuming it's fine. Here's the key things to look out for to solve that dilemma:
- End-to-end encryption protects the session so that the content can't be intercepted in transit. This is the baseline.
- Data sovereignty matters because where your client data is stored determines which laws protect it. Australian-hosted storage, or offshore storage under adequate protection, keeps you on solid ground under APP 8.
While regulatory bodies like the Australian Health Practitioner Regulation Agency (AHPRA) do not explicitly publish a banned list of software, consumer-grade platforms fail to meet key clinical and legal standards required for healthcare delivery. This is why consumer-grade tools like FaceTime or a standard Zoom account are generally not appropriate for clinical use without specific configuration [2]. Since these platforms weren't designed with health record obligations in mind, using them by default leaves you assuming compliance rather than demonstrating it.
Which telehealth platforms are compliant with Australian privacy law? To answer this, you need to ask your provider very specific questions including whether the platform is encrypted end-to-end, where the data is stored, and if they support your obligations under the Australian Telehealth Standards? You are responsible for the platform you choose, so be sure to keep a record of the due diligence you’re carried out.
Telehealth documentation requirements for Australian consultations
Telehealth documentation carries the same clinical standard as in-person notes, with a handful of additions specific to the mode. It can feel like double the work when you have less control over the environment and you're still expected to meet the same clinical bar remotely. The additions themselves are short and mostly repeatable, though. After a telehealth appointment, your documentation should record the following into a client's file:
- Modality used - This includes whether the consultation was over video or phone.
- Consent - Be sure to confirm that telehealth consent was obtained before starting the session
- Platform - Document the exact platform used for the session
- Third parties - Document if anyone besides the client and the approved practitioner were seen or heard during the telehealth session
- Clinical assessment findings - These need to be documented to the usual standard
- Limitations - Make a note if you encountered a dropped connection or an inability to complete a physical assessment [2].
Do telehealth records need to be stored differently from in-person consultation notes? No. They live in the same clinical record and carry the same retention requirements, generally a minimum of seven years for adults and until age 25 for minors, though you should confirm the rule for your state and profession.
When a telehealth consult was clinically inappropriate, you must record it as well. If you recommended an in-person appointment or a referral because the presentation exceeded what video could safely deliver, that note protects both the client and you. It shows your clinical judgement in action.
Understanding valid referrals and billing obligations
Medicare compliance is a separate risk stream from your clinical and privacy obligations, and incorrect billing counts as a breach on its own terms. Three areas need your attention.
Valid referrals: Allied Health telehealth items that sit under chronic disease management require a current GP Management Plan and Team Care Arrangement [1]. This is where some confusion might set in. If the GP referral was written pre-COVID, it technically expired. Confirm the referral is current before you bill rather than treating and hoping. If it's lapsed, the cleaner path is to hold the item until an updated plan arrives.
Eligible patient locations: Some items carry rurality or location requirements, so the client's circumstances can affect eligibility.
Correct item number selection: Telehealth items differ from their in-person equivalents, and using the wrong number is a compliance issue even when the care was sound.
What are the Medicare referral requirements for Allied Health telehealth in Australia? They shift periodically, and updated MBS factsheets for 2026 are already in circulation. We always recommend verifying current requirements through MBS Online before you rely on them.
Managing third-party presence and environmental suitability
Who else is in the room matters, on both ends of the call, and it needs to be handled deliberately.
On the client's side, that might be a carer, a family member, or an interpreter. On your side, it could be a supervisor or the reality of a shared co-working space. How should you handle a telehealth session where a third party is present? Confirm the client is comfortable with that person being there, document who was present, and where the third party is on your side, make sure the client has consented to it [2].
Environmental suitability is your responsibility too. You must take reasonable steps to deliver the session from a private, professional setting. A physiotherapist working from a home office, for instance, should close the door, mute notifications, and let the household know a session is in progress. This ensures people accidentally wandering into frame or background noise doesn't compromise the client's privacy or the quality of care. It's a quick setup routine that pays off every session.
The compliance limitations of virtual appointments
Telehealth creates genuine compliance risk in ways in-person care doesn't. The obvious limitation is the inability to perform hands-on assessment. There's also technology failure mid-session, the difficulty of verifying identity when you can't rely on familiar in-person cues, the reduced ability to read non-verbal signals, and the real challenge of assessing safety in mental health contexts where you can't see the whole environment or intervene physically [8].
What are the risks of telehealth from a duty-of-care perspective? The primary one is proceeding with a consultation that has outgrown a client's needs. If a presentation calls for in-person assessment or urgent escalation and you continue on video anyway, that's a clinical and compliance failure.
The professional response isn't to avoid telehealth. It's to build in the judgement to recognise when a client's needs exceed what virtual care can safely deliver, and to act on it by recommending an in-person appointment, a referral, or escalation. Documenting that decision then closes the loop. Knowing telehealth's limits is a strength, not an admission that it doesn't work.
How practice management software supports telehealth compliance
The right practice management software turns telehealth compliance from a daily mental load into something that mostly runs in the background.
Good software captures telehealth consent at onboarding and records it against the client file, so you're never hunting for proof later. It gives you documentation templates that prompt you for the modality, platform, third-party presence, and consent confirmation, which means fewer gaps in your notes. It supports secure video delivery under Australian data handling arrangements, and it builds an audit trail as you work, so demonstrating due diligence becomes a byproduct of normal practice rather than a separate project.
That's the shift worth making. Compliance is no longer the friction you fight through between clients and instead becomes a quiet, reliable part of how a well-run practice operates. You focus on the client on the screen, and the system holds the record-keeping, consent, and security obligations steady underneath you.
Compliance is a practice standard, not a barrier to telehealth
Consent, privacy, documentation, and clinical governance can feel like four separate weights to carry. To simplify things, it pays to think of them working as one framework. A single, connected way of running telehealth that protects your clients and your practice at the same time. Once you understand your obligations under AHPRA standards, the Privacy Act, and Medicare, the systems around them fall into place quickly.
Here's your next step. Pick a single upcoming telehealth session and run it as a test of your workflow. Check that consent is recorded, the platform stores data in Australia, and your notes capture the mode of delivery. If any part feels clunky, that's your signal to tighten it before it becomes routine.
Telehealth is a permanent mode of Allied Health care now, and it keeps growing. Practices that build reliable workflows today, with software like splose holding the record-keeping steady, will be ready for whatever comes next.
