HIPAA vs Australian Privacy Laws: What App Developers Need to Know

It’s likely that HIPAA was the first thing that came up when you were looking into compliance for your health, fitness, or well-being app. Most of the online developer guides, templates, and compliance checklists are written for the US market. It’s the privacy law that people talk about the most.

However, if you’re making an app for people in Australia, HIPAA probably doesn’t apply to you. Instead, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply. These are a different set of rules with different requirements, obligations, and penalties.

There is a mistake that many business owners make before they come to us: they mix them up. It wastes time and effort making rules that don’t apply, or even worse, it gives people a false sense of security because “HIPAA compliant” doesn’t mean anything in Australia.

This guide breaks down what each law really covers, where they overlap, and what you need to do to make sure you follow the rules if you’re making an app in Australia.

What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that controls Protected Health Information (PHI). This is information that is handled by “covered entities” such as healthcare providers, health plans, and healthcare clearinghouses, as well as their “business associates” who work with that data.

It depends on the sector. If you handle protected health information (PHI) in one of those specific situations, HIPAA applies to you, no matter how much money you make or how big your business is. The Breach Notification Rule, the Security Rule, and the Privacy Rule are the most important parts of it.

Australia is only covered by HIPAA in a few specific cases that are set out in contracts. One example is if your company handles patient data under a Business Associate Agreement (BAA) for a US covered entity as a subcontractor. This means that HIPAA applies to you. Legal issues are not a problem if you only make apps for people in Australia.

What Actually Applies in Australia

Most businesses in Australia that gather personal data must follow the 13 Australian Privacy Principles that are part of the Privacy Act 1988. Health apps are part of this. Following these rules is the job of the Office of the Australian Information Commissioner (OAIC).

A few things make the Australian framework distinct:

• It affects the whole economy, not just one sector: The APPs cover how any organisation that is covered handles personal information. Not only do they cover health data, but because it is “sensitive information,” they protect it even more.
• There is a turnover threshold, but there is one big exception: The Privacy Act usually covers companies that make more than AUD $3 million a year. But health service providers are covered no matter how often they change jobs. You can use this exception if your app checks, manages, diagnoses, treats, or records anything that has to do with a person’s physical or mental health. This is true even if you are a small startup. It’s also why health remains the single most-breached sector in the country: it accounted for 19% of all data breaches reported to the OAIC in 2025, more than any other industry.
• Health information needs clear permission: It is harder to get sensitive information like health data, biometric data, and genetic data than it is to get regular personal information. Most of the time, implied consent isn’t enough.
• It works with the Notifiable Data Breaches (NDB) scheme: You are required by law to tell both the people who could be affected and the OAIC about a data breach that could cause serious harm.
• It can be used even if your company isn’t in Australia: As part of your business, if you gather or store personal data here. There is a test for this called the “Australian link.”

HIPAA vs Australian Privacy Principles: Key Differences

There is a real overlap; both frameworks want the same thing: for personal and health data to be handled safely, openly, and with the person’s knowledge. It’s not automatically compliant here if the build is HIPAA-compliant, and vice versa. This is because the rules on what counts as consent, who is exempt, and how breaches are reported differ.

Building It Right From the Start

Privacy and security aren’t add-ons that you add right before launch; they shape your data architecture, how you work with third-party apps, and how you welcome new users from the very first sprint. Privacy is built into everything we do at App Gurus. We make mobile apps and software for clients in Australia across healthcare, fitness, and wellness. It’s not something we add on at the end.

Getting in touch for a free consultation is the best way to ensure your health or wellness app meets all of Australia’s requirements from the start.