We're aware of a cyber security incident affecting the electronic prescriptions provider MediSecure. The eRX Script Exchange (eRX) and the National Prescription Delivery Service (NPDS) continue to operate as usual and have not been impacted. Find out more and read our statement here.

Privacy and managing health information in general practice

Information management for general practice business information

Sale or closure of a practice

Last revised: 24 May 2023

Sale or closure of a practice

Privacy considerations

A practice’s patient list is a valuable asset, and it is unlikely a practice would be sold without it.

The Privacy Act is not clear on the sale or transfer of medical records. Medical records would be transferred as part of a sale by a sole practitioner or as part of the transfer of an unincorporated practice to a new owner.

Where possible, a long settlement period is recommended for business or asset sales involving the transfer of medical records. This will allow consent to be obtained from a patient (either express or inferred) through consent forms or communication of the transfer of records, either in the practice or provided to the patient.

Before and during any settlement period, vendors must ensure patients records are kept secure. Access to any medical records should only occur as required by the sale or transfer of the business and should be restricted to only those people involved in the sale who require access. Providing de-identified documents might be appropriate.10

When selling a practice, GPs should be aware medical records might need to be retained for insurance or other medico-legal purposes. It is important the sale agreement and patient consent permit this.

If the sale is of shares in an incorporated general practice, there is no transfer of personal information (it is retained within the company) and privacy concerns will not apply to the transfer itself.

Deceased GPs

If a practice closes due to a GP's death, the practice staff (or the executor in the case of a sole practitioner) should take reasonable steps to notify patients and organise the transfer of their medical records to another GP.

Health record legislation

There are additional requirements for the transfer or closure of a general practice under current health records legislation.

For example, legislation in Victoria and the ACT require practices to publish a notice in a local newspaper stating the practice is closing or being sold, detailing how the practice plans to deal with the medical records.

Legal advice should be obtained if required.

  1. Australian Government, Office of the Australian Information Commissioner. Australian Privacy Principles quick reference. 2014 [Accessed 7 November 2022].
  2. National Health and Medical Research Council, Australian Research Council, Australian Vice-Chancellors’ Committee. National statement on ethical conduct in human research (2007) (updated 2018). 2018 [Accessed 16 January 2023].
  3. Commonwealth of Australia. Privacy Act 1988.1988 [Accessed 7 November 2022].
  4. Australian Government, Office of the Australian Information Commissioner. Australian Privacy Principles guidelines: Privacy Act 1988. 2015 [Accessed 16 January 2023].
  5. Australian Government, Attorney-General. Parliament approves Government’s privacy penalty bill. 2022 [Accessed 16 January 2023].
  6. Medical Board of Australia, AHPRA. Good medical practice: A code of conduct for doctors in Australia. 2020 [Accessed 16 January 2023].
  7. Australian Government, Office of the Australian Information Commissioner. Business resource. Chapter 9: Research. 2019 [Accessed 16 January 2023].
  8. Australian Government, Office of the Australian Information Commissioner. Chapter 5: APP 5 – Notification of the collection of personal information. 2019 [Accessed 8 November 2022].
  9. Australian Medical Association. Frequently asked questions – Fees. [date unknown] [Accessed 8 November 2022].
  10. Australian Government, Office of the Australian Information Commissioner. Privacy for organisations: Trading in personal information. [date unknown] [Accessed 16 January 2023].
  11. National Health and Medical Research Council. Use and disclosure of genetic information to a patient’s genetic relatives under Section 95AA of the Privacy Act 1988 (Cth) – Guidelines for health practitioners in the private sector. 2014 [Accessed 16 January 2023].