Who this reaches
State and territory public-sector agencies under their local regimes. Private health providers in NSW, Victoria, and the ACT can face both federal and local health-privacy requirements.
What the rule requires
The applicable principles vary across collection, security, use, disclosure, access, retention, and transborder flows. Western Australia's new public-sector privacy framework commenced in July 2026.
What changes when the email path is regional
A common Sydney communication plane gives multi-state teams one provider data path to document, while the regional regulation map identifies where local legal analysis still needs to branch.
What your team still owns
One infrastructure region does not harmonise state laws or determine which regulator, health principle, retention period, or public-record rule applies.
Read the primary sources
This is an engineering and vendor-evaluation guide, not legal advice. Confirm the current rule for your entity, contract, and workload from the primary source.