Patient emails, recalls and the Spam Act

If your practice already sends appointment reminders by text or email, it is a short step to thinking the same list could carry a newsletter, or an announcement that a new practitioner has joined. The patients are already there, they already gave you their email address, and it feels like the same conversation continued. It is not automatically the same conversation. Reminders about a patient's own care and promotional content about the practice sit under different rules, and the difference matters more than it looks from the sending end.

Two different things wearing the same inbox

An appointment reminder, and a clinically based recall such as a diabetic patient's scheduled six-month review, are part of ongoing care. They exist because of the primary purpose the practice collected that patient's contact details for in the first place, which is a category the Privacy Act treats under Australian Privacy Principle 6 rather than as marketing. A newsletter, a general new-service announcement or news of a new practitioner joining the practice is a different category entirely: it is using patient information to promote something to the patient, which is direct marketing under Australian Privacy Principle 7, regardless of how genuinely useful or well-intentioned the message is.

The regulator's own worked examples make the line concrete rather than theoretical. The Office of the Australian Information Commissioner gives, as its own examples of direct marketing requiring consent, a mail-out to an entire patient database about flu vaccination availability, and promoting a new physiotherapist joining the practice. Both are common, ordinary things a practice might want to tell its patients. Both are direct marketing under the framework, not routine clinical communication, the moment they go to the whole list rather than to individuals for whom the message is part of their own treatment.

Why health data raises the bar

Health information is treated as sensitive information under the Privacy Act, which attracts stricter handling than ordinary personal information. Using sensitive information for direct marketing is only permitted with the individual's consent, whether that consent is express or reasonably inferred from the circumstances. Being an existing patient does not itself supply that consent for unrelated promotional content, and being a health service provider means your practice does not get the small-business exemption that lets many other Australian businesses skip formal privacy obligations altogether. Consent to treatment and consent to receive marketing are also legally distinct, even though a patient often gives both at the same visit without necessarily realising they are separate questions.

The Spam Act's mechanics, plainly

Once a message counts as promotional and is sent electronically, a second layer of rules applies regardless of what the Privacy Act already requires. Consent has to exist before the message is sent, and it has to be provable for every address on the list, even if a marketing agency sends the message on the practice's behalf. Express consent, where someone has knowingly and actively agreed, is the safest form and the one worth keeping a record of: who consented, and when. Inferred consent is read narrowly by the regulator and only holds where the person knowingly gave you their details directly, and it is reasonable to think they would expect this particular kind of message because of an existing, ongoing relationship that the message is directly related to. A patient's relationship with the practice reasonably covers reminders about their own care; it does not automatically stretch to cover an unrelated promotional email about a service they have never used.

Every commercial message also needs to identify the sending practice accurately, with correct contact details that stay valid for at least thirty days, and needs a working unsubscribe mechanism that is free to use, clearly presented, does not require logging into anything or handing over extra personal information, and is honoured within five working days of being used. One rule catches out well-meaning practices more than any other: you cannot send an electronic message asking someone whether they would like to receive marketing, because that request is itself treated as a marketing message requiring consent that does not yet exist. Building a newsletter list by emailing the current patient database and asking who wants to opt in is, on the regulator's own reading, the exact thing the rule is written to prevent.

Capturing consent properly at reception and intake

The practical fix sits at the front desk, not in the email platform. A new-patient intake form is the natural place to ask, with a clear, unticked checkbox specifically for marketing communications, worded plainly enough that a patient understands what they are agreeing to and that it is separate from agreeing to appointment reminders or their own clinical care. Keep a simple record of how and when each patient consented, since the Spam Act expects you to be able to demonstrate consent for every address on a marketing list, not merely assume it exists. Reception staff are worth briefing specifically on this, so the checkbox is presented honestly as an opt-in for marketing content rather than bundled silently into a general terms-and-conditions signature that a patient signs without reading closely.

• Building a defensible patient marketing list
• Add a specific, unticked marketing checkbox to the intake formSeparate from consent to treatment and from agreeing to appointment reminders
• Record how and when each patient gave marketing consentYou need to be able to demonstrate this, not just assume it happened
• Never email the existing list to ask if people want to opt inThat request is itself a commercial message requiring consent you do not yet have
• Keep the marketing list separate from the clinical reminder and recall listMakes it far easier to know which rules apply to any given message
• Include accurate sender details and a working unsubscribe in every marketing messageFree to use, no login required, honoured within five working days
• Review consent records periodically rather than treating them as permanentA tick from several years ago is weaker evidence than a recent, specific one

When a recall campaign drifts into promotion

The boundary blurs most often in a very ordinary situation: a recall message reminding a patient they are due for a review also mentions, in passing, that the practice has just started offering a new service. The clinical part of that message is legitimate care communication. The added sentence promoting an unrelated service is direct marketing riding along inside it, and it is the kind of drift that is easy to miss because the whole message feels like one continuous piece of care-related correspondence. The safer approach is to keep clinical recalls strictly clinical, and run any promotional content through the separately consented marketing list, sent as its own message rather than tucked into someone else's reminder.

None of this is designed to make ordinary patient communication difficult. Reminders and genuine clinical recalls can carry on exactly as they do now. What changes is the newsletter, the announcement of a new practitioner, or the flu-season mail-out to the whole database: those need their own properly consented list, sender details that identify the practice correctly, and an unsubscribe that actually works. This sits alongside the broader advertising rules that already govern what a practice can say publicly, and a free growth plan is a reasonable place to work out how a compliant patient newsletter or recall campaign should actually be structured for your practice.