On 20 August 2020 the ACCC announced that the Federal Court had ordered HealthEngine Pty Ltd to pay $2.9 million in penalties for misleading conduct. The case involved two things most practices deal with every week: patient reviews and patient contact details.
This was not a new law. It was an enforcement outcome under the existing Australian Consumer Law (ACL). But it remains one of the clearest Australian examples, in a health setting, of what the regulator expects when a business curates reviews or passes patient information to third parties. Since then, the maximum penalties under the ACL have risen sharply (to $50 million in November 2022 and to $100 million for conduct from 28 March 2026), which makes the lessons more relevant, not less. We cover those increases in separate articles on the ACL penalty changes.
What changed
Nothing in the rulebook changed. What the case did was show how the ACCC and the Federal Court applied the ACL to an online health booking and directory platform. According to the ACCC’s media release (release number 176/20, dated 20 August 2020):
- The Federal Court ordered HealthEngine to pay $2.9 million in penalties for misleading conduct relating to the sharing of patient personal information with private health insurance brokers, and to publishing misleading patient reviews and ratings.
- HealthEngine admitted that between 30 April 2014 and 30 June 2018 it gave non-clinical personal information of over 135,000 patients to third party private health insurance brokers without adequately disclosing this to consumers. The ACCC described this information as including names, dates of birth, phone numbers and email addresses.
- HealthEngine earned more than $1.8 million from its arrangements with private health insurance brokers during that period.
- HealthEngine admitted that between 31 March 2015 and 1 March 2018 it did not publish around 17,000 reviews and edited around 3,000 reviews to remove negative aspects, or to embellish them.
- HealthEngine also admitted that it misrepresented to consumers the reasons why it did not publish a rating for some health or medical practices.
- The court ordered HealthEngine to contact affected consumers and give them details of how they could regain control of their personal information. HealthEngine was also to contribute to the ACCC’s legal costs.
The ACCC said it began investigating in July 2018 and then started legal proceedings. HealthEngine admitted liability and made joint submissions with the ACCC to the court. The ACCC also noted that, up until June 2018, consumers could read patient reviews about health practitioners on the platform.
Two comments from the then ACCC Chair, Rod Sims, set out the regulator’s concern. On data, he said businesses risk breaching the ACL “if they are not upfront with how they will use consumers’ data“. On reviews, he said patients “may have visited medical practices based on manipulated reviews“. That second point is the one practices should sit with. Patients use reviews to choose a clinician, so the ACCC treats a distorted picture of reviews as a real source of harm.
Who it applies to
The case was about a platform, not a clinic. But the conduct it describes is not unique to platforms, and the ACL applies to any business acting in trade or commerce. That includes:
- Medical, dental, allied health and cosmetic practices that publish reviews or ratings on their own website, booking page or social channels.
- Practices that use review widgets, review-collection software or a reputation management service.
- Practices that share patient contact details with any third party for a commercial reason, such as referral partners, lead buyers, financing providers or marketing platforms.
- Booking platforms, directories and agencies that manage reviews or lead generation on a practice’s behalf.
If your practice operates through a company, the ACL penalty regime for corporations applies to you. If you run reviews or lead generation through an agency, you still need to know what is being done in your name.
What the rules require
The HealthEngine outcome turns on a simple idea that runs through the ACL: do not create a misleading impression. Applied to this case, that breaks down into a few clear expectations.
Reviews must reflect what patients actually said
Choosing not to publish a large share of reviews, and editing others to remove negative parts or make them sound better, gave patients a picture of practitioners that did not match what other patients had said. The admissions cover both suppression (not publishing) and alteration (editing). Either can mislead when the result is presented as a genuine view of patient experience.
Ratings and explanations must be accurate
HealthEngine admitted misrepresenting why it did not publish a rating for some practices. The lesson is that the explanation you give around reviews is itself a representation. If you say a rating is missing, hidden or pending, the reason you give has to be true.
Be upfront about how patient data will be used
The data part of the case was framed as misleading conduct under the ACL, not only as a privacy issue. The problem was that patients’ details were passed to insurance brokers without adequate disclosure. If a patient would be surprised to learn where their details went, and the business earns money from that flow, the ACCC may view the lack of clear disclosure as misleading.
Remediation can be ordered
Beyond the penalty, the court ordered HealthEngine to contact affected consumers about regaining control of their information. Practices should expect that, where things go wrong, a regulator may look for fixes that reach the people affected, not just a payment.
What it means for your marketing
Website and booking pages
If you show reviews or star ratings on your website, they should be a fair sample of what patients have said, not a curated selection presented as the whole picture. Avoid quietly removing critical comments or editing them so they read more positively. If you only show a selection, do not describe it in a way that suggests it is complete or representative when it is not.
For registered health practitioners there is a second layer. The National Law prohibits testimonials in advertising a regulated health service, and Ahpra’s guidance explains that the party with control over content is responsible for testimonials appearing in it. In practice this means clinical reviews often should not be used on your own advertising at all, while comments only about customer service or communication style are not testimonials. The ACL lesson from HealthEngine sits on top of that: whatever you do display must not be manipulated.
Google Business Profile and third-party reviews
You cannot edit reviews on Google, but you can still distort the picture. Common examples include asking only patients who are likely to be happy to leave a review, or reporting genuine negative reviews in an attempt to have them removed. The ACCC’s later sweep of online reviews (findings released 7 December 2023) specifically raised concern about review practices that steer happy customers to public reviews and unhappy customers to the business. We cover that report in a separate article on ACCC findings about fake and incentivised reviews.
If you respond to reviews, keep responses factual, polite and free of patient health information. Ahpra also cautions registered practitioners to take care engaging with reviews on third-party sites, because this may be treated as using a testimonial to advertise.
Directories, platforms and referral partners
If you list on a booking platform or directory, read how it handles reviews and ratings. If it hides or edits reviews, the misleading impression may attach to your listing. Ask the platform how it moderates reviews, and keep a copy of the answer.
Lead generation and data sharing
This is the part practices most often overlook. Lead-sale arrangements, “partner offers” at the end of an enquiry form, financing referrals and shared marketing databases all involve passing a patient’s details to someone else. Before doing any of this, ask: does the patient know, clearly and before they hand over their details, who will receive them and why? A line buried in a long privacy policy is unlikely to be enough on its own if the overall impression of the form is that the details stay with the practice.
Email and SMS
If enquiry or booking forms feed a shared list used by another business, say so clearly at the point of collection. Do not upload patient lists to third-party tools for a purpose the patient was not told about.
Agencies and reputation services
If an agency or reputation management service collects or publishes reviews for you, it is acting in your name. Ask exactly how reviews are requested, filtered, displayed and responded to. “We only send the review link to patients who rate us five stars” is the kind of answer that should prompt a rethink.
Common mistakes we see
These are general patterns, not references to any particular practice.
- Curated review carousels presented as “what our patients say“. A hand-picked set of positive comments can imply it reflects patients generally.
- Editing reviews “for length” in a way that removes the critical part. Trimming is different from changing the overall impression.
- Review-gating. Sending a short survey first and only inviting high scorers to post publicly.
- Enquiry forms that quietly share details. A pre-ticked box or a vague “we may share your details with partners” line, with no list of who those partners are.
- Explaining away a missing rating. Telling patients a rating is “unavailable” or “under review” when it has actually been removed for being low.
- Assuming a platform’s review practices are the platform’s problem. If you promote a listing, you are relying on what it shows.
A practical checklist
- List every place your practice displays reviews or ratings: website, booking engine, social media, directories, in-clinic screens.
- For each, confirm whether reviews are filtered, edited or selectively shown, and by whom.
- Remove any editing that changes the meaning or tone of a review. If a review must be shortened, make sure the overall impression is unchanged.
- Stop any process that invites only satisfied patients to post public reviews.
- If you show a selection of reviews, describe it honestly (for example, “a selection of recent comments“) rather than implying completeness.
- For registered practitioners, check displayed reviews against Ahpra’s testimonial guidance and remove clinical testimonials from advertising.
- Map every flow of patient or enquirer data to a third party: referral partners, finance providers, marketing platforms, lead buyers.
- For each flow, check that patients are told clearly, at the point of collection, who receives their details and why.
- Make sure any consent is active (not pre-ticked) and that patients can say no without losing access to care.
- Ask your agency, booking platform and reputation tools how they handle reviews and data, and keep their answers on file.
- Have a plan for contacting affected patients if you discover data was shared in a way they were not told about.
How this fits with other rules
Australian Consumer Law. The HealthEngine penalties were for misleading conduct under the ACL, enforced by the ACCC. The ACL applies to all businesses, including health practices. Maximum penalties for corporations have increased twice since this case: to the greater of $50 million, three times the benefit, or 30% of adjusted turnover during the breach turnover period from 10 November 2022, and with the fixed amount doubled to $100 million for conduct from 28 March 2026.
National Law and Ahpra. For registered health practitioners, the National Law’s advertising provisions apply as well. Testimonials about clinical aspects of a service are prohibited in advertising, and Ahpra’s guidance notes that selectively editing reviews can be misleading. Ahpra’s general advertising guidelines took effect on 14 December 2020.
Privacy Act. Sharing patient information also engages the Privacy Act and the Australian Privacy Principles, which are enforced by the OAIC. Privacy penalties were increased from 13 December 2022. The HealthEngine case shows that the same conduct can raise consumer law issues as well as privacy issues.
TGA. If reviews or testimonials mention therapeutic goods, the TGA’s advertising rules may also apply. That is a separate topic covered in our TGA articles.
Frequently asked questions
Can we choose which Google reviews to show on our website?
Showing a selection is not automatically a problem, but it must not create a misleading impression of what patients generally think. If you are a registered practitioner, clinical testimonials should not be used in your advertising at all under the National Law. Comments only about customer service are treated differently by Ahpra.
Is it wrong to remove a review from our own website?
Removing content that breaches the law, such as a clinical testimonial or a review that reveals health information, can be appropriate. The concern in the HealthEngine case was suppressing and editing reviews in a way that removed negatives or embellished them, giving patients a distorted view.
Do we need consent to share enquiry details with a finance or referral partner?
Privacy law has its own requirements, and this article is not legal advice. From a consumer law angle, the HealthEngine case shows that failing to adequately disclose a data-sharing arrangement can itself be misleading. Tell patients clearly, before they submit their details, who will receive them and why.
Our booking platform handles reviews. Is that our responsibility?
The platform is responsible for its own conduct. But if you promote or link to a listing that presents a manipulated picture, you are relying on that picture to attract patients. Ask the platform how it moderates reviews, and for registered practitioners, check Ahpra’s guidance on who controls review content.
Was HealthEngine penalised under privacy law?
According to the ACCC’s release, the penalties were for misleading conduct under the ACL. The conduct involved personal information, which is why it is often discussed alongside privacy obligations.
Related articles
- Australian Consumer Law maximum penalties rise to $50 million
- Unfair contract terms now attract penalties: what to review
- ACCC findings on fake reviews and influencer disclosure
- Can clinics ask patients for Google reviews? The rules in plain English
Need a hand?
If you are not sure how your reviews are being collected, displayed or filtered, or where your enquiry data ends up, an independent review is a good starting point. Our AHPRA compliance audit looks at reviews, testimonials and patient data flows across your website and channels, and our clinic websites team can rebuild forms and review sections so they are clear and fair from the start.
This article is general guidance based on the published rules and the regulator’s announcement, not legal advice. Final responsibility for advertising and consumer dealings sits with your practice and, for health advertising, the registered practitioner, and complex situations may need independent legal advice.