From 1 December 2025 (4 December 2025 in South Australia), new National Law provisions protect people who raise concerns with Ahpra from reprisals and other detriment, and limit how non-disclosure agreements can be used. A confidentiality clause can no longer stop a person from making a notification to the regulator or helping with an investigation.
For most practices this is about complaint handling, not advertising. But marketing and complaint handling often meet: refund deals, complaint settlements and requests to take down a negative review. If your practice uses confidentiality terms with dissatisfied patients, the templates need checking now.
Status as at October 2026: these provisions are in force. They are part of the Health Practitioner Regulation National Law and Other Legislation Amendment Act 2025, which also introduced a nationally consistent reinstatement order process and permanent register publication of professional misconduct findings involving sexual misconduct. Those changes started on 10 April 2026 and are covered in a separate article.
What changed
The Bill was introduced into the Queensland Parliament, the host jurisdiction for the National Law, on 12 December 2024. It passed on 3 April 2025 and became law on 9 April 2025. Ahpra’s National Law amendments page lists the notifier protections, covering protection against reprisals or detriment and non-disclosure agreements, as in effect from 1 December 2025, and from 4 December 2025 in South Australia.
Ahpra’s April 2025 information guide explains the two changes. The guide was written before the start date was set, so it describes the changes as starting on proclamation.
Protection from reprisals or detriment
The guide says a new section 237A makes it an offence to threaten, intimidate, dismiss, refuse to employ or subject a person to other detriment or reprisal because they intend to make, or have made, a notification, or because they assist people performing functions under the National Law, such as Ahpra staff investigating a concern. The guide gives the maximum penalty as $60,000 for an individual and $120,000 for a body corporate.
Before this change, section 237 already protected people who give information in good faith from civil, criminal and administrative liability. Ahpra’s guide notes that it did not expressly protect them from reprisals or other detriment, and that the new offence gives Ahpra the power to prosecute retaliatory behaviour.
Limits on non-disclosure agreements
The guide says a new section 237B makes NDAs void to the extent they seek to prevent or limit a notifier from making a notification or from assisting people performing functions under the National Law.
It is also an offence to enter into an NDA unless the agreement clearly sets out, in writing, that it does not limit a person from making a notification or from providing assistance to regulators and others performing functions under the National Law. The guide gives the maximum penalty as $5,000 for an individual and $10,000 for a body corporate.
The guide defines an NDA broadly, as a contract or other agreement that prohibits or restricts disclosure of information or documents about the health, conduct or performance of a registered or former registered health practitioner.
Why it was introduced
Ahpra’s guide links the NDA change to the Independent review of the regulation of medical practitioners who perform cosmetic surgery, which identified a risk that patients who had signed an NDA might not know they could still make a notification or help a regulator. As an interim step, the Medical Board updated its cosmetic surgery FAQs to say it did not believe NDAs could prevent patients from making a notification. The reprisal protection responds to gaps identified in several reviews, including the Royal Commission into Institutional Responses to Child Sexual Abuse and the National Health Practitioner Ombudsman’s review of confidentiality safeguards for notifiers.
Who it applies to
The reprisal offence applies to any person, not only registered practitioners. That includes practice owners, managers and companies who employ or engage practitioners and staff. The protection covers patients, colleagues, employees and anyone else who makes or intends to make a notification or assists the regulator.
The NDA provisions apply to any agreement that restricts disclosure of information about a practitioner’s health, conduct or performance. In practice, that can include patient settlement or refund agreements, complaint resolution letters, employment and separation agreements, and contractor agreements.
Ahpra’s short guide says the changes apply automatically in each state and territory, except New South Wales, South Australia and Western Australia, where governments take extra steps to confirm they apply. South Australia’s later start date of 4 December 2025 reflects that.
What the rules require
Do not penalise people for raising concerns
Threats, intimidation, dismissal, refusal to employ or other detriment because someone has notified or intends to notify Ahpra, or because they assist an investigation, is an offence. That covers patients as well as staff. Refusing future treatment, pursuing a patient over a complaint they made to Ahpra, or treating an employee differently because they raised a concern could all be examined against this provision.
NDAs cannot block a notification
A clause that tries to stop or limit a person notifying Ahpra or helping with an investigation is void to that extent. Ahpra’s guide says that while the offence is prospective, meaning a breach can only be prosecuted if the behaviour happened after the change started, an NDA “may be void if it includes this type of provision regardless of when the agreement was entered into.” Older agreements are therefore affected too.
New NDAs must say so in writing
Any new NDA covering information about a practitioner’s health, conduct or performance must clearly state, in writing, that it does not limit the person from making a notification or providing assistance to regulators and others performing functions under the National Law. Leaving this out is an offence in itself.
Existing protections still apply
Section 237 continues to protect people who give information in good faith from civil, criminal and administrative liability. Ahpra’s protections for notifiers page says this is deemed to include defamation. Ahpra’s published public statements also remind people of this protection.
What it means for your marketing
Reviews and review-removal requests
Some practices offer refunds or goodwill gestures in exchange for a patient removing a negative review and agreeing to keep the matter confidential. If that agreement restricts disclosure of information about a practitioner’s conduct or performance, it falls within the NDA definition. It must not try to stop the patient contacting Ahpra, and a new agreement must say in writing that it does not. Asking a patient to stay silent with the regulator is now clearly unlawful.
The advertising rules still apply alongside this. Reviews that refer to clinical aspects cannot be used in your advertising, and selectively editing or curating reviews can be misleading. Removing negative reviews through agreements, while promoting positive ones, can create a misleading impression in its own right.
Website
If your website publishes a complaints process or patient charter, make sure it does not suggest patients must use your internal process instead of, or before, contacting Ahpra or a health complaints entity. Keep the language accurate and neutral.
Google Business Profile and social media
Public replies to critical reviews should never threaten, intimidate or hint at consequences for a patient who complains. If a reviewer mentions they have gone, or will go, to Ahpra, do not respond in a way that could look like pressure or reprisal. Keep replies short, respectful and free of patient information, and take the conversation offline.
Email and SMS
Follow-up messages to dissatisfied patients, especially those offering refunds, should be checked before sending. Any confidentiality terms in them need the written statement that they do not limit a notification to the regulator.
Influencer and collaboration agreements
Cosmetic and aesthetic practices sometimes use agreements with content creators or models that include confidentiality terms. If those terms restrict disclosure about a practitioner’s conduct or performance, they are caught by the NDA definition and need the same carve-out.
Staff and contractor agreements
Marketing and front-desk staff often see complaints first. Employment, contractor and separation agreements with confidentiality clauses should include the written carve-out, and managers should understand that staff who raise concerns with Ahpra are protected from reprisal.
Common mistakes we see
- Refund or settlement templates with broad confidentiality clauses and no carve-out for regulators.
- Assuming old agreements are unaffected. Ahpra’s guide says offending provisions may be void regardless of when the agreement was made.
- Review takedown deals that also ask the patient not to “take the matter further”.
- Review replies that sound defensive or threatening toward a patient who complained.
- Complaints pages that imply patients must exhaust the clinic’s process before contacting a regulator.
- Separation agreements with staff that try to restrict them from speaking to Ahpra.
A practical checklist
- Collect every template with a confidentiality clause: patient settlements, refund letters, complaint resolutions, review removal agreements, employment, contractor, separation and influencer agreements.
- Check whether each one restricts disclosure about a practitioner’s health, conduct or performance.
- Add clear written wording that the agreement does not limit the person from making a notification or assisting regulators and others performing functions under the National Law.
- Remove any clause that tries to stop or limit contact with Ahpra.
- Review existing signed agreements with your legal adviser, since offending provisions may be void.
- Check your website complaints page and patient charter for wording that discourages notifications.
- Set a review reply policy that avoids pressure, threats or patient details.
- Brief managers and front-desk staff on the reprisal offence.
- Keep records of how complaints were resolved and what was agreed.
How this fits with other rules
These provisions sit within the National Law alongside the existing section 237 liability protection and Ahpra’s confidential notifier policy. State health complaints bodies handle complaints under their own laws, and in Queensland and New South Wales complaints about registered practitioners are managed in co-regulatory arrangements. Your advertising obligations under section 133, including the testimonial ban, are unchanged. The Australian Consumer Law, enforced by the ACCC, applies to misleading conduct, and privacy law governs how you handle patient information when resolving complaints. Employment law and any whistleblower schemes that apply to your business sit alongside the new reprisal offence.
Frequently asked questions
Can we still use confidentiality agreements when settling a complaint?
Ahpra’s guide does not ban NDAs. It makes them void to the extent they seek to prevent or limit a notification, and makes it an offence to enter one that does not clearly state in writing that it does not limit a notification or assistance to regulators. Get legal advice on the exact wording.
Does this affect agreements signed before 1 December 2025?
Ahpra’s guide says the offence is prospective, so only conduct after the change started can be prosecuted. However, it also says an NDA may be void if it includes this type of provision regardless of when it was entered into.
What are the penalties?
Ahpra’s guide gives a maximum of $60,000 for an individual and $120,000 for a body corporate for the reprisal offence, and $5,000 for an individual and $10,000 for a body corporate for entering an NDA without the required written statement.
Can we ask a patient to remove a Google review in exchange for a refund?
If the arrangement includes confidentiality terms about a practitioner’s conduct or performance, it is caught by the NDA rules and cannot restrict contact with the regulator. You should also consider whether curating reviews this way could make your remaining reviews misleading. Seek legal advice before using such arrangements.
Does the reprisal protection cover staff as well as patients?
Yes. Ahpra’s guide says it is an offence to dismiss, refuse to employ, threaten, intimidate or otherwise cause detriment to a person because they made or intend to make a notification, or because they assist people performing functions under the National Law.
Related articles
- A practice owner’s guide to the AHPRA advertising rules
- Why testimonials are banned in health advertising (and what to do instead)
- Ahpra conflicts of interest guidance and the codes of conduct review
- Is your practice website AHPRA compliant? A self-audit checklist
Need a hand?
If you would like your review reply approach, complaints page and patient communications checked as part of a broader review, our AHPRA compliance audit can include them. For cosmetic practices, our page for cosmetic clinics explains how we approach compliance across marketing. Agreement wording itself is a legal matter, so involve your lawyer.
This article is general guidance based on the published rules, not legal advice. Final responsibility for advertising sits with the registered practitioner, and complex situations may need independent legal advice.