Yes. If a patient, client, or participant is identifiable in a photo, video, or testimonial you plan to publish, you need a written, explicit model release separate from any clinical consent form. That release has to name the exact channels, the duration of use, and how someone withdraws consent later. Skip any of those three and you’re exposed under privacy law and advertising rules alike.
TL;DR:
- A proper model release, covering the exact channels, duration, and withdrawal process, is required for any identifiable patient image used in marketing, separate from clinical consent.
- Regulations from the OAIC, AHPRA, and state health policies mandate explicit, written consent for sensitive health images, especially when used outside clinical records.
- A compliant release form must specify content details, channel-specific opt-ins, timeframes, editing rights, metadata handling, withdrawal procedures, and storage protocols.
- Consent should be obtained after visible treatment results, with evidence of approval kept, and withdrawal requests must be swiftly executed with detailed audit logs.
- Sharing images externally requires explicit participant approval, with consent records attached, and enforceable agreements ensuring third parties honor withdrawal requests.
Table of Contents
- What counts as a model release in healthcare, and how it differs from clinical consent
- What do OAIC and AHPRA actually require?
- What must a compliant healthcare model release include?
- How do you get consent the right way, in practice?
- How do you track consent so it survives an audit?
- What does a pre-shoot to publish workflow actually look like?
- How do you handle a request to withdraw consent after publication?
- Can you share model release forms with agencies or media outlets?
- Are there templates you can actually use?
- What happens if you get this wrong?
- Why briefing and dignity matter as much as paperwork
- How True Care Media handles compliant healthcare photography and video
- Sources
What counts as a model release in healthcare, and how it differs from clinical consent
A model release is permission to use someone’s image, voice, or words publicly, whether that’s a photo on your website, a video testimonial on Instagram, or a quote in a brochure. It’s a marketing document, not a medical one.
Clinical photography is different. A wound photo taken for a treatment record becomes part of the patient’s health file, and clinicians can generally take and use it for direct care without a separate marketing form, provided it stays in that clinical context. The moment that same image appears on a website, in a newsletter, or on a conference poster, you’ve crossed into marketing territory and need explicit consent for that use.
Identifiability isn’t limited to a clear face shot. A distinctive tattoo, a wheelchair with a personalised decal, a support worker standing next to someone, or even a caption naming a suburb can make a person identifiable to people who know them, according to the Office of the Australian Information Commissioner. When you’re unsure, get the release. It costs you five minutes; a complaint costs a lot more.
What do OAIC and AHPRA actually require?
Three regulatory layers apply to healthcare imagery, and marketing teams often only know about one of them.
The Australian Privacy Principles (APPs), enforced by the OAIC, treat an identifiable photo as personal information. If it also reveals something about a person’s health, disability, or treatment, it’s sensitive information, which carries a higher bar for consent before you collect, use, or disclose it. The OAIC’s own guidance on photographing patients is explicit on this point, and its collated health privacy guide confirms that direct marketing involving sensitive health information needs express, written consent, not an assumed opt in.
AHPRA’s advertising rules apply if you provide a regulated health service (most allied health, nursing, and medical providers do). Its advertising guidelines restrict testimonials and before-and-after images because they can create unrealistic expectations about outcomes. AHPRA’s own testimonial tool recommends limiting testimonial wording to factual, verifiable statements and avoiding comparisons with other providers.
State and local health district policies add a third layer. New South Wales’s SESLHD photography policy requires written consent for any non-clinical use, mandates secure storage in authorised repositories, and sets retention timeframes. If you operate across states, check the equivalent policy in each jurisdiction rather than assuming one set of rules covers you everywhere.
What must a compliant healthcare model release include?
A release that only says “I consent to be photographed” won’t hold up if a patient disputes how their image was used later. Build yours around these elements:
- Plain-language description of the content — specify whether you’re capturing photos, video, audio, or direct quotes, and describe the context (e.g. “a testimonial about your NDIS support experience”).
- Channel-by-channel consent — separate tick boxes or clauses for website, social media, print materials, conference presentations, and third-party media, rather than one blanket “marketing use” line.
- Duration of use — a fixed period (12 months, three years, indefinite) with a renewal or review date, not an open-ended “forever” clause.
- Editing rights and honesty commitments — state that images won’t be altered in ways that misrepresent outcomes, particularly for before-and-after content, which aligns with AHPRA’s concerns about misleading advertising.
- Metadata and de-identification handling — note whether location data, timestamps, or names attached to files will be stripped before publication.
- Withdrawal process — a simple method to revoke consent, plus a realistic timeframe (state it, don’t leave it vague) for removal across all platforms where the content lives.
- Storage, access, and audit fields — a reference to your privacy policy, an asset ID for tracking, and a note on who can access the signed form.
Template examples, like the downloadable consent form used by some clinics, show how these clauses translate into an actual signature page. Use one as a structural starting point, not a final answer, since your channels and retention periods will differ.
How do you get consent the right way, in practice?
Getting a signature isn’t the same as getting informed consent. Legal commentary on advertising in health services makes the point clearly: consent needs to follow an actual conversation about what’s being captured, where it will appear, and what happens if the person changes their mind.
A practical sequence looks like this:
- Time it after the result is visible. Ask for marketing consent once a treatment outcome, support milestone, or program result is apparent, not on day one when someone’s still deciding whether to engage your service at all.
- Explain consequences plainly. Make clear that declining or withdrawing consent has zero effect on the care or support they receive. This should be stated in the form itself, not just said verbally.
- Offer channel-specific opt-ins. Let the person consent to a website photo but decline a social media reel, rather than forcing an all-or-nothing choice.
- Show the final edit where you can. Before publishing, let the person see the actual photo or video, and record that they viewed and approved it.
- Clear personal devices immediately. Once content is uploaded to your secure system, delete it from the photographer’s or staff member’s phone or camera, consistent with RACGP guidance on mobile devices for clinical photos.
Pro Tip: Build the “show the final edit” step into your workflow as a mandatory checkbox, not a courtesy. It’s the single easiest way to prevent a dispute six months after publication, when the person barely remembers signing anything.
How do you track consent so it survives an audit?
Every published asset needs a paper trail back to its consent record. That means logging an asset ID, the signer’s name, the exact scope they agreed to, and the date, then storing that record somewhere your marketing and compliance staff can both reach it.
A spreadsheet or a simple internal system works fine if it lets you search by person or by asset in under a minute. When someone withdraws consent, you need to find every place that photo or quote lives and remove it fast, then log the deletion date and method. The OAIC recommends keeping deletion logs precisely so you can demonstrate, if challenged, that you actually acted on a withdrawal request rather than just receiving it.
Where practical, keep evidence that the patient saw the final content before it went live. A quick email confirmation or a signed sign-off sheet is enough. It’s the difference between “we assumed they were fine with it” and being able to prove they were.
What does a pre-shoot to publish workflow actually look like?
You don’t need a legal team on standby to run this properly. A compact workflow covers three stages:
Before the shoot:
- Brief the participant (and their guardian, if relevant) on what’s being captured and why.
- Share a link to your privacy policy.
- For minors or people with a legally appointed guardian, get sign-off from that guardian, not just the participant.
- Set device rules with your photographer or videographer up front.
After the shoot:
- Select final edits before showing anyone.
- Get the participant to view and approve the content.
- Capture marketing consent tied to a specific asset ID.
- Upload to secure storage and clear devices immediately.
Before publishing:
- Check testimonial wording against AHPRA’s advertising rules.
- Add disclaimers to any before-and-after content.
- Confirm the consent record is linked and current before the asset goes live.
Our guide on briefing photographers for allied health clinics walks through this in more operational detail.
How do you handle a request to withdraw consent after publication?
Withdrawal requests will happen, and your process needs to be ready before the first one arrives, not improvised on the day.
Start by acknowledging the request in writing within a short, defined timeframe (24 to 48 hours is reasonable), and confirm to the person that their care or support isn’t affected by the decision. Then move to removal. Search every platform where the asset appears, including your website, social channels, print materials still in circulation, and any third-party sites you’ve shared content with. Some removals are instant (a website page); others take longer (a printed brochure already distributed, a conference recording hosted elsewhere). Tell the person realistically how long full removal will take rather than promising something you can’t deliver.
Log the withdrawal date, what was removed, where, and when, creating the same kind of deletion record the OAIC recommends for audit purposes. If the content was shared with a third party such as a media outlet or agency, your withdrawal process needs to extend to them too, which is exactly why the sharing terms you set at the outset matter so much (more on that next).
One thing to avoid: quietly leaving an asset live because removing it is inconvenient, or because “it’s already been seen anyway.” That’s the fastest way to turn a straightforward consent withdrawal into a formal privacy complaint. Build revocation into your consent form as a named, described process, not an afterthought, so both your team and the participant know exactly what happens next.
Can you share model release forms with agencies or media outlets?
Yes, but only within the scope the original release actually permits. If your form only covers your own website and social channels, handing that same photo to a journalist or an external marketing agency for their own use isn’t covered, even if the outlet or agency is working on your behalf.
The cleanest approach is to write third-party sharing into the release itself. State explicitly whether the content may be provided to an external marketing agency, a media outlet, or an industry publication, and whether that third party can re-use it beyond your original campaign. If your form doesn’t already say this and you need to share an asset externally, go back to the participant for a specific, additional consent covering that use rather than assuming your original signature stretches to cover it.
When you do share, pass the consent record along with the asset, not just the file itself. A media outlet or agency should know the exact scope, duration, and withdrawal terms attached to that image before they publish it anywhere, because if the participant withdraws consent later, that obligation follows the asset wherever it’s gone. Put a written agreement in place with any agency or outlet you work with regularly, spelling out that they’ll honour your consent scope and act on withdrawal requests you pass along. Without that agreement, you have no real mechanism to enforce removal once content leaves your direct control.
Are there templates you can actually use?
Rather than building a release from a blank page, adapt an existing structure and adjust the fields to your service type. A workable healthcare model release generally needs five components: a description of what’s being captured, a channel-by-channel consent table, a duration and review date, a withdrawal clause with a stated timeframe, and a signature block that includes a guardian line for minors or represented participants.
Example consent forms already in circulation at Australian clinics show this structure in practice, though most need updating to include the AHPRA-specific testimonial restrictions and granular channel opt-ins that generic templates leave out. If you’re an NDIS provider, allied health clinic, or aged care operator, your release form should also flag whether the participant has a support person or guardian involved in decision-making, and provide a large-print or easy-read version where accessibility needs to require it.
Resist the temptation to copy a general business photography release wholesale. Healthcare-specific risks, like testimonial claims about treatment outcomes or the sensitivity of disability-related imagery, need clauses that a standard retail or hospitality template simply doesn’t carry.
What happens if you get this wrong?
Non-compliance carries more than reputational risk, though that alone can be significant for a provider whose whole value proposition rests on trust.
Under the Privacy Act, publishing identifiable sensitive health information without proper consent can trigger an OAIC complaint or investigation, with the regulator empowered to direct remedial action. For AHPRA-registered practitioners and services, using a misleading testimonial or an unqualified before-and-after image can lead to a formal advertising complaint, and repeated or serious breaches can affect a practitioner’s registration standing. State health district policies add their own compliance obligations, particularly around storage and retention, which internal audits or accreditation reviews will check.
Beyond the regulatory exposure, there’s a practical cost that’s easy to underestimate: a participant or family member who feels their image was used without proper consent rarely stays quiet about it, especially in the NDIS and aged care sectors where word of mouth carries real weight. A single dispute, even one that never reaches a regulator, can undo years of carefully built community trust. Getting the consent process right isn’t just about avoiding a complaint; it’s about protecting the relationship that makes your marketing content worth having in the first place.
Why briefing and dignity matter as much as paperwork
Separating marketing consent from clinical consent, and showing people the final edit before it goes live, prevents most disputes before they start. It also changes how a shoot feels for the participant.
Brief your photographer or videographer on this distinction directly: capture consistently, avoid staged “before” shots that exaggerate a starting point, and never chase an angle that implies more than the service delivered. For participants with disability or complex support needs, use plain consent language, involve a support person where wanted, and frame shots discreetly rather than centring equipment or visible support needs unless the person specifically wants that shown. Our guide to participant dignity in media covers this in more depth.
— Mishal
How True Care Media handles compliant healthcare photography and video
Getting a model release right is one thing; getting a photographer or videographer who already understands AHPRA advertising limits and OAIC consent requirements is another problem entirely, and it’s the gap most NDIS providers and allied health clinics actually get stuck on. True Care Media builds compliant consent capture into every shoot, so you’re not left retrofitting paperwork after the fact or hoping your existing image library holds up under scrutiny.
We offer a straightforward audit of your existing photo and video library and consent records, flagging any assets that lack a proper release or clear withdrawal terms, alongside content packages built specifically for NDIS, allied health, aged care, and hospital marketing teams. If you’re planning a shoot or just want to know where your current library stands, start with our medical photography services for NDIS and allied health page and book a call to talk through what an audit or a new content package would look like for your organisation.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- OAIC — Taking photos of patients
- AHPRA — Advertising guidelines
- RACGP — Using personal mobile devices for clinical photos