The Legal and Medico-Legal Danger of Posting CCTV Images or Allegations Online

1. Introduction: Why Social Media and Healthcare Don’t Mix

For Australian medical practices, clinics, and allied health providers, social media platforms can feel like an immediate and accessible solution when something goes wrong — a no-show, a billing dispute, or a suspected theft. The instinct to warn others is understandable. But acting on that instinct online can create catastrophic medico-legal exposure.

This article is written specifically for GPs, specialists, practice managers, dental practices, physiotherapy clinics, psychology practices, and other healthcare providers operating in Australia. It explains the intersection of Australian defamation law, privacy legislation, AHPRA professional standards, and insurance coverage — and what every practice needs to know before hitting ‘post’.

2. Real-World Case Study Scenario

Consider the following scenario, which is representative of incidents encountered in Australian medico-legal practice:

3. Australian Defamation Law: What Medical Practices Need to Know

Defamation law in Australia is primarily governed by uniform defamation legislation enacted across all states and territories, most recently amended by the Defamation Amendment Act 2021 (NSW) and corresponding reforms in other jurisdictions. For healthcare providers, the key provisions are as follows.

3.1 What Constitutes Defamation?

A person (the plaintiff) may bring a defamation claim if published material:

Identifies them — or is capable of identifying them — to a reasonable person;

Conveys one or more defamatory imputations (i.e., meanings that would damage reputation, lower the person in the eyes of right-thinking members of the community, or cause others to shun or avoid them); and

Causes, or is likely to cause, serious harm to their reputation (following 2021 reforms).

Posting a CCTV image to a Facebook group with commentary implying theft is capable of satisfying all three elements, even where the poster believed the conduct was deliberate.

3.2 Who Can Sue for Defamation?

Importantly, defamation claims in Australia can be brought by individuals and, following the 2021 reforms, by certain companies. A natural person does not need to prove financial loss — harm to personal reputation is sufficient. This means a patient, customer, or visitor who can identify themselves in a published image may have standing to sue.

3.3 The 2021 Reforms: Serious Harm and Concerns Notices

The 2021 reforms introduced a serious harm threshold for individual plaintiffs, and a mandatory Concerns Notice process that must be completed before proceedings can be commenced. The Concerns Notice framework is designed to encourage early resolution, but it does not reduce liability — it creates a formal, documented pathway toward litigation. Practices receiving a Concerns Notice should seek immediate legal advice.

Further detail: Australian Law Reform Commission — Defamation Law Reform

3.4 Online Publications and Facebook Groups

Publishing to a Facebook group — even a ‘closed’ or ‘private’ group — constitutes publication for the purposes of defamation law. Each person who views the post is a separate publication. Where a post is shared or screenshot, publication extends further. The geographic reach of the internet does not narrow the application of Australian law to Australian publishers.

4. Why the ‘Truth’ Defence Is Rarely Straightforward

Truth (or ‘justification’) is a complete defence to defamation in Australia. However, to succeed, the defendant must prove that the specific defamatory imputation conveyed by the publication is substantially true.

If the imputation conveyed by a post is that the person deliberately stole, the publisher must be able to prove dishonest intent — not merely that they left without paying. The failure to pay for an item does not establish criminal intent. Intent is a matter for law enforcement and courts, not CCTV footage reviewers.

Legal Principle

The imputation conveyed is not what the publisher intended to say — it is what the publication is reasonably capable of meaning. Commentary accompanying CCTV imagery can convey stronger imputations than the publisher realised, and ‘I only said what I saw’ is not a defence.

Additional defences — including honest opinion and qualified privilege — are unlikely to assist in circumstances where a business publishes allegations about an individual to a public or semi-public audience without any prior complaint or notification process.

5. Privacy Law and CCTV: What the Law Says in Australia

Beyond defamation, publishing CCTV images of identifiable individuals engages a separate and overlapping body of law.

5.1 The Privacy Act 1988 (Cth)

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to most healthcare providers regardless of size. APP 6 restricts the use and disclosure of personal information — including images — for purposes other than the primary purpose for which it was collected. CCTV footage is typically collected for security and incident management purposes. Publishing it on social media is not a permitted secondary use without consent.

5.2 State-Based Surveillance Legislation

Each Australian state and territory has surveillance device legislation that may independently regulate the capture and disclosure of images. In some jurisdictions, use of CCTV footage beyond lawful security purposes may attract civil or criminal liability.

5.3 OAIC Guidance

The Office of the Australian Information Commissioner (OAIC) provides detailed guidance on the collection, use, and disclosure of personal information, including images. Healthcare providers should be familiar with this guidance and ensure their CCTV policies are consistent with it.

6. AHPRA and Professional Conduct Obligations

For registered health practitioners — including medical practitioners, nurses, midwives, pharmacists, psychologists, physiotherapists, and others — the Australian Health Practitioner Regulation Agency (AHPRA) has published explicit social media guidance that applies to professional online conduct.

6.1 The AHPRA Social Media Policy

AHPRA’s Social Media Policy for Registered Health Practitioners makes clear that practitioners are expected to maintain professional standards in all online communications — including personal social media accounts. The policy specifically addresses:

Maintaining patient and third-party confidentiality;

Avoiding conduct that could bring the profession into disrepute;

Not making unsubstantiated claims or allegations;

Recognising that online conduct can be subject to formal notifications and investigations.

6.2 Notifiable Conduct and the National Law

Under the Health Practitioner Regulation National Law, conduct that is unprofessional, or that falls below the standard expected of a registered practitioner, can result in notifications, investigations, conditions, suspensions, or cancellation of registration. A social media post that generates a defamation claim, or that involves disclosure of a patient or third party’s information, could constitute grounds for a notification.

6.3 Higher Standard for Healthcare Providers

Healthcare providers are held to a higher standard of professional discretion than ordinary members of the public. The trust placed by patients and the community in healthcare providers creates obligations of confidentiality, fairness, and restraint — including in online conduct. A business decision to ‘warn’ the community via social media may be viewed very differently by a regulatory body assessing professional standards.

7. Professional Indemnity Insurance: Will Your Policy Respond?

This is a question that many healthcare providers assume they know the answer to — but the answer is frequently ‘no’, or at best ‘maybe’.

7.1 Intentional Acts Exclusions

Most professional indemnity policies contain exclusions for intentional or deliberate acts. A decision to post CCTV footage on social media is a deliberate act. Where the posting gives rise to a defamation claim, the insurer may argue — with justification — that cover does not respond to the legal costs or any settlement arising from that claim.

7.2 Staff Actions and Communication Protocols

Where a staff member — rather than the practice principal — makes the social media post, this does not necessarily resolve the coverage question. Vicarious liability may bring the practice into the claim. However, if the staff member acted outside any approved communication protocol, the insurer may dispute coverage on those grounds.

7.3 What to Do

Healthcare providers should:

Review their professional indemnity policy for exclusions relating to intentional acts, defamation, and social media;

Contact their broker or insurer before any online publication that could be construed as an allegation;

Implement formal social media and communications policies that all staff must follow;

Seek legal advice promptly upon receiving a Concerns Notice or any complaint related to an online post.

8. AI, Online Reputation and SEO Risks for Healthcare Providers

In 2025, the medico-legal risk of social media posts extends beyond traditional legal liability. AI-powered search tools — including Google’s AI Overviews, Bing Copilot, and dedicated healthcare review platforms — increasingly surface, summarise, and amplify online content about healthcare providers.

8.1 Algorithmic Amplification

A post about an individual that gains engagement — shares, comments, reactions — can be amplified algorithmically to audiences far beyond the original poster’s network. In a healthcare context, this can spread allegations to current and prospective patients, referrers, and other professionals.

8.2 AI Search and Reputation

AI-assisted search engines increasingly answer user queries by synthesising content from multiple sources. A defamatory or misleading post — even one that has been deleted — may be indexed and summarised by AI tools before deletion occurs. Healthcare providers should assume that anything posted online may become permanently discoverable.

8.3 Reverse Defamation Risk

The same social media environment that a practice might use to warn others can also be used against that practice. A person who receives an allegedly defamatory post may share it widely, leave negative reviews, or engage in coordinated online commentary. The initial poster’s conduct can catalyse a reputational crisis for the practice itself.

8.4 SEO and Google Business Profile

Negative content — including content about a practice’s social media conduct — can appear in Google search results for the practice’s name. Practices should proactively manage their Google Business Profile and monitor their online presence regularly. For guidance on managing online reputation in a healthcare context, see the Australian Medical Association (AMA) — Social Media Advice.

9. Practical Risk Management Checklist for Australian Medical Practices

If misconduct, theft, or another incident is suspected at your practice, the following risk management steps apply:

Step 1: Secure and Review Internally

Review CCTV footage internally, with only those who need to know.

Document observations contemporaneously, including time, date, and what is visible.

Do not share footage or still images with anyone outside the practice at this stage.

Step 2: Attempt Direct and Lawful Resolution

Make reasonable attempts to contact the person directly and allow them to respond.

Many incidents resolve at this stage — as in the case study above.

If the person cannot be contacted or denies the conduct, obtain legal advice.

Step 3: Follow Lawful Reporting Pathways

If theft or criminal conduct is suspected and direct resolution fails, the appropriate avenue is reporting to local police — not social media.

Provide footage and documentation to police if requested through lawful processes.

Do not publish or distribute footage pending police advice.

Step 4: Preserve Evidence Correctly

Back up CCTV footage securely with restricted access.

Note the retention period required by your state’s legislation and CCTV policy.

Document all steps taken in the incident record.

Step 5: Do Not Post on Social Media

This step should be listed as an absolute prohibition in your practice’s social media policy.

Remind all staff of the prohibition, particularly after incidents.

Even ‘private’ or ‘friends only’ posts carry legal risk.

Step 6: If You Have Already Posted

Remove the post immediately.

Do not add additional commentary.

Contact your insurer and legal adviser before responding to any complaint.

Preserve records of the original post and all communications received.

10. Frequently Asked Questions

Can I post CCTV images if I don’t identify the person by name?

This does not eliminate defamation risk. A person is ‘identified’ for defamation purposes if they are identifiable to those who know them — including by their image, location, or distinguishing features. An unnamed image is not automatically safe to publish.

What if I only post to a ‘closed’ Facebook group?

Closed groups are not private in the legal sense. Publication to any audience beyond the subject themselves constitutes publication for defamation purposes. The size of the audience may affect damages, but not liability.

What should I do if I receive a Concerns Notice?

Contact a defamation lawyer immediately. A Concerns Notice initiates a formal pre-litigation process under the uniform defamation legislation. Time limits apply. Early and appropriate legal advice can significantly affect outcomes and costs.

Does this apply to Google reviews or other platforms?

Yes. The same defamation principles apply to any online publication, including responses to Google reviews, healthcare review platforms, and social media platforms generally. Responding to a negative review with statements about the reviewer that convey defamatory imputations carries the same risks.

Are there any circumstances where posting is lawful?

Publishing a police-issued wanted notice or engaging in lawful assistance to law enforcement may attract different considerations. However, independently publishing CCTV content — even with genuine belief in its accuracy — should not occur without legal advice.

11. Further Reading and Authoritative Resources

The following authoritative sources provide further guidance on the topics covered in this article:

Defamation Law