All organisations that provide a health service and hold health information are covered by the Privacy Act 1988 (Privacy Act), whether or not they are a small business and even if providing a health service is not their primary activity.