An informed consent form for counselling in Australia is a written record that a client voluntarily agreed to the service, after being told what it involves, what it costs, how their information will be handled and when confidentiality can be broken. It discharges two separate duties: consent to the service, and consent to information handling.
Most consent templates you can download were written for United States practices, so they are built around HIPAA and insurance authorisation. Neither applies here. The Australian requirements sit in two places: the Psychology Board of Australia's Code of conduct for psychologists, in force from 1 December 2025, and the Privacy Act's Australian Privacy Principles. They ask for things no imported template contains.
What is an informed consent form for counselling?
The Code defines informed consent as "a person's voluntary decision about accessing services that is made with knowledge and understanding of the benefits and risks involved". The form is not the consent. The conversation is the consent, and the form is your evidence that the conversation happened and what it covered.
That distinction matters when a complaint or a subpoena arrives years later. A signature on an unread page proves very little. A form that records what was explained, when, and what the client agreed to is a far stronger record, and section 3.3(b) of the Code asks you to "formally document the outcome of the consent and/or agreement process when possible".
Is a signed consent form legally required in Australia?
Not in the way most practitioners assume. The Code requires you to "document consent appropriately", and it names only one situation where written consent is specified: assessments or procedures that involve physical contact with clients. For talk therapy, documented consent is the standard, and a signed form is one good way to meet it, not the only way.
Privacy law pushes harder in the same direction. Health information is sensitive information, and the Office of the Australian Information Commissioner advises that an entity "should generally seek express consent from an individual before handling the individual's sensitive information, given the greater privacy impact this could have". Express consent means given explicitly, in writing or orally. A written form is simply the version you can still prove in three years.
What must an Australian counselling consent form include?
Three layers stack up. From section 4.2 of the Code: what the service involves, its material risks and expected outcomes, and financial consent covering the cost of all required services, agreed before the service starts. From section 3.3(a): how information will be recorded, stored and used, the limits of confidentiality, and consent before any disclosure.
The third layer is the privacy collection notice under APP 5, which must be given at or before the time you collect information. It covers your identity and contact details, why you are collecting the information, what happens if the client does not provide it, who you usually disclose to, where your privacy policy sits, and whether information goes to overseas recipients and which countries. Practically, this is the section clinicians most often leave out.
How should you explain the limits of confidentiality?
Section 3.3(a)(i) sets the timing: clients "should be adequately informed about the limits of confidentiality and likely uses of the information" at the beginning of a service, and afterwards as necessary. So this belongs on the form, not in a passing remark at intake.
Write the limits in the terms that actually apply in Australia, not the Tarasoff framing imported templates use. That means the serious threat ground, mandatory reporting obligations in your state or territory, court orders and subpoenas, and disclosures the client themselves authorises. Our guide to when a psychologist can break confidentiality sets out each ground and the tests attached to it. Keep the wording plain enough that a distressed person reads it and understands what they are agreeing to.
Does an informed consent form expire?
This is where nearly every downloaded template fails, and two separate instruments agree on it. The Code requires you to "inform clients of the period for which consent will be relied on in the absence of significant changes", and then to revisit consent when that period has passed or the service has materially changed.
The privacy guidance says the same thing from the other side: "Consent given at a particular time in particular circumstances cannot be assumed to endure indefinitely." So an Australian consent form needs a stated review period on its face. A form signed in a first session and never revisited is not evidence of current consent, it is evidence of consent as at that date. A significant change, moving to telehealth, adding a third-party report, or shifting from individual to conjoint work, restarts the conversation.
Why avoid one big "I agree to everything" tickbox?
Because bundling can undermine the voluntariness that makes consent valid at all. The OAIC's guidance on consent states that bundled consent "has the potential to undermine the voluntary nature of the consent", and warns against seeking a broader consent than is necessary, such as consent for undefined future uses or to "all legitimate uses or disclosures".
The fix is cheap. Separate the consents a client can genuinely decline without losing the service: contact by SMS, recording sessions for supervision, sharing a summary with a referring GP, appearing in de-identified teaching material. Each gets its own line and its own tick. The Code adds a matching duty, to tell clients they may withdraw consent at any time and to discuss what withdrawal would mean.
How does consent work with children and young people?
The Code does not set an age. It asks you to act according to the client's "capacity for decision-making and consent, including when providing services to children and young people, based on their maturity and capacity to understand, and the nature of the proposed service", and then to consider whether a parent, carer, guardian or substitute decision-maker also needs to consent.
That is a judgement you make and record, per client, not a birthday you look up. Privacy guidance treats capacity the same way: an individual must be "capable of understanding the nature of a consent decision", and age, disability, temporary incapacity or limited English can all affect it. Where a young person has capacity, the harder question is usually what the parent will and will not be told, so decide that at the outset and write it into the form both parties sign.
Do sole traders and small practices have to comply?
Yes, and this catches people out. Businesses turning over $3 million or less are generally exempt from the Privacy Act as small business operators, but providing a health service and holding health information is an express exception to that exemption. The OAIC puts it plainly: "The Privacy Act generally applies to all organisations that provide a health service, including an organisation that is a small business."
Counselling meets the definition of a health service, which covers activities intended to assess, maintain or improve a person's health or to treat an illness. So a solo counsellor in a rented room is covered on day one. Note too that health information is broader than your case notes: appointment and billing details count as well.
How should consent be recorded and stored?
Attach the executed form to the client record rather than filing it separately, so that anyone reviewing the file can see the scope and date of consent alongside the notes it authorised. Record the date, what was explained, the stated review period, and each separate consent given or declined.
Then diarise the review. A consent that expires quietly is the failure mode here, and it is a scheduling problem more than a clinical one. PractaLuma is AI-native practice management software for Australian mental-health practices, and keeps consent documents, client records and clinical notes in one file so the consent status is visible where the clinical work happens. Retention rules apply to consent forms as they do to notes, so check how long to keep clinical records.
Frequently asked questions
Can a client give consent verbally? Yes, express consent can be oral or written. But you still have to document the outcome of the consent process, and for sensitive health information express consent is the expectation, so a written record is the safer default.
Do I need a new form for each new issue a client brings? Not automatically. You revisit consent when the period you nominated has passed, or when there is a significant change to the service or the service relationship. A new presenting issue treated the same way usually is not one, a shift to conjoint work or a third-party report is.
Does a consent form cover releasing records to a third party? Only if it says so specifically. Before disclosing, clients must be adequately informed about the nature and purpose of that disclosure, so a broad blanket authorisation is weak. Use a separate, purpose-specific release each time.
What should the form say about my intake questionnaire? The privacy collection notice must be given at or before collection, so if intake forms are sent ahead of the first session, the notice needs to reach the client with them. See our guide to the psychology intake assessment for how the two documents fit together.
This article is general information about professional and privacy obligations, not legal advice. Requirements vary by state and territory and by registration status. Check your own regulator's current code and seek advice for your practice.