An AHPRA advertising complaint is filed as a criminal offence report, and it almost never ends the way clinic owners fear. AHPRA says most cases start with a letter telling the advertiser their advertising breaches the National Law and requiring it to be corrected within 30 days, and that in most cases the matter is closed once it is corrected. The part nobody warns you about is who counts as the advertiser. Whoever authorises the content is on the hook, which can be the practitioner, the practice company and the agency all at once.
Why does an advertising complaint go in on a criminal offences form?
Because unlawful health advertising is a criminal offence, not a conduct issue.
Practice owners hear "AHPRA complaint" and picture the notifications process. That is the stream for concerns about a practitioner's health, conduct or performance. Advertising sits somewhere else entirely. AHPRA's page on making an advertising complaint says it plainly: breaches of the advertising requirements are criminal offences, and to complain about advertising you complete the criminal offences form.
That sounds much worse than it is. The same page immediately adds that breaches assessed as a low or medium risk to the public may be managed by an administrative process, rather than through a court process.
So the door is marked criminal offence. The room behind it is mostly correspondence. Both halves of that are worth knowing, and most clinic owners have only ever been told one.
What does AHPRA actually do with the complaint?
Three steps, in a fixed order: review, assess, then act.
AHPRA sets the whole sequence out on its how we manage advertising complaints page. It says it reviews all complaints received about advertising.
Review. AHPRA checks whether the complaint relates to advertising about a regulated health service, identifies any unlawful advertising, and identifies who the advertiser is. That last one is the step everybody skips reading, and it is the one that decides your year. If the complaint does not carry enough information, AHPRA will try to contact the complainant. If it cannot, it may close the matter there.
Assess. AHPRA runs a risk assessment on the breaches it found. It says that as part of that assessment it will consider previous complaints made about the advertiser and whether they have a history of non-compliant advertising. A first letter and a fourth letter are not the same event.
Action. Here is the sentence to remember. AHPRA says most cases start with it writing to the advertiser to let them know their advertising breaches the National Law, and requiring them to correct it within 30 days. It provides education resources with the letter. And in most cases, if the advertiser corrects the advertising, AHPRA closes the matter.
One more thing happens quietly at this stage. AHPRA says that if a complaint may be of interest to another regulator, such as the Therapeutic Goods Administration or the ACCC, it may refer the matter on. A page about a prescription medicine can therefore become a TGA problem after AHPRA has finished with it.
Who counts as the advertiser?
Whoever authorises the content. Not whoever owns the website, and not whoever pressed publish.
This is the single most useful line in Australian health advertising regulation, and it sits buried in AHPRA's advertising compliance and enforcement strategy. The strategy says the person or entity who controls part or all of the advertising, meaning who authorises the content, is considered the advertiser and is responsible for compliance with the advertising requirements. It then adds seven words that end most arguments: advertisers must check any content developed by others on their behalf.
Read it twice. It does not say the registered practitioner is the advertiser. It says control is the test. So a single homepage can have three advertisers at once: the practitioner whose name is on it, the company that trades the clinic, and the agency that wrote and approved the claims.
Section 133(2) of the National Law says a person does not commit the advertising offence merely because that person, as part of their business, prints or publishes an advertisement for another person. A printer is safe. A platform is safe. An agency that was handed finished copy and put it live is arguably inside that carve-out. An agency that wrote the claim is not printing somebody else's advertisement. It is authoring one.
Does reporting your marketing agency move the liability off you?
No. It can add a second advertiser without subtracting the first.
Practice owners who discover a breach often want to establish, on the record, that the agency wrote it. That instinct is reasonable and it is worth documenting. It is not a defence. If you authorised the page, you controlled the advertising, and AHPRA's strategy says advertisers must check content developed by others on their behalf. Signing off unread is still signing off.
What the report can do is put a second, quite differently exposed party in front of the regulator. And the two of you go through different doors.
AHPRA says that where the advertiser is a registered practitioner and the advertising is not corrected as requested, it may propose to impose conditions on their registration prohibiting advertising. Where the advertiser is not a registered practitioner, it says it may prosecute if they fail to correct the advertising.
That asymmetry is the piece the industry never mentions. Registration is not only a liability. It is also the reason AHPRA has a proportionate lever to pull before court. An unregistered marketing company has no registration to condition, so the escalation path available against it is the one that ends in a prosecution.
When does a letter turn into something worse?
When you do not fix it, when you have form, or when the breach was serious from the start.
The strategy is explicit about all three, and it tiers them.
- Low risk, first time. AHPRA writes to say the advertising is non-compliant, supplies resources, gives a timeframe, and says how compliance will be checked, such as an audit.
- Low risk, with history. The strategy says matters assessed as low risk where the advertiser has a history of non-compliant advertising will be managed under the medium-risk process instead. Your record changes the tier, not just the tone.
- Medium risk or repeat. Letter first, then compliance checked by targeted audits. If a practitioner has not corrected the advertising, or has a history including low-risk breaches, they receive a show cause letter proposing conditions on their registration restricting their ability to advertise, plus a further timeframe.
- Conditions imposed. Before conditions come off, the practitioner must demonstrate their understanding of the advertising requirements. Continued non-compliance after conditions may result in referral to a tribunal.
- High risk. The strategy says certain high-risk matters will be identified as suitable for prosecution or disciplinary action from the outset. There is no warning letter stage for these.
And one line that cuts across the whole ladder. AHPRA says very serious breaches which placed the public at significant risk of harm may be subject to prosecution even if the advertising is corrected. Deleting the page is not a reset button for everything.
What are the real penalties in 2026?
$60,000 per offence for an individual. $120,000 per offence for a body corporate.
Those are the current maximums in section 133 of the Health Practitioner Regulation National Law, as consolidated in Queensland and current as at 10 April 2026. Western Australia did not adopt the increase, so different penalties apply there.
Now the awkward part, and it matters if you are checking this yourself. AHPRA's enforcement strategy document still prints the old maximums of $5,000 for an individual and $10,000 for a body corporate. It is not an error so much as an artefact: that strategy took effect on 14 December 2020, the penalties were raised by a 2022 amendment, and AHPRA's own page carries a note saying the strategy will be updated when it is next reviewed.
So a practice owner who reads the strategy and stops there walks away with a figure that is twelve times too small. Read the legislation for the number, and the strategy for the process.
Current maximums from the Queensland consolidation of the National Law, current as at 10 April 2026. The lower pair are the pre-2022 maximums, which AHPRA's advertising compliance and enforcement strategy still carries because the strategy has not been rewritten since 14 December 2020. Western Australia did not adopt the increase.
One further wrinkle on the arithmetic. AHPRA notes that while those maximums apply to one-off instances, ongoing breaches may be treated as separate offences. A claim repeated across a homepage, six service pages and a booking page is not obviously one thing.
What should you do the day the letter arrives?
Treat the 30 days as the whole game, because on AHPRA's own account it usually is.
- Read what was actually flagged. The letter names the advertising. Fix that first, before anyone debates whether the rule is fair.
- Sweep for the same wording everywhere else. If the flagged claim appears on five other pages, on your Google Business Profile and in a booking confirmation email, correcting only the named page leaves the pattern intact. AHPRA checks compliance, sometimes by audit.
- Work out who authorised it. Not to assign blame, but because that answers who the advertiser is, and there may be more than one.
- Write down the fix and the date. Your history is an input to the next risk assessment. Being able to show a clean, dated correction is worth having.
- Change the approval step, not just the sentence. A breach that came through an agency will come back through the same agency unless somebody starts checking copy before it goes live.
The uncomfortable truth in all of this is that the regulator is not the aggressive party in the story. AHPRA's stated default is a letter and a month. What turns a letter into conditions on a registration is usually not the original breach. It is a practice that fixed one page, left the claim living everywhere else, and got a second complaint.
This article explains a regulatory process. It is general information, not legal advice. If you have received correspondence from AHPRA, get advice from your professional indemnity insurer or a health law practitioner.
Frequently Asked Questions
Do you know what your published copy is already claiming?
My GhostRank audit checks your site, socials and ad copy against the AHPRA and TGA advertising rules, Google ranking factors and AI search visibility in one report, with evidence for every flag. You get the list of what breaches, who authorised it, and exactly what to publish instead.
Book a GhostRank audit
Amisha Sharma
Amisha Sharma writes compliance checked healthcare copy for Australian practices and agencies. She built GhostRank, the 226 check audit engine, and every piece she ships carries its evidence report.
Your daily dose of copy, compliance, and chaos
Short, sharp takes on writing that ranks and stays legal. Delivered to your inbox.