# Is your clinic software compliant? Queensland is auditing and NSW's new injectables law starts 5 November

> Queensland is auditing clinics now and NSW's new injectables law starts 5 November 2026. Does your clinic software enable compliance, or just tolerate it?

- Published: 12 September 2026
- Updated: 12 September 2026
- Author: DappleOS HQ
- Topics: Product
- Canonical: https://news.dappleos.com/articles/is-your-clinic-software-compliant-nsw-qld-injectables-2026

![A clinician sits across a consulting table from a client in a calm treatment room, showing her a digital consultation record and treatment plan on a tablet while holding a stylus.](https://news.dappleos.com/cdn-cgi/image/format=auto,quality=90,fit=scale-down,width=1600,onerror=redirect/media/articles/media/b6ee9152877ec4111da339bb274c98b7f2f07b2ca80b5f4c9ac7969e5cc6f81d.jpg)

If a health department inspector walked into your clinic today and asked for the complete record of an injectable treatment you performed six months ago, could your team produce it in five minutes?

Not "most of it". All of it. The prescription or written direction. The date the prescriber personally reviewed the patient. The signed consent. The treatment note. The batch number of the vial. The drug book entry showing which prescriber bought that vial, where it was stored and where the rest of it went. The aftercare you sent.

And the harder question: would every one of those records agree with each other?

Now ask the question almost no clinic has asked. Not "is my team compliant?" but **"is my clinic software compliant?"** Because if your booking system lets a clinician save an injectable treatment with no script attached, no batch number, no consent on file and no drug book entry, then your software is not neutral. It has quietly made non-compliance the default, and your team has been covering for it by hand. Every day. And one missed day is all an inspector needs.

Most clinic software in Australia was built for salons, spas or general practice, not for cosmetic medicine. It stores notes. It was never designed around a prescriber, a patient-specific script that expires, or a vial that has to be accounted for from purchase to disposal. Software that cannot tell a clinician "there is no valid script for this patient" is not a compliance tool. It is a diary.

**Want to check where you stand before someone else does?** We have built a free injectables compliance checklist, drawn from the Queensland guidance, NSW Part 9 and the 2025 Ahpra cosmetic guidelines. [Download the injectables compliance checklist](#resource-access), pick one injectable treatment from six months ago and tick every line using only the records you can find. Anything you cannot tick, or can only tick after a phone call, is the gap an inspector finds first.

In Queensland, that inspection is already happening. Queensland Health has been inspecting and auditing cosmetic clinics since it clarified the rules in 2025. In New South Wales, the inspection gets a new rulebook on **5 November 2026**, when cosmetic injectables get their own part of the state's medicines law for the first time. If you own, prescribe for or inject in a clinic in either state, the question is no longer whether you will be asked to prove compliance. It is whether the system you rely on can.

## Queensland: the rules did not change. Enforcement did

Queensland did not pass a new law. In December 2024, and again in April 2025, Queensland Health published guidance spelling out what the Medicines and Poisons Act had required all along, after "routine compliance activities" showed clinics were getting it wrong.

The clarifications were blunt, and they still apply to every Queensland clinic today:

- **Registered nurses cannot buy or hold Schedule 4 injectables as stock.** Only a doctor or nurse practitioner can, and they must keep exclusive custody and control of it. Putting a purchase order through an app or website on a doctor's behalf counts as buying.
- **Every patient needs their own prescription**, written after the prescriber has assessed that patient. Standing orders cannot be used.
- **A remote doctor cannot order stock into a nurse-led clinic.** That is an unlawful supply, contract or no contract.
- **There are two lawful models**: medicine dispensed per patient by a pharmacist and administered from the dispensing label, or stock held on site by a doctor or nurse practitioner who is present and in control.
- **Advertising Schedule 4 injectables to the public is not permitted.**

Clinics that had run on informal arrangements for years suddenly had no lawful model. Some closed. Nurses protested outside Parliament. In January 2026 a Queensland nurse had their registration cancelled for injecting without a prescription and falsifying records. Queensland Health says it educates first, but inspections and audits are how the problem was found, and they have not stopped.

We covered the practical side at the time in [how digital systems support Schedule 4 compliance in Queensland](/articles/how-digital-systems-support-schedule-4-compliance-in-qld). Eighteen months on, most Queensland clinics have a lawful model on paper. Fewer can prove, vial by vial, that they are following it.

**Queensland clinic still running a paper drug book and a separate prescriber platform?** [Download the checklist](#resource-access) and work through the Queensland sections, or [book a free compliance gap review](https://dappleos.com/sales-call) and we will show you, vial by vial, what Queensland Health would see.

## New South Wales: a new law from 5 November

New South Wales is replacing the Poisons and Therapeutic Goods Act 1966 with the Medicines, Poisons and Therapeutic Goods Act 2022 and a new 2026 Regulation. Part 9 of the Regulation covers eight Schedule 4 "cosmetic use substances", including botulinum toxins, hyaluronic acid fillers, calcium hydroxylapatite, polylactic acid and deoxycholic acid.

In plain terms, from 5 November:

- **Unless the injector is a doctor or nurse practitioner, only a nurse acting under a direction may administer.** The direction must come from a medical practitioner or nurse practitioner who has personally reviewed the patient, in person or by video. A phone call or a text is not a review.
- **Directions must be written, signed and time-limited.** A written direction lasts no more than six months from the date of the review. It must name the patient, the prescriber, the premises, the substance, the treatment area, the quantity and how many times it may be given.
- **Every administration needs a written record.** The nurse must record their name, the date, the batch number and the details of the direction, and give a copy to the prescriber and to the business. The business must keep every direction and every record.
- **Product provenance is now everyone's problem.** Both the prescriber and the nurse must be satisfied the product is on the Australian Register of Therapeutic Goods or otherwise lawfully supplied. If you cannot show where a vial came from, that is your risk.
- **The business carries its own duties.** Risk management policies, emergency equipment, emergency training for every injecting nurse and compliant storage are legal obligations on the "responsible provider", not just on the clinicians.

The penalties come in two categories:

- **Category 1** (administering without a direction, directing without a personal review, failing the business duties): up to 200 penalty units or six months' imprisonment for an individual, and 1,000 penalty units for a corporation. At the current NSW penalty unit, that is $22,000 and $110,000.
- **Category 2** (record-keeping, direction content and storage): 50 penalty units for an individual and 250 for a corporation, or $5,500 and $27,500.

The Act also introduces compliance notices and on-the-spot penalty notices, so an inspector does not need a court to fine you.

**Want Part 9 mapped against your current software before 5 November?** [Download the injectables compliance checklist](#resource-access) and run it over your own records, or [book a free compliance gap review](https://dappleos.com/sales-call). Your system, our checklist, no obligation.

## This is not just a nurse problem

Most of the coverage has been written for nurses. Read the rules again and count who else is named.

- **Prescribers.** In NSW the doctor or nurse practitioner must personally review the patient, give the direction in writing, sign it, limit it to six months, keep a copy and hand a copy to the business. Directing without a personal review is a category 1 offence against the prescriber, not the nurse. In Queensland the doctor or nurse practitioner is the only person who may buy and hold the stock, and custody and control sits with them personally. The Medical Board's own cosmetic guidelines apply to doctors on top of all of that.
- **Clinic owners.** NSW calls the business the "responsible provider" and gives it its own duties: risk management policies, emergency equipment, emergency training for every injecting nurse, compliant storage, and keeping every direction and every administration record. The corporate penalties, up to 1,000 penalty units, are written for the owner, whether or not they hold a clinical registration.
- **Doctors who inject their own patients.** Part 9 does not apply to a doctor or nurse practitioner treating their own patient, but everything else does: the Ahpra and Medical Board consultation and consent requirements, the TGA's provenance and advertising rules, and the record-keeping that proves it.

If you own the clinic, prescribe for it, or inject in it, the regulator has a paragraph with your name on it. And if you are a doctor prescribing for a clinic whose software cannot show you what was administered under your direction, with which batch, on which date, you are carrying category 1 exposure for records you have never seen.

**Prescribing for a clinic you cannot see into, or owning one you cannot audit?** [Talk to our team](https://dappleos.com/sales-call) about the prescriber and owner views in DappleOS, where every direction you sign and every vial bought in your name is one screen away.

## Both states, the same test: does your software pass it?

Underneath the state rules sit the Ahpra cosmetic procedure guidelines that took effect on 2 September 2025. They already require a real-time consultation for every script, written and verbal consent, and a seven-day cooling-off period for anyone under 18. Through 2025 and 2026 the TGA has issued infringement notices to injectors in NSW, Queensland and Victoria for importing unapproved botulinum toxin. None of this is theoretical any more.

Most clinics we speak to believe they are compliant. Most of them are relying on people, not systems. The prescription lives in one platform, consent in a form builder, the treatment note in another, the drug book in a paper ledger or a spreadsheet, and aftercare in someone's memory. Each piece of software is doing its job. None of them is doing the compliance job, because none of them was built for it.

So put the software on trial. Does your clinic software:

- Show the clinician, before drawing up, that there is a current prescription or signed direction for this patient, and when it expires? Or does it let them treat without one?
- Show whether consent is current in the treatment record, and expire it? Or is the only consent a form signed 14 months ago that nobody has looked at since?
- Capture the patient's consent to the price, and to their photos, and hold both against the treatment?
- Put the batch number and expiry on the note and in the drug book, linked to the patient, from a scan? Or is that on a sticker that will be thrown out with the vial?
- Record which prescriber bought each vial and where it is stored, and stop stock being held in a nurse's own name?
- Write the drug book entry at the point of treatment, by the clinician who did the treatment? Or is your drug book reconstructed on Friday afternoon?
- Send aftercare and record that it was sent, with a timestamp?
- Keep every version of a note, so that if one was changed you can show what it said before, who changed it and when? Or can a note simply be edited?

If the answer to any of those is "no", or "I would have to check", your software does not enable compliance. It tolerates it. The gap between "we do the right thing" and "our system can prove we did the right thing" is exactly where the fines live. That was the Queensland lesson. Most clinics were not caught harming patients. They were caught unable to show a lawful chain from prescriber to patient, because nothing they used had ever been designed to hold one.

Those eight questions are the short version. [Download the injectables compliance checklist](#resource-access) for the long one, line by line, and mark your own software against it.

**Not sure your software would pass?** [Book a free compliance gap review](https://dappleos.com/sales-call) with our team. We map how your current system handles prescribing, consent, notes, medicine tracking and aftercare against the Queensland guidance and NSW Part 9, and show you exactly what an inspector would find.

## Compliance has to be built into the workflow, not bolted onto the end of the day

This is what DappleOS was built for. It is purpose-built for aesthetic medicine, and every record the regulators ask for is created as a by-product of treating the patient, in one system, rather than as a separate job afterwards.

We did not build DappleOS to meet today's guidance. We built it to enable compliance as a way of working, which means it already goes further than either state currently asks. When the next clarification lands, and Queensland showed there will be a next one, clinics on DappleOS change a setting, not a system.

**You keep your own prescriber. DappleOS puts them inside the workflow.** DappleOS does not sit between you and a doctor. Your medical director, prescribing doctor or nurse practitioner stays yours. What changes is that their review, their script and their custody of stock are recorded in the same system your clinicians treat from, so the chain from prescriber to patient is visible instead of assumed.

**Built-in injectable scripting.** Clinicians request a script from inside DappleOS. Your prescriber reviews the patient by video, approves the script in writing with a validity period, and it is recorded against the patient with the prescriber's name and date. Only doctors and nurse practitioners can issue scripts. In the treatment note, each treatment shows a green "Valid Script" or red "Requires Script" badge before the clinician begins. For NSW patients, DappleOS defaults new scripts to six months' validity to match the new rule.

**Doctors treating their own patients are covered too.** A prescriber can issue a script for a patient they are treating themselves, and can issue a valid script for the clinicians in their clinic to treat that patient. Every telehealth script ever issued can be pulled up in DappleOS at any time, by patient, by prescriber or from the scripting queue, so a six-month-old script is one search away rather than one email thread away. Scripts also connect to treatment planning: a script can be linked to the patient's treatment plan, so the plan and the script stay in step and the clinician sees both from the same place.

**Custody and control, by role.** Schedule 4 products in DappleOS are ordered and received by prescribers, and the prescriber's details are attached to every purchase order and batch record. Clinicians administer under a valid script. Administrative users can view records without changing them. DappleOS supports both Queensland models: pharmacy-dispensed, per-patient supply and prescriber-held clinic stock.

**Automatic consenting.** Consent forms are attached to the treatment, not the appointment. They can be sent automatically at booking, and completed in the patient app before the visit or on the clinic iPad in the room. Each form expires on the interval you set, down to per-visit consent, and shows as outstanding again until it is re-signed. The treatment record shows whether consent is current.

**Decision support at the point of treatment.** Every time a clinician opens a treatment in DappleOS, the note tells them, before they start, whether there is a valid script for it, whether consent is current, whether the photos the treatment requires have been taken, and whether the new patient form has been completed. Nothing has to be remembered or looked up in another system. Clinics can also turn on a consent gate so that a script cannot be requested or approved while the patient's consent is outstanding, which means a prescriber is never directing treatment for a patient who has not consented to it. If the consent status cannot be confirmed, the gate stays closed.

**Informed financial consent and photo consent.** Consent in DappleOS is not one signature. Forms can include an informed financial consent block that is prepared from the treatment note, itemising the treatments and prices the patient is agreeing to before they are treated. Photo consent and marketing-use consent are captured separately on the patient record, and any change to them is audited.

**A digital drug book that writes itself.** During treatment the clinician scans the vial barcode. When the note is saved, DappleOS creates the Schedule 4 drug book entry automatically, linking patient, product, batch, expiry, quantity used, location, the user who recorded it and the time. Receipts, transfers, write-offs and stocktakes post their own entries. The ledger is append-only: nothing is edited or deleted, and a correction is a new entry, not a change to an old one. Expiring stock is flagged before it is drawn up. You can read more in [tracking S4 stock with certainty](/articles/tracking-s4-stock). Where the digital record meets your record-keeping requirements, there is no need to keep a duplicate paper drug book.

**Product provenance on every record.** When a product is marked as Schedule 4 in DappleOS it is linked to its ARTG ID and TGA product name, and every vial of it carries a unique barcode with batch and expiry. NSW now requires both the prescriber and the nurse to be satisfied a product is on the Australian Register of Therapeutic Goods before it is directed or administered, and the TGA is fining injectors who cannot show where their product came from. In DappleOS that evidence is on the product, the vial and the treatment note, not in a supplier email someone has to find.

**Notes that lock, with full version history.** A treatment note closes for editing after the day of treatment. Every save is stored as a separate encrypted version, so if a note was amended you can show what it said before, who changed it and when. Nothing is overwritten.

**A full audit trail for medicines.** Every drug book entry carries who created it and when. Changes to products, Schedule 4 settings, users and permissions are logged with the value before and after. Consent changes on the patient record are audited. When an inspector asks who did what, the answer is a query, not a reconstruction.

**Aftercare that is sent and recorded.** Aftercare instructions belong to the treatment. When the note is saved, DappleOS sends them to the patient automatically by email, SMS or in-app message and records the message against the patient, so "we told them what to watch for" has a timestamp.

**Australian, and hosted in Australia.** DappleOS is built in Australia for Australian regulation, and your patient records, notes, scripts and drug book are stored in Australia. The platform is designed around Ahpra, Medical Board and Nursing and Midwifery Board guidance and TGA requirements, with the state medicines rules layered on top, so the record you keep is the record an Australian regulator expects to see.

**Because it is one system,** your prescriber, your clinicians and the clinic owner are all looking at the same record. NSW says the nurse must give a copy of every administration record to the prescriber and to the business. In DappleOS that copy already exists, because all three are reading the same note. The direction, the consent, the note, the batch and the aftercare cannot disagree with each other, because they were never separate documents.

That is how the [Juv'ae network runs its clinics on DappleOS](/articles/juvae-and-dappleos-launch-juvae360), and why we wrote in 2025 that [compliance is the new differentiator](/articles/compliance-is-the-new-differentiator). Queensland proved it. The clinics that came through were not the ones with the best lawyers. They were the ones that could put a complete, consistent record in front of an inspector in minutes and get back to work.

**Rather see it than read about it?** [Watch the treatment notes demo](https://dappleos.com/demos) and count how many of the records above are created before the clinician leaves the room.

## Five things to have in place before an inspector asks

Whether you are in Brisbane or Sydney, and whichever software you use, these are the minimum:

1. **A named prescriber for every vial.** Stock bought, received and controlled by a doctor or nurse practitioner, with a record that proves it.
2. **A current, patient-specific prescription or direction for every treatment**, based on a real-time review, with a validity date the clinician can see before drawing up. In NSW, no more than six months.
3. **Batch, expiry and ARTG registration on every treatment record and every drug book entry**, linked to the patient, entered at the point of treatment.
4. **Consent that is current, not just signed once**, including financial and photo consent, visible in the treatment record.
5. **Records the prescriber, the clinician and the business can all produce**, unchanged, on demand, with aftercare included.

[The injectables compliance checklist](#resource-access) breaks those five into the individual lines an inspector reads, across prescribing, custody of stock, the drug book, consent and aftercare, with a column for what your current software does. It is free, and it names which state each line comes from.

If your current software needs a person to remember any of those five, it is not a compliance system. It is a habit, and habits are what break under inspection. Ask your software vendor which of the five it enforces. If the answer is a training document, you have your answer.

**Ask us the same question.** DappleOS builds all five into the workflow, not into a training document. [Book a free compliance gap review](https://dappleos.com/sales-call) and we will show you where, in your own clinic's terms.

## Talk to us before November

Queensland clinics are already being asked. NSW clinics have until 5 November. Between now and then there is enough time to move a clinic onto DappleOS and have every injectable treatment documented the way the law now requires, with your own prescriber in the loop. It is not enough time to keep patching a paper drug book, a stack of PDFs and three logins together and hope nobody asks. And whatever the next clampdown looks like, a clinic whose records are already complete, linked and unchangeable has nothing to rebuild.

Start by [downloading the injectables compliance checklist](#resource-access) and see how many lines you can tick today. Then [book a free compliance gap review](https://dappleos.com/sales-call) and we will show you where the gaps are and how DappleOS closes them. If you would rather see it first, [watch the feature demos](https://dappleos.com/demos), starting with treatment notes.

_Important: this article is general information, not legal advice. Regulations vary by state and change over time. Always refer to the Medicines and Poisons Act 2019 (Qld), the Medicines, Poisons and Therapeutic Goods Act 2022 (NSW) and its 2026 Regulation, your state's medicines and poisons legislation and current Ahpra and Board guidance._