Healthcare Cyber Security Compliance & Knowledge Centre
Official guidance for Australian GP clinics, medical centres, specialist practices and allied health providers, collected from the Australian Digital Health Agency, the OAIC, the RACGP and the Australian Cyber Security Centre.
Is your practice meeting its patient information security responsibilities? Using third-party clinical software, cloud records or an outsourced IT provider does not remove your duty to protect patient data. Start with the topic that matches your question.
Regulatory content last reviewed 24 October 2026. Links last checked 19 October 2026.
Protecting Patient Information, Regardless of Your Clinical Software
Every medical centre has a responsibility to protect sensitive patient information, regardless of the software, systems or technology it uses. Whether your practice uses Best Practice, MedicalDirector, Zedmed, cloud-based clinical applications, locally hosted servers or paper-based patient records, cybersecurity and privacy protection are essential.
Read the legal detail
In Australia, private health service providers are generally expected to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access (Privacy Act 1988, Australian Privacy Principle 11), and to respond to eligible data breaches under the Notifiable Data Breaches scheme.
- Applies to
- Every practice that holds patient information
- Privacy law
- Privacy Act 1988, APP 11 and Notifiable Data Breaches scheme
- If you use My Health Record
- Additional rules apply, with revised requirements for existing participants from 1 October 2026
Core Cybersecurity Safeguards for Any Healthcare Provider
Regardless of the software you use, these are the areas we review when assessing how well patient data is protected:
- 01
Access Control
Give each staff member their own login, limit access to what their role needs and remove access promptly when people leave.
- 02
Strong Authentication
Use multi-factor authentication on email, remote access, cloud services and clinical or practice management systems where supported.
- 03
Data Protection and Backups
Protect patient data with measures such as encryption and regular, tested backups that are kept separate from your main systems.
- 04
Patching and System Security
Keep operating systems, clinical software, networks and devices updated, and monitor them for suspicious activity.
- 05
Software and Supplier Review
Understand where your clinical, billing and cloud software stores patient data and how your suppliers protect it.
- 06
Staff Security Awareness
Train your team to spot phishing and unsafe handling of patient information, on induction and regularly after that.
- 07
Incident and Breach Response
Keep a documented response plan and breach register so your team knows what to do, and when to notify, if something goes wrong.
Related assessments: Healthcare Cyber Security Assessment · Free Cyber Security Score
Which Requirements Apply to Your Practice?
Many practices keep patient records in their own clinical software, such as Best Practice, MedicalDirector or Zedmed, and never use My Health Record. Others participate. The core duty to protect patient data applies either way; the My Health Record rules apply on top for participants.
Privacy law and clinical information security still apply
- Privacy Act 1988 and APP 11: reasonable steps to protect patient information
- Notifiable Data Breaches scheme
- RACGP accreditation standards on information security, where your practice is accredited
- Pathology and diagnostic imaging services have separate My Health Record upload obligations from 1 July 2026, so not using the system does not automatically exempt them
Everything on the left, plus the My Health Records Rules 2026
- A documented, auditable Security and Access Policy (Rule 21)
- User access management and staff security training
- Technical security measures, monitoring and risk management
- Revised requirements for existing participants from 1 October 2026
Related assessments: Privacy Act APP 11 Security Assessment
Legal Duties, Accreditation and Voluntary Frameworks
These are different things, and which ones apply depends on your practice. Security assessments, vulnerability assessments and recognised frameworks help you evaluate and improve your safeguards; most frameworks are not mandatory for every private medical practice.
Apply according to your role and location
- Privacy Act 1988 and the Australian Privacy Principles, including APP 11 (reasonable steps to protect personal information)
- Notifiable Data Breaches scheme
- NSW Health Records and Information Privacy Act 2002, which can apply to private health service providers in NSW
- Victorian Health Records Act 2001, which applies to health service providers in Victoria, including private GP clinics
- My Health Records Act 2012 and the My Health Records Rules 2026, for participating organisations
- Healthcare Identifiers Act 2010, where your practice uses healthcare identifiers (OAIC)
Where your practice is accredited
- RACGP Standards for general practices, which include information security expectations
- Accreditation arrangements vary by practice, so check what your accreditor requires
Useful baselines, not automatic requirements
- ASD Essential Eight, as a technical security baseline and maturity review
- ISO/IEC 27001, as a management system gap assessment (certification is optional)
- NIST Cybersecurity Framework and CIS Controls
Regulatory summary reviewed 24 October 2026. Please check the current official sources, because requirements and commencement dates can change.
Healthcare assessment pages
Why Does This Matter for Your Practice?
Patient information is highly valuable to criminals and highly personal to patients. A breach can disrupt appointments and billing, harm patients, damage the trust your practice has built and trigger regulatory obligations.
Strong security is part of good patient care. It is also far easier and cheaper to put in place before an incident than after one.
If your practice participates in My Health Record, the My Health Records Rules 2026 (effective 1 April 2026) add specific requirements. Rule 21 requires a documented Security and Access Policy, and revised requirements apply to existing participants from 1 October 2026.
Under Rule 14, the System Operator may suspend access to the system where its security, integrity or operations are, or may be, compromised.
Related assessments: My Health Record Security Readiness Assessment
How Veytrix Cyber Can Help
Veytrix Cyber supports GP clinics, medical centres, allied health practices and other healthcare providers across Sydney, NSW, Melbourne and Victoria in understanding how well their patient data is protected and where the gaps are. We are independent and software-agnostic: we assess your whole IT environment, not one clinical product.
Do you know how well your patient data is protected?
Contact Veytrix Cyber to assess your current cybersecurity controls and identify practical ways to strengthen patient data protection and regulatory compliance.
Request a scoping callOfficial references
Privacy, data breach and My Health Record guidance My Health Records Rules 2026 (F2026L00392) apply to participants. Relevant provisions: Rules 14, 21, 22, 38, 39 and 43–46.1Privacy Act, patient information and data breaches
Why outsourcing patient data storage does not necessarily outsource your responsibility.
2RACGP standards and GP practice security
Specific to general practice rather than general cyber security advice.
3My Health Record compliance and security
Additional resources for practices that participate in My Health Record. Practices that do not participate still have the privacy and security duties above.
4Practical cyber security guidance and training
Plain-language help for practice managers without a technical background.
Back to our services
Our vulnerability assessment and penetration testing (VAPT), IT security audit and cyber risk assessment services are described on the homepage. For practical situations to test your practice against, see the ten healthcare scenarios.