Industries / Healthcare & Medical

Cyber security checklist for medical and health practices

Health information is the most sensitive data a business can hold, and health services report more data breaches to the OAIC than almost any other sector. This free check shows where your practice stands in about five minutes.

Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, SMB1001

Why medical and health practices are targeted

Clinics are busy, shared workstations stay logged in, and many practices rely on one external IT provider and a handful of cloud systems. That makes stolen passwords, phishing and unpatched software the usual ways in.

The consequences are unusually serious. Patient records cannot be "changed" like a credit card number, ransomware can stop a clinic seeing patients, and a breach of health information is very likely to be notifiable.

What the healthcare & medical check asks about

The quick check has 20 questions and the full assessment 44. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:

Privacy Act — health information
My Health Record / ADHA security requirements
RACGP / accreditation security standards
Notifiable Data Breaches — health
Medical & clinical device security
Health software / cloud vendors

You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.

Obligations that may apply to you

The Privacy Act applies to every health service provider, regardless of turnover. Health information is "sensitive information" and needs a higher level of care.
Notifiable data breaches. A breach likely to cause serious harm must be notified to affected patients and the OAIC. See our Privacy Act guide.
My Health Record. Participating organisations must have a written security and access policy and control who can access the system.
Accreditation. The RACGP Standards for general practices include information security requirements, and other accreditation schemes have similar expectations.
Ransomware payments. Practices with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.

Four things to do first

Give every staff member their own login and turn on multi-factor authentication
Set shared workstations to lock automatically when unattended
Check your clinical software vendor stores data securely and in line with Australian privacy law
Write down what you would do in the first 24 hours of a data breach

Start the free healthcare & medical check

Frequently asked questions

Does the Privacy Act apply to small medical practices?

Yes. Unlike most small businesses, health service providers are covered by the Privacy Act regardless of turnover, so the Australian Privacy Principles and the Notifiable Data Breaches scheme apply to every practice.

What should a practice do first to improve its cyber security?

Start with individual logins and multi-factor authentication for email, clinical software and remote access, automatic screen locking on shared workstations, and backups you have actually tested restoring. Those steps address the most common causes of health data breaches.

Will this check tell me if I meet the RACGP standards?

It asks about the information security elements of accreditation and flags gaps, but it is a self-assessment and educational guide, not an accreditation assessment, audit or legal advice.

This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.