Healthcare Compliance Is Not One Checklist: The IT Standards Australian Practices Need to Understand.

Healthcare IT compliance involves more than installing antivirus software or creating a privacy policy. This guide explains the different legal obligations, industry standards and security frameworks Australian healthcare practices need to understand. 

Healthcare practices are responsible for some of the most sensitive information an organisation can hold. 

Patient files may contain medical histories, diagnoses, prescriptions, test results, Medicare details, contact information, payment data and correspondence with other healthcare providers. 

Protecting this information is therefore not simply an IT responsibility. It forms part of patient privacy, clinical governance, business continuity and the practice's broader duty of care. 

The challenge is that Australian healthcare compliance does not come from one standard, one regulator or one certification. 

A medical or allied health practice may need to consider: 

• The Privacy Act 1988 and Australian Privacy Principles 

• The Notifiable Data Breaches scheme 

• State or territory health-records legislation 

• Professional and accreditation standards 

• My Health Record participation requirements 

• Cyber security frameworks such as the Essential Eight 

• Contractual requirements from insurers, suppliers or healthcare partners 

Understanding how these layers fit together is the first step towards building a compliant and secure healthcare environment. 

Healthcare continues to be one of Australia's most frequently affected sectors for reported data breaches. 

The Office of the Australian Information Commissioner received 1,205 data-breach notifications during 2025. Health service providers were the most commonly affected sector, accounting for 225 notifications, or 19% of the total. Cyber hacking remained the leading cause of reported breaches. 

These incidents can create consequences far beyond temporary IT disruption. 

A healthcare data breach may expose patients to identity theft, fraud, embarrassment, discrimination or targeted scams. It can also prevent clinicians from accessing records, processing prescriptions, reviewing test results or continuing normal patient care. 

Compliance should therefore not be viewed as paperwork completed for accreditation. It should be treated as an ongoing system for reducing risks to patients and the practice.

The Australian Privacy Principles, commonly known as the APPs, form the foundation of Australia's federal privacy framework. 

They govern how covered organisations collect, use, disclose, secure, retain and provide access to personal information. Health information is treated as sensitive information and is subject to stronger protections than ordinary personal information. 

Private-sector health service providers have obligations under the Privacy Act even where they may otherwise be considered a small business. 

Depending on the services provided, this can include: 

• General practices 

• Dental clinics 

• Psychology and counselling practices 

• Physiotherapy and allied health providers 

• Specialists 

• Pathology and diagnostic services 

• Pharmacies 

• Aged-care and disability-service providers 

The OAIC's health privacy guidance makes it clear that privacy must be embedded into the practice's processes, rather than addressed only after a complaint or breach occurs. 

From an IT perspective, this means a healthcare practice should be able to demonstrate how it protects patient information against unauthorised access, disclosure, modification, loss and misuse. 

That normally requires more than a privacy policy. It requires security controls that are actively implemented and monitored. 

All private-sector health service providers have obligations under the Notifiable Data Breaches scheme. 

Under the scheme, an organisation must notify affected individuals and the OAIC when an eligible data breach is likely to result in serious harm. 

A breach may involve: 

• A compromised email account 

• Patient records sent to the wrong recipient 

• A stolen or lost device 

• Ransomware affecting clinical information 

• An unauthorised employee accessing records 

• Patient documents exposed through an incorrect sharing link 

• A supplier or cloud platform being compromised 

• Credentials being stolen through phishing 

Practices must be able to identify a suspected breach, contain it, investigate what information was affected, assess the likelihood of serious harm and complete any required notifications. 

The OAIC explains that eligibility is determined through an objective assessment of whether serious harm is likely—not simply whether the practice believes the incident is important. 

This makes incident preparation critical. 

Waiting until an event occurs to decide who will investigate it, where audit logs are located or how affected patients will be identified can cause costly delays. 

Healthcare practices must also consider the legislation that applies in their state or territory. 

For practices operating in Victoria, the Health Records Act 2001 establishes 11 Health Privacy Principles governing the collection and handling of health information. 

The Act applies to both public and private organisations and covers a wide range of providers, including GP clinics, psychologists, dietitians, naturopaths and speech pathologists. Importantly, it applies regardless of the size of the organisation and does not include a general small-business exemption. 

Victorian practices may therefore have obligations under both federal privacy legislation and the Victorian Health Records Act. 

The Health Privacy Principles address areas including: 

• Collection of health information 

• Use and disclosure 

• Data quality 

• Security and retention 

• Openness 

• Patient access and correction 

• Transfer or closure of a practice 

For IT planning, this means practices need to understand where information is stored, who can access it, how it is transferred and how it can be provided to patients when legitimately requested. 

General practices seeking accreditation must also consider the RACGP Standards for general practices. 

At the time of writing, the fifth edition remains the published accreditation standard, while the RACGP has advised that the sixth edition will be published shortly. 

Criterion C6.4 of the fifth edition specifically addresses information security. It points practices towards policies and procedures designed to protect sensitive information from loss or unauthorised access. 

The standard also requires practices that permit remote access to document their remote-access and wireless-system policies. 

This has practical implications for common healthcare workflows. 

Practices should know: 

• Which clinicians can access systems remotely 

• Which devices they are permitted to use 

• Whether multi-factor authentication is enforced 

• Whether access is logged 

• Whether unmanaged personal devices are permitted 

• How access is removed when a clinician or employee leaves 

• Whether third-party IT tools are approved and monitored 

A remote-access policy that exists only on paper will not address these risks. The technical environment must enforce the policy wherever reasonably possible. 

Dental clinics, allied health providers and specialist practices may have different accreditation or professional requirements. Each organisation should identify the standards that apply to its services rather than assuming the RACGP framework applies universally.

Healthcare organisations participating in My Health Record have additional requirements. 

Under the My Health Records Rules 2026, participating organisations must establish, communicate, enforce and regularly maintain a written security and access policy. 

This applies even when the organisation uses My Health Record infrequently. 

The policy must address areas including: 

• How users are authorised 

• How accounts are created and modified 

• How access is suspended or deactivated 

• How individual users can be identified 

• Training requirements 

• Physical and information security 

• Data-breach management 

• Risk-management processes 

The 2026 requirements also place greater emphasis on maintaining evidence. 

Participating organisations must retain records relating to account changes, staff training, user identification, breach management and the technical or organisational controls used to protect My Health Record access. Depending on the record type, retention periods of two or five years apply. 

Authorised users must receive training before accessing My Health Record, annually thereafter and following significant changes to the system or its governing legislation. Training records must be retained for five years. 

The System Operator may also request a copy of the organisation's security and access policy, which must be supplied within seven days. Failure to maintain a compliant policy can affect the organisation's eligibility to participate in My Health Record. 

These requirements demonstrate an important compliance principle: 

A practice must be able to prove that its controls operate—not merely state that the controls exist.

The Australian Signals Directorate's Essential Eight is a cyber security framework rather than a healthcare-specific law. 

It recommends eight baseline mitigation strategies designed to make it more difficult for attackers to compromise systems. 

The strategies cover: 

• Application control 

• Application patching 

• Microsoft Office macro settings 

• User application hardening 

• Restriction of administrative privileges 

• Operating-system patching 

• Multi-factor authentication 

• Regular backups 

The Essential Eight should not be presented as a certificate proving that a healthcare practice has met every privacy or accreditation requirement. 

A practice could improve its Essential Eight maturity while still having gaps in patient-consent processes, My Health Record policies, privacy notices or information-release procedures. 

Equally, a practice may have comprehensive policies but still operate unsupported computers, shared administrator accounts or untested backups. 

The Essential Eight is best used as a technical security baseline that supports broader privacy and compliance responsibilities.

Healthcare compliance becomes meaningful when policies, technology and daily behaviour produce the same result. 

A compliant and well-governed environment should generally include the following. 

Individual user accountability 

Staff should use identifiable accounts wherever auditability is required. 

Shared logins make it difficult to determine who viewed, changed, printed, downloaded or disclosed information. This becomes particularly problematic during privacy investigations or when responding to concerns about unauthorised access. 

Access based on job responsibilities 

Reception staff, clinicians, contractors and administrators do not necessarily require the same access. 

Permissions should reflect each person's role, and privileged access should be restricted to those who genuinely need it. 

Prompt onboarding and offboarding 

New users should receive only the access required for their duties. 

When someone leaves or changes roles, access should be reviewed immediately across clinical applications, email, Microsoft 365, remote-access systems, file storage, My Health Record and third-party platforms. 

Multi-factor authentication 

Multi-factor authentication should protect remote access, email, cloud services and administrative accounts wherever supported. 

A password alone should not be the only control protecting patient information from external access. 

Supported and patched technology 

Operating systems, clinical applications, firewalls and network devices must remain supported and updated. 

Unsupported systems may continue to operate, but they can no longer be relied upon to receive the security updates needed to address newly discovered vulnerabilities. 

Reliable and tested backups 

Backups should include all critical patient and business information. 

They should also be isolated from ordinary user access and tested through actual restoration exercises. A successful backup notification does not prove that the data can be recovered within the timeframes the practice requires. 

Monitoring and audit logs 

Practices should retain enough visibility to investigate unusual access, account changes, security alerts and suspected breaches. 

Logs are most useful when they are actively reviewed and protected against unauthorised alteration. 

Documented incident response 

The practice should have a clear process for reporting a suspected incident. 

Staff need to know whom to contact, what information to preserve and what actions should be avoided. A well-meaning employee who deletes evidence or continues using a compromised device can make investigation more difficult. 

Security awareness training 

Healthcare staff should receive regular education about phishing, passwords, patient-information handling, fraudulent requests, remote access and incident reporting. 

Training should reflect real workflows within the practice rather than relying exclusively on generic annual presentations.

One of the most common mistakes is assuming that compliance belongs entirely to the IT provider. 

An IT partner can implement controls, monitor systems, provide evidence and help maintain policies. However, responsibility also involves practice leadership, privacy processes, staff behaviour, clinical workflows and decisions about how patient information is used. 

Other common mistakes include: 

• Treating a written policy as proof that a control is operating 

• Allowing shared accounts without considering auditability 

• Leaving former staff or contractors with active access 

• Assuming cloud systems are backed up automatically 

• Giving users administrator access for convenience 

• Failing to review supplier access 

• Keeping unsupported computers because they still work 

• Conducting training without retaining evidence 

• Having no tested data-breach response process 

• Applying the same access rights to every staff member 

• Failing to reconcile staff lists against active system accounts 

Compliance gaps are often caused not by the absence of technology, but by the absence of ownership, review and evidence.

Healthcare practices do not need to address every issue simultaneously. 

A structured approach can begin with four stages. 

1. Identifythe requirements 

Determine which laws, accreditation standards, My Health Record obligations and contractual requirements apply to the organisation. 

Do not rely on a generic healthcare checklist without confirming whether it is relevant to the practice type and location. 

2. Assess the current environment

Review users, devices, clinical systems, email, Microsoft 365, backups, remote access, network security, third-party access and existing policies. 

Compare what is documented with what is actually occurring. 

3. Address the highest risks

Prioritise issues that could lead to unauthorised access, widespread data exposure or an inability to continue patient care. 

Typical priorities include multi-factor authentication, unsupported systems, excessive administrator access, missing backups and unmanaged remote access. 

4. Maintainevidence and review controls 

Record what has been implemented, who approved exceptions, when controls were tested and when the next review is due. 

Compliance is not a one-time project. Staff, applications, suppliers, threats and regulatory expectations continue to change.

Security controls should not make healthcare unnecessarily difficult to deliver. 

The goal is to create an environment where clinicians can access the information they need while patient data remains protected, systems remain available and abnormal activity can be investigated. 

Well-designed compliance measures should improve: 

• Reliability of clinical systems 

• Accountability for access 

• Recovery from outages and incidents 

• Staff confidence 

• Patient trust 

• Accreditation readiness 

• Management visibility 

• Continuity of care 

When compliance is approached as an operational system rather than a paperwork exercise, it supports both security and patient outcomes.

Managed Services Australia provides tailored IT support and cyber security services for medical and allied health organisations. 

We can assist healthcare practices with: 

• Technology and cyber security assessments 

• Microsoft 365 and identity security 

• Multi-factor authentication 

• Device and compliance management 

• User-access reviews 

• Network and firewall security 

• Managed endpoint protection 

• Backup and disaster recovery 

• Remote-access controls 

• Security monitoring 

• Policy implementation support 

• Technology planning and compliance remediation 

Our approach focuses on improving security and compliance while maintaining reliable access to the clinical applications and systems healthcare professionals depend on. 

To understand where your practice currently stands, contact Managed Services Australia or book a Technology and Cyber Security Audit with our Melbourne-based team. 

🌐 Explore our services at Managed Services Australia.
📧 Dial 1300 024 748, shoot us an email at [email protected], or schedule a session with one of our IT specialists.