A patient record is worth more than a credit card. Protect it accordingly.
Patient information and connected clinical systems make medical practices a high-consequence target. We map your practice's security to applicable privacy, health-record and professional obligations, then document the controls.
Dossier 02 / 10
Medical & Allied Health
Health records sell for more than credit cards. A breach here is a patient-safety and registration risk.
- AHPRA obligations
- My Health Records Act 2012
- Privacy Act 1988 / APPs
What the obligation actually requires of you.
- 01
AHPRA obligations
Registered practitioners and their staff have professional confidentiality and privacy obligations. A serious incident may require separate advice about registration, privacy and health-record duties.
- 02
My Health Records Act 2012
Connected systems carry specific security and unauthorised-access obligations under the My Health Records Act, with real penalties for non-compliance.
- 03
Privacy Act 1988 / APPs
Patient records are sensitive information under the Privacy Act, held to a materially higher standard of protection than ordinary personal information.
controls to review
Use this sector-specific set of practical prompts to identify owners, evidence and the next control to verify.
A ransomware attempt targeting patient files.
Illustrative scenario — In this example, A phishing email delivered a ransomware payload to a reception workstation at a multi-site allied health group. The payload attempted to encrypt shared drives, including the folder synced from the practice-management database.
Example response — A suitable response is to isolate affected devices, preserve clinical-system evidence, reset credentials and test restoration from protected backups before reconnecting systems.
What to verify — Confirm the relevant control is configured, tested and evidenced for this scenario; record the owner, review date and any exception before treating the risk as addressed.
Control evidence to collect
Configuration, test evidence, an accountable owner and a review date for the controls described in this scenario.
Illustrative scenario only. It is not a client case study, endorsement, zero-loss claim or proof of a security outcome.
Run it yourself, then see the priorities.
Review each practical control, assign an owner, and get an educational action list before you request a prepared follow-up.
These are practical control prompts, not a legal compliance determination. Exact obligations vary by entity, asset, contract and jurisdiction.
Medical & Allied Health Cybersecurity Checklist
Complete each control to see your prioritised plan before submitting.
The questions this vertical always asks.
Not automatically, but a serious breach involving patient information can trigger both Privacy Act notification and, in some cases, a registration-standard conversation you would rather not have.
Your vendor secures their platform. Your obligations under the Privacy Act and the My Health Records Act still sit with you — the login credentials, the devices, and the staff using them.
The assessment runs alongside normal operations. Where we deploy controls, work is scheduled around clinic hours to minimise disruption to bookings; any service impact is agreed in advance.
Find out exactly where your patient data is exposed.
The Cyber Readiness Assessment is the forensic starting point, backed by a 100% refund guarantee. Enquire for scope and terms.
Melbourne VIC · Australia · gmanit.com.au