Cyber security for medical practices in Australia comes down to four things: protect patient health information because the Privacy Act covers every health service provider regardless of turnover, meet the security obligations attached to My Health Record and RACGP accreditation, lock down email and remote access with MFA, and keep backups you've actually restored. Health is the most breached sector in the country, so get the basics in place, then get them independently tested so you have evidence, not just a policy.
Practices usually look at this when an accreditation survey is coming up, an insurer or partner wants proof of controls, or something has already gone wrong. This guide covers why practices are targeted, what Australian law and accreditation expect, the controls that matter most, and where penetration testing fits. It's written for practice owners, practice managers and the IT providers who support GP clinics, specialist rooms, dental surgeries, allied health and other small to mid-sized healthcare providers.
Why are Australian medical practices a target for cyber criminals?
Because health data is valuable, clinics can't afford downtime, and many practices run lean IT with lots of shared logins and remote access. That combination makes healthcare both easy to get into and likely to pay attention when criminals start making demands.
The numbers are clear:
- ▸Health service providers were the most breached sector in Australia in 2025, with 225 notifications (19% of the total) out of 1,205 reported to the OAIC under the Notifiable Data Breaches scheme. That total was the highest since the scheme began in 2018 (OAIC).
- ▸ASD's Annual Cyber Threat Report 2024–25 says the number of ransomware incidents against the healthcare sector doubled compared with 2023–24, and malicious actors were successful in 95% of health care and social assistance incidents ASD responded to, compared with nearly 52% across all sectors.
- ▸The same report describes a July 2024 incident at an e-prescription service in which about 6.5TB of data was taken, including personal and health information of roughly 12.9 million Australians.
- ▸For all businesses, the average self-reported cost of cybercrime per report was $56,600 for small businesses and $97,200 for medium businesses in 2024–25.
The motive is simple: health records are sensitive and enable fraud and identity theft, and disruption to care creates pressure to pay. A clinic that can't see its appointment book or patient records for a day feels the pressure immediately.
Does the Privacy Act apply to small medical practices?
Yes. Unlike most small businesses, health service providers are covered by the Privacy Act whatever their annual turnover. The OAIC lists medical practitioners, pharmacists, allied health professionals, private hospitals, day surgeries and complementary therapists among the providers that must comply with the Australian Privacy Principles (OAIC).
That means three obligations land on even a two-doctor clinic:
- APP 11: take reasonable steps to secure personal information from misuse, interference, loss and unauthorised access, and destroy or de-identify it when you no longer need it. Our guide to Privacy Act cyber security requirements explains what "reasonable steps" looks like in practice.
- The Notifiable Data Breaches scheme. If a breach is likely to result in serious harm, you must assess it, notify affected patients and notify the OAIC. Health information is sensitive information, so breaches involving it are more likely to meet that threshold.
- A clear privacy policy and collection notices that match how you really store and share data, including cloud practice software and third-party booking or telehealth tools.
The practical point: "we're too small to be covered" isn't available to healthcare. If you hold patient records, the Privacy Act expects you to protect them.
What do My Health Record rules require from a practice?
If your organisation is registered with My Health Record, you must have, communicate and enforce a written security and access policy, and from 1 October 2026 it must comply with the My Health Records Rules 2026. The Australian Digital Health Agency says this applies to every registered organisation, including those that previously wrote a policy under the 2016 rules (Australian Digital Health Agency).
What the policy has to cover
According to the Agency's guidance on the 2026 rules (Rule 21), the policy must be written down and must address, among other things:
- ▸user account management, including who is authorised to access the system
- ▸staff training before they're given access, and at least annually after that
- ▸regular system maintenance, including patching
- ▸data protection measures such as encryption and regular backups
- ▸monitoring and review of your security measures
- ▸how security risks are identified and reported to management
The policy must also be written so your compliance can be audited against it, and the obligation applies regardless of the size of your organisation, including organisations that only upload information.
How often it must be reviewed
The Agency says the policy must be reviewed at least annually. Each version needs a unique version number and date of effect, and you must keep copies for five years.
That's the part many practices miss. A template policy that says "we patch promptly and use strong passwords" is only useful if you can show it's true. Independent testing is one of the simplest ways to produce that evidence.
What do the RACGP Standards say about information security?
The RACGP's Standards for general practices (6th edition), released in August 2026, include a dedicated information security criterion (F8) covering ICT continuity, cyber incident response, backups, antivirus, firewalls and secure ICT governance. Accreditation under the National General Practice Accreditation Scheme currently still uses the 5th edition, and transition dates haven't been published yet (ACSQHC, newsGP).
Criterion F8 is broken into several parts:
- ▸F8.A ICT continuity, protection and recovery
- ▸F8.B Digital governance and ICT security
- ▸F8.C Digital communications
- ▸F8.D Social media
- ▸F8.E Records storage, retention and destruction
- ▸F8.F An aspirational indicator
The new edition also adds criteria on privacy and confidentiality, digital health technology and, for practices that use them, AI tools. Much of F8 builds on what the 5th edition already expected, so the work you do now isn't wasted. In particular, expect surveyors to look for a documented, regularly tested ICT continuity plan that includes a cyber security incident response plan, a backup log, current antivirus and firewalls, secure offsite or cloud backups you can restore from, and a process for telling patients about a data breach.
If you're not a general practice, the same principles still apply. Dental, allied health and specialist practices face the same Privacy Act and (if registered) My Health Record obligations, even if their accreditation framework is different.
Which cyber security controls matter most for a medical practice?
Start with the controls that stop the most common attacks: MFA, patching, backups, restricted admin rights and staff awareness. These line up with ASD's Essential Eight and with the Australian Digital Health Agency's cyber security fundamentals for healthcare.
1. Multi-factor authentication everywhere it counts
Turn on MFA for email, remote access, cloud practice software, finance systems and any admin account. ASD recommends phishing-resistant MFA (such as passkeys or security keys) where possible, rather than SMS codes. Remote access to the practice server without MFA is one of the most dangerous gaps a clinic can have.
2. Unique logins, not shared front-desk accounts
Shared "reception" or "nurse" accounts make it impossible to see who accessed which record, and they undermine the user account management your My Health Record policy has to describe. Give everyone their own login and remove accounts promptly when staff or locums leave.
3. Patching and replacing legacy systems
Keep operating systems, browsers, practice software and internet-facing devices (firewalls, VPNs, routers) up to date. If a clinical device or old server can't be patched, isolate it from the rest of the network.
4. Backups you've actually restored
Keep at least one backup offline or immutable, and run a test restore every quarter. "The backup job says success" isn't the same as "we can rebuild the appointment book by lunchtime". Our guide to ransomware protection for Australian businesses covers backup design in more detail.
5. Restricted admin rights
Clinicians and front-desk staff shouldn't browse the web or read email with administrator accounts. Limit admin rights to the IT provider and a small number of named people.
6. Email and phishing defence
Phishing was recorded in 60% of incidents reported to ASD in 2024–25. Train staff to spot fake login pages and invoice scams, configure SPF, DKIM and DMARC on your domain, and make it easy for staff to report a suspicious email without feeling foolish.
7. A written, tested incident response plan
Know who to call, how to keep seeing patients if systems are down, and how you'll assess a possible notifiable breach. Run a short tabletop exercise at least once a year.
Where does penetration testing fit for a medical practice?
A penetration test shows whether your controls actually work against a real attacker, and produces the evidence that accreditation surveyors, insurers and partner organisations increasingly ask for. It isn't mandated by name in the Privacy Act or My Health Record rules, but the Privacy Act expects reasonable security steps and My Health Record policies must cover monitoring and review of your security measures. Testing is the most direct way to show those measures work.
For most practices, the highest-value scope is:
- ▸External perimeter: remote desktop gateways, VPNs, firewalls, patient portals and booking forms exposed to the internet
- ▸Microsoft 365 or Google Workspace: MFA coverage, legacy authentication, mailbox forwarding rules and admin roles (see our cloud penetration testing guide)
- ▸Internal network: whether a single compromised reception PC can reach the practice server, backup storage or clinical devices
- ▸Web applications and integrations: online booking, telehealth links and any custom patient-facing apps
Common issues in healthcare environments include remote access without MFA, shared or default credentials on servers and network devices, flat networks with no separation between admin PCs and clinical systems, and backups stored on the same network as the data they protect. A good test finds these before a criminal does and gives you a prioritised fix list your IT provider can work through.
If you're not ready for a full engagement, an automated security assessment is a useful first look at your internet-facing systems. Just be clear it's an automated assessment, not a penetration test. Our article on automated vs manual penetration testing explains the difference.
How much does cyber security testing cost for a medical practice?
Expect anywhere from $80 for an automated external check to $5,000 or more for a human-led penetration test, depending on scope. Here are Aussie Pentest's published prices (AUD, plus GST):
| Service | Price | Best for |
|---|---|---|
| Automated security assessment | $80, $200, $500 or $2,000 | A fast first look at your website, portal or exposed systems |
| Penetration test (Basic) | From $5,000 | External network, up to 25 IPs |
| Penetration test (Standard) | From $12,000 | External and internal network, up to 50 IPs and 2–3 web apps |
| Penetration test (Advanced) | From $20,000 | Full-scale, including web apps, APIs and social engineering |
| Essential Eight assessment | $4,950 | Up to 50 seats, ML1 or ML2 target, maturity score and roadmap |
| vCISO retainer | $2,500–$6,500/month | Ongoing advice, risk register and board or partner reporting |
Penetration tests are delivered in 5–10 business days, and Essential Eight reports within 10 business days. Full details are on our pricing page. If you need ongoing help keeping your security and access policy, risk register and testing schedule on track, a vCISO retainer provides advisory and oversight. It's not implementation and not incident response, so your IT provider still does the hands-on work.
What should a practice do in the next 30 days?
Pick the handful of actions that close the biggest gaps and produce evidence. A practical 30-day plan:
- Check MFA coverage on email, remote access, practice software and admin accounts. Fix anything missing first.
- Review your My Health Record security and access policy against the 2026 rules, give it a new version number and date, and record who reviewed it.
- Remove shared logins and disable accounts for anyone who's left.
- Run a test restore of your practice management database and record the result in your backup log.
- Update your incident response plan with contacts for your IT provider, insurer, ASD (1300 CYBER1) and the OAIC.
- Get independent evidence. Start with an automated assessment or an Essential Eight assessment, then scope a penetration test around remote access, Microsoft 365 and your internal network.
If your IT is managed by an MSP, share this list with them. Independent testing works best alongside your provider, validating what they've built rather than replacing them.
Frequently asked questions
Is cyber security mandatory for medical practices in Australia?
There's no single cyber law for clinics, but the Privacy Act requires every health service provider to take reasonable steps to secure personal information, regardless of turnover. Practices registered with My Health Record must also maintain an auditable security and access policy.
Do small GP clinics have to report data breaches?
Yes. Because health service providers are covered by the Privacy Act regardless of turnover, they're part of the Notifiable Data Breaches scheme. Breaches likely to cause serious harm must be reported to the OAIC and affected patients.
What changed for My Health Record security policies in 2026?
From 1 October 2026, registered organisations' security and access policies must comply with the My Health Records Rules 2026. The policy must cover cybersecurity measures, be auditable, be reviewed at least annually and be version-controlled, with copies kept for five years.
Does the RACGP 6th edition apply now?
The 6th edition was released in August 2026, but NGPA accreditation currently still uses the 5th edition. Transition dates haven't been published yet, so it's sensible to start working towards the new criteria now.
Do medical practices need a penetration test?
It isn't named as mandatory, but the Privacy Act expects reasonable security steps and My Health Record policies must cover monitoring and review of your security measures. A penetration test focused on remote access, Microsoft 365 and the internal network is the most direct way to prove those controls work.
How often should a medical practice test its security?
At least annually, and after major changes such as new practice software, a cloud migration, a new site or a change of IT provider. Automated assessments can run more often between human-led tests.
Can our IT provider do the testing?
They can run scans, but independent testing avoids the provider marking its own homework and is more credible to surveyors, insurers and partners. The best results come when the tester and your IT provider work together on the fixes.
Bottom line
Australian medical practices are the most breached sector under the Notifiable Data Breaches scheme, and ASD says ransomware against healthcare doubled in a year. The Privacy Act covers every health service provider, My Health Record now expects an auditable security policy under the 2026 rules, and the RACGP 6th edition strengthens information security expectations for accreditation. The practices that cope best get MFA, patching and backups right, write down how they'll respond, and get independent evidence that it all works.
If you'd like to know where your practice stands, book a 1-on-1 call and we'll recommend the smallest scope that gives you real evidence, whether that's an $80 automated assessment, an Essential Eight assessment or a full penetration test.
Sources
- ▸OAIC: Data breach notifications increase to all-time high in 2025
- ▸OAIC: Small business and the Privacy Act
- ▸ASD: Annual Cyber Threat Report 2024–25
- ▸Australian Digital Health Agency: My Health Record participation obligations
- ▸Australian Digital Health Agency: Fundamentals of cyber security in healthcare
- ▸ACSQHC: RACGP Standards for general practices 6th edition
- ▸newsGP: RACGP unveils new accreditation standards
- ▸RACGP: Information security in general practice
- ▸Aussie Pentest: Pricing
This article is general information only, not legal, regulatory, privacy, clinical or insurance advice. Check your own obligations with the OAIC, the Australian Digital Health Agency, your accrediting agency and your insurer. Prices are current as of October 2026, and sources were checked on 30 October 2026. Only test systems you have written authority to assess.