Skip to content

Compliance pressure on health and aged-care providers.

Health information attracts the heaviest privacy obligations in Australian law, and a breached medical record is treated like a breached bank detail. Most providers have the clinical side under control and the IT side running on trust.

Live right now ·  health and aged care

What's hitting health and aged-care providers right now.

Regulatory changes with dates already set, and what each one asks of you.

Aged Care Act 2024

In force since 1 November 2025

In force since 1 November 2025 for registered aged-care providers. Information Management is an explicit standard with audit-grade expectations on records, access, and cyber resilience. Captures aged-care providers, not broader medical or allied-health practices.

Read the full guide

What's being asked of you ·  health and aged care

What health and aged-care providers have to prove on compliance in 2026.

The operational expectations tightened sharply in 2026. The Aged Care Act 2024 and the Strengthened Quality Standards are in force, and the Information Management standard reaches straight into IT. Records retention, access control, audit-grade evidence, cyber resilience. Health data is also sensitive information under the Privacy Act, which raises the bar again on consent, access and security.

My Health Record participants also answer to the Australian Digital Health Agency's conformance expectations. The Share by Default changes in 2026 push more health data through more systems and more access points. Clinical software such as Best Practice, Medical Director, Genie or Pracsoft is only part of it. The security expectations attach to the environment around the software as much as to the software.

The threat side has not been kind. Aged care has been the most-targeted part of Australian healthcare for several years running. The threat does not care that a provider is a not-for-profit on a thin margin. The Aged Care Quality and Safety Commission has signalled that cyber resilience is part of provider assessment now, not a deferred item.

What we do ·  Map, build, maintain

What health and aged-care providers get from a compliance engagement.

The work starts with privacy, because that is where the exposure is. The Australian Privacy Principles treat health information as a sensitive category, and the Notifiable Data Breaches scheme means a breach is not a private matter. We build the access, logging and breach-response infrastructure that turns a notifiable event into a survivable one.

If you participate in My Health Record, we implement the technical conformance the Australian Digital Health Agency expects. If you operate under the Aged Care Act 2024, the Information Management standard reaches directly into IT. Record retention, access control, audit-grade evidence, cyber resilience. We map each expectation to a control and build the control into the stack.

Aged care has been the most-targeted part of Australian healthcare for years, and being a not-for-profit on a thin margin is no protection. We build the cyber-resilience baseline before the Commission asks for it. Essential Eight controls, plus the identity and backup discipline that turn a ransomware event into an incident rather than a closure. When the assessment comes, the answer is operational rather than aspirational.

The cycle then runs continuously. Gap analysis against the Privacy Act, conformance and Aged Care Quality Standards in scope for you. Monitoring across the clinical and administrative stacks. Remediation when something drifts. Evidence that produces the report the Commission, the Agency or the Information Commissioner expects, without a fire drill.

The tools and the role ·  the operational toolkit

The capabilities most health and aged-care providers need at once, and rarely have in-house.

Whichever framework you are measured against, it asks for roughly the same operational set. These five we run as a service, so the framework cycle is a continuing operation rather than an annual scramble.

  • Trouble shows up while it is still recoverable

    Security information and event management, or SIEM, collects logs from your devices, identity, network and cloud services. The alerting answers 'are we under attack right now' rather than 'were we under attack last quarter'.

  • Unapproved software never gets to run

    Allowlisting stops unauthorised executables running on managed devices. One of the highest-impact Essential Eight controls, and one of the hardest for in-house IT to operate without breaking the business. We run it as a service, exception handling included.

  • Known vulnerabilities get closed, not just listed

    Most providers run a scanner and email you a list. We run the scanner and do the labour-intensive remediation work that actually closes the vulnerabilities inside the thirty-day window most frameworks expect.

  • Staff finish the training, and you can prove it

    Annual training your staff actually complete, plus phishing simulations that escalate rather than scold. Your compliance officer gets the completion reporting they can show an auditor or an insurer.

  • Someone senior owns the roadmap, without the salary

    Strategic IT advice, framework gap analysis, board-level reporting, risk register maintenance and vendor management oversight. That is the virtual chief information officer, or vCIO, role most firms our size cannot resource internally.

    More on our vCIO service

What goes wrong ·  for health and aged care

The compliance risk that actually costs health and aged-care providers work.

The one that hurts providers most starts with a yes on a funder questionnaire or a conformance review. The policy document said yes. The operational control was patchy or out of date. When the breach comes, the regulator and the funder both ask for the evidence. Who had access on the relevant dates. What the patch status was. When backups were last tested. If it does not exist, the consequences reach past the breach into funder relationships and licence conditions.

Already included ·  baseline plan

What your managed IT engagement already covers.

The controls we require cover the core of what the Privacy Act and the Aged Care Quality Standards expect from IT. Specialist overlays layer on per engagement. Clinical-system integration, conformance with the Australian Digital Health Agency, aged-care incident reporting, and disability-scheme provider obligations where they apply.

Compliance is an overlay against the baseline, not a plan tier on its own. The Managed IT + Compliance plan exists for providers with continuing regulator and funder obligations and an active evidence calendar. Smaller practices can run the baseline plan and add overlays where a regulator or an insurer requires them.

Some of it stays with you. Clinical governance, the patient-care and resident-care decisions, the clinical-software training, and the policy-level conversations with the Aged Care Quality and Safety Commission. We provide the IT and compliance machinery the clinical governance function depends on to be defensible.

Common questions

The framework questions health and aged-care providers ask us first.

Can you help us meet My Health Record conformance requirements?
Yes. We configure the systems with the access, logging and conformance requirements the Australian Digital Health Agency expects. That includes the technical conformance items, the audit-trail expectations, and what the Share by Default changes in 2026 mean for a participating practice.
What does the Aged Care Information Management standard require of IT?
Records retention, access control, audit-grade evidence and demonstrable cyber resilience. We map each expectation to a technical control and build the evidence so the Commission can see it in operation. Then we keep the controls running, so the next assessment is not a fire drill.
Do you handle Privacy Act obligations on sensitive health information?
Yes. Health information is sensitive information under the Privacy Act, which means stricter consent, access, disclosure and security requirements. We configure the systems holding it with the access controls, audit trails and breach-notification readiness the Australian Privacy Principles expect for sensitive categories.
Can you help us prepare for a notifiable data breach?
Yes, and ideally before one happens. We build the logging, access controls and incident-response runbook that turn a notifiable event into a survivable one. The notification clock starts when the organisation becomes aware, and what you do in the first 24 hours decides most of the regulatory and operational outcome.
What about NDIS provider obligations on data handling?
Providers under the National Disability Insurance Scheme carry obligations through the NDIS Quality and Safeguards Commission, including participant data handling, worker-screening data and incident reporting. We map those obligations against the same control environment used for the rest of the practice, and add overlays where the framework asks for more.
Can you support clinical-system integration security?
Yes. Clinical software integrates with practice management, billing, accounting, pathology, imaging and more. Every integration is a possible route to data exposure. We configure them with the controls the data sensitivity warrants, and we document them. A privacy impact assessment or a vendor-risk review then has the evidence on hand.
What about ISO 27001 if a hospital partner requires it?
Hospital partners and large health insurers increasingly want ISO 27001 or equivalent assurance from suppliers handling patient data. We hold the standard ourselves, and we help practices through certification preparation: gap analysis, control implementation, documentation, and the surveillance-audit cycle that follows.

Next step ·  start with the evidence

Find out what your Essential Eight maturity actually is.

Ten minutes of questions gives you a PDF report on your Essential Eight maturity. Hand it to your compliance officer, your insurer or your board the same day. If you want to check we are the right shop for the work, start with the fit check.

Start the Essential Eight self-assessment See if we're a fit
See if we're a fit