Can you manage Best Practice, Medical Director, Genie, Gentu or Halaxy?

We look after everything those applications need to work: the server or cloud tenancy, the devices, the network, the backups and the user accounts. Questions inside the application, like how a template works or how a prescription prints, stay with the software vendor. We know exactly where that line is, and we own everything on our side of it.

Our current IT person installed Windows 11 on our server. Is that a problem?

Yes. Server operating systems and desktop operating systems aren't interchangeable. Desktop Windows isn't licensed or designed for hosting multi-user services, and a lot of compliance auditors will pick it up immediately. We'd rebuild it properly and tell your auditor what we did, so the next visit is clean.

Is our backup OK if the practice gets ransomware?

We would need to test it before we could tell you. A backup that has never been restored is a hope, not a control. Our backup service validates automatically every business day and runs a full disaster-recovery test once a year. After the first full test you get the actual recovery time, so you know the answer before you need it.

A GP thinks an email they clicked might have been a scam. What do we do?

Don't send anything else through that mailbox, don't delete the email, and ring us. We will isolate the account and check whether credentials were entered or harvested. Then we look for forwarding rules or active sessions that a password reset would not clear. If it was nothing, we document it and close the ticket. If it was something, the first hour is where most of the damage gets prevented.

Can clinicians use Microsoft 365 Copilot, AI scribe tools, or ChatGPT on patient data?

Extremely carefully, and only on enterprise tiers with the right data-handling terms. The Privacy Act and the My Health Records Act do not bend for artificial intelligence. Several scribe and transcription tools in clinical use have changed their data-residency and training-use terms more than once. We assess the specific tool you want to use: Heidi, Lyrebird, Nuance DAX, Microsoft 365 Copilot, Claude for Work. We check its data handling against the APPs, then write an acceptable-use policy your clinicians can follow. Consumer-tier tools are blocked on the network, at the domain name system (DNS) layer.

IT and cybersecurity for Australian private health practices.

You have patient records to protect and a My Health Record connection to keep compliant. Underneath both is a practice-management system nobody wants going down on a Monday morning. We look after the environment all of that runs on, Australia-wide.

What compliance asks of you See if we're a fit

What's actually different

Every health practice runs the same few systems, and the same rules follow.

Whether you run a GP clinic, specialist rooms, an allied-health group or a private day-surgery, the clinical work differs and the systems rarely do. A practice-management platform at the centre. Pathology and imaging feeding into it. Microsoft 365 for the admin side. A backup arrangement that is more optimistic than tested, and staff working across several roles and devices.

The obligations are just as consistent. Patient records are sensitive information under the Australian Privacy Principles (APPs), so the full set applies to you. Connect to My Health Record and you pick up its own security and access rules on top. Several states add their own health-information laws as well.

Most incidents we get called to in this sector do not start in a clinical system. They start with a reception mailbox, a reused password, or a server whose operating system stopped getting patches eighteen months ago. The practice-management software gets blamed; the underlying environment is usually where the failure happened.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

My Health Record 'Share by Default', from 1 July 2026

Prescribed providers must now upload pathology and diagnostic imaging reports to My Health Record by default, unless the patient opts out. Registration failures carry penalties up to $82,500, and missed uploads up to $9,900 each. If your practice is not uploading yet, the integration work is the piece to get scoped.

My Health Records Rules 2026: written security policy required

Every registered provider organisation needs a documented security and access policy for My Health Record. It has to cover who is authorised, how staff are trained, and how IT accounts are managed. "We have multi-factor authentication" does not satisfy it. The policy has to exist on paper and be reviewed.

AI scribes: what AHPRA and the RACGP expect in writing

Using Heidi, Lyrebird, Smart Scribe or Nuance DAX puts documented privacy, consent and clinical-verification obligations on the clinician. They come from the Australian Health Practitioner Regulation Agency (AHPRA) shared code update of August 2024. The Royal Australian College of General Practitioners (RACGP) added its AI-scribe fact sheet in July 2024. A practice running scribes without a written policy is exposed, so we help you write that policy and keep it in use.

Ransomware payments: 72 hours to report

Businesses above $3M turnover must report a ransomware payment to the Australian Signals Directorate within 72 hours. The rule commenced on 30 May 2025 under the Cyber Security Act. It catches most group GP practices, specialist clinics, allied-health groups and private day surgeries. An incident response plan is no longer something you can put off.

Frameworks and regulators

Industry frameworks, regulations and audit standards for health in Australia.

Privacy Act 1988 and the Australian Privacy Principles: Patient records are sensitive information under the Australian Privacy Principles (APPs). Every practice holds some, so the full set of obligations applies, along with the Notifiable Data Breaches scheme.
My Health Records Act 2012: Connect your practice-management system to My Health Record and you take on specific security and audit duties. They limit who can look at the data and what it can be used for. Getting it wrong carries civil penalties.
RACGP and AHPRA practice standards: Accreditation standards cover secure information handling, backup practice and staff privacy training. None of it is written as a technology specification, and your next re-accreditation visit will still ask about it.
State-based health information laws: Several states add their own legislation on top of the APPs. New South Wales has the Health Records and Information Privacy Act 2002; Victoria has the Health Records Act 2001.
Essential Eight, from the Australian Cyber Security Centre: Private-hospital operators, insurers and larger allied-health networks increasingly ask about this control baseline. Read the Essential Eight maturity levels and what each one requires.

Where firms usually start

Compliance and IT starting points for health in Australia.

Common questions

The things health clients ask us first.

Can you manage Best Practice, Medical Director, Genie, Gentu or Halaxy?: We look after everything those applications need to work: the server or cloud tenancy, the devices, the network, the backups and the user accounts. Questions inside the application, like how a template works or how a prescription prints, stay with the software vendor. We know exactly where that line is, and we own everything on our side of it.

Our current IT person installed Windows 11 on our server. Is that a problem?: Yes. Server operating systems and desktop operating systems aren't interchangeable. Desktop Windows isn't licensed or designed for hosting multi-user services, and a lot of compliance auditors will pick it up immediately. We'd rebuild it properly and tell your auditor what we did, so the next visit is clean.

Is our backup OK if the practice gets ransomware?: We would need to test it before we could tell you. A backup that has never been restored is a hope, not a control. Our backup service validates automatically every business day and runs a full disaster-recovery test once a year. After the first full test you get the actual recovery time, so you know the answer before you need it.

A GP thinks an email they clicked might have been a scam. What do we do?: Don't send anything else through that mailbox, don't delete the email, and ring us. We will isolate the account and check whether credentials were entered or harvested. Then we look for forwarding rules or active sessions that a password reset would not clear. If it was nothing, we document it and close the ticket. If it was something, the first hour is where most of the damage gets prevented.

Can clinicians use Microsoft 365 Copilot, AI scribe tools, or ChatGPT on patient data?: Extremely carefully, and only on enterprise tiers with the right data-handling terms. The Privacy Act and the My Health Records Act do not bend for artificial intelligence. Several scribe and transcription tools in clinical use have changed their data-residency and training-use terms more than once. We assess the specific tool you want to use: Heidi, Lyrebird, Nuance DAX, Microsoft 365 Copilot, Claude for Work. We check its data handling against the APPs, then write an acceptable-use policy your clinicians can follow. Consumer-tier tools are blocked on the network, at the domain name system (DNS) layer.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.