Cyber security for healthcare providers

Australia's most-breached sector needs more than a firewall. We protect patient data, clinical continuity and your Privacy Act obligations — for GP practices, hospitals, aged care and allied health.

The threat landscape

Healthcare has led Australia’s breach rankings every year since 2018

Health records are worth more on the dark web than credit card numbers — they carry a lifetime of irreplaceable personal and clinical detail. Adversaries know it, and Australia's statistics prove it.

Real-world incidents

Australian healthcare breaches you need to know about

These public incidents illustrate what is at stake and, in several cases, reveal the security gaps that enabled them.

Threat types

The specific risks facing clinics, hospitals and aged care

Healthcare organisations face a distinctive threat profile shaped by the sensitivity of their data, the criticality of uptime and the complexity of their technology environments.

Compliance & obligations

A layered regulatory framework — and real penalties

Australian healthcare providers operate under overlapping privacy and security obligations. Non-compliance is no longer a theoretical risk: civil penalty proceedings and reputational damage are live consequences.

  • Privacy Act 1988 & Australian Privacy Principles (APPs) — All private-sector health service providers are covered regardless of turnover. Health information is ‘sensitive information’ under the Act, attracting the strongest obligations across collection (APP 3), use and disclosure (APPs 6–7), data quality (APP 10) and security (APP 11). A sole-practitioner GP is as fully subject to these obligations as a major hospital.
  • Notifiable Data Breaches (NDB) scheme — Organisations must notify the OAIC and affected individuals as soon as practicable after becoming aware of an eligible data breach that is likely to result in serious harm. Penalties for serious or repeated interference with privacy can reach $50 million for corporations under 2022 Privacy Act amendments.
  • My Health Records Act 2012 — Registered healthcare providers accessing the My Health Record system must maintain the security of their systems and comply with the system operator’s requirements, which align with the ACSC Essential Eight. Once information is downloaded locally it remains subject to the Privacy Act.
  • RACGP Standards & AHPRA expectations — The Royal Australian College of General Practitioners (RACGP) publishes privacy guidelines and incorporates data security expectations into its Standards for general practices. AHPRA-registered practitioners have professional obligations around the confidentiality of patient information that are separate from, and complementary to, statutory requirements.
  • ACSC Essential Eight — While not legally mandated for all private health providers, the Australian Cyber Security Centre’s Essential Eight (patch applications, patch OS, MFA, restrict admin privileges, application control, macro settings, user application hardening, regular backups) is the recognised baseline for Australian healthcare IT security and is referenced by both the ADHA for My Health Record connections and the TGA for medical devices.
  • Aged Care Act & Quality Standards — Approved aged care providers have obligations under the Aged Care Act 1997 and the Aged Care Quality Standards to keep consumer information secure. The Aged Care Quality and Safety Commission increasingly expects providers to demonstrate information security governance.

At a glance

Controls that map directly to your obligations.

MFA
All clinical & admin accounts
EDR
Every endpoint & device
24/7
SOC detection & response
E8
Essential Eight uplift
BDR
Tested backup & recovery
vCISO
Governance & policy
What good looks like

Security that fits clinical environments — without slowing care

Effective healthcare cyber security is not a single product. It is a layered programme that addresses people, process and technology across every site, device and data flow.

Identity & access control

Enforce MFA on all accounts accessing patient data, practice management software and My Health Record. Apply least-privilege principles so clinical staff access only the records their role requires. Remove accounts promptly on staff departure.

Endpoint & device protection

Deploy EDR (Endpoint Detection and Response) on every workstation, laptop and clinical device — including shared reception PCs and nurse-station terminals. Segment IoMT devices onto isolated VLANs away from administrative and internet-facing systems.

Patch & vulnerability management

Maintain a regular patching schedule for operating systems, applications and network devices. Unpatched systems were a contributing factor in the Medibank breach. Where legacy clinical software cannot be patched, compensating controls (network isolation, application whitelisting) must be in place.

Backup & disaster recovery

Keep immutable, encrypted, offsite backups of all clinical and administrative data. Test restoration quarterly — a backup you have never restored is an assumption, not a control. Document your recovery time objectives (RTOs) in a tested Business Continuity Plan so staff know what to do if systems are unavailable.

24/7 detection & response

Ransomware can encrypt thousands of files in minutes. Signature-based antivirus alone cannot keep pace. A Security Operations Centre (SOC) with SIEM correlation and behavioural analytics provides the continuous visibility needed to detect and contain threats before they reach patient data.

Security awareness & staff training

Phishing is the number-one initial access vector in Australian healthcare. Regular simulation exercises and concise, role-appropriate training — not a once-a-year checkbox — measurably reduce the likelihood of a successful attack.

Services fit

How Cryptiq maps to your needs

Cyber security & endpoints

EDR on every clinical device, MFA enforcement, phishing-resistant email filtering, vulnerability scanning and Essential Eight uplift tailored to health environments including IoMT device segmentation.

Learn more →

Managed IT

Reliable, monitored infrastructure for practice management and clinical systems — proactive maintenance, patch management and help desk support so clinical staff stay focused on patients, not IT problems.

Learn more →

Managed SOC & SIEM

24/7 threat detection and incident response. Our SOC correlates events across your endpoints, network and cloud to catch ransomware, credential misuse and data exfiltration before they become a breach notification.

Learn more →

Microsoft & Azure

Secure Microsoft 365 and Azure environments used by clinical teams — conditional access policies, Purview information protection, Defender for Endpoint and secure configuration baselines aligned to the ACSC.

Learn more →

vCISO

Fractional security leadership for practices and aged care providers that need strategic governance without a full-time CISO. We develop your information security policies, assist with OAIC notification preparation and represent you in regulatory discussions.

Learn more →

Backup & disaster recovery

Immutable, encrypted backups with tested recovery procedures — ensuring you can restore clinical operations quickly after a ransomware attack or hardware failure without paying a ransom or losing patient data.

Learn more →

Frequently asked questions

Does the Privacy Act apply to my small GP practice or sole-trader allied health business?

Yes. Unlike most other industries, the Privacy Act 1988 contains no small-business exemption for health service providers. Every private-sector health provider — including sole-practitioner GPs, physiotherapists, psychologists, dentists and pharmacies — must comply with all 13 Australian Privacy Principles regardless of revenue. This includes APP 11, which requires you to take reasonable steps to protect health information from misuse, interference, loss, and unauthorised access or disclosure.

What are our obligations if we suffer a data breach?

Under the Notifiable Data Breaches scheme, you must notify the OAIC and affected individuals as soon as practicable if a breach is likely to result in serious harm. The obligation to assess and act begins as soon as anyone in your organisation becomes aware of a suspected breach — not just when it reaches your privacy officer. Following the 2022 Privacy Act amendments, penalties for serious or repeated breaches can reach $50 million for corporate entities. Prompt containment, a documented response plan and a relationship with a security partner who can assist with incident response and OAIC notification drafting are essential.

How do you approach security without disrupting clinical workflows?

We design controls around clinical realities. For example, we configure MFA to use methods that work on shared workstations (hardware tokens or authenticator apps on personal devices) rather than forcing clinicians to log in and out repeatedly. We schedule patching and maintenance during off-peak hours and test changes in staging environments before they reach production systems. Our experience with practice management and clinical software means we understand which configurations create risk without adding unnecessary friction.

What are the My Health Record security requirements we need to meet?

The Australian Digital Health Agency (ADHA) requires healthcare providers connecting to the My Health Record system to maintain controls aligned to the ACSC Essential Eight. This includes patching internet-facing services, restricting administrative privileges, configuring MFA and maintaining regular, tested backups. We can assess your current posture against these requirements, identify gaps and implement the controls needed to meet ADHA expectations and maintain your registration.

Do you cover aged care providers and multi-site operators?

Yes. We work with aged care providers operating across distributed sites with varying levels of on-site IT capability. Our managed services model provides consistent security coverage across every location via remote monitoring and management, with local escalation paths. We understand the Aged Care Quality Standards and can help providers demonstrate to the Aged Care Quality and Safety Commission that appropriate information security governance is in place.

What should we do right now if we have not reviewed our security recently?

Start with a security assessment that maps your current controls against the ACSC Essential Eight. Key questions: Are MFA and EDR deployed on every account and device that touches patient data? Do you have immutable backups and a tested recovery plan? Do staff receive regular phishing awareness training? Is your practice management software and OS patched and up to date? Cryptiq offers a no-obligation initial review for healthcare providers — contact us to arrange one.

Protect your patients, your practice and your licence to operate

Australia’s healthcare sector faces real, escalating cyber threats and real regulatory consequences. Book a no-obligation security review with Cryptiq’s team to understand your current exposure and a practical path forward.

Book a free security review