Healthcare gets sold IT differently to everyone else. The pitch is always about the future: telehealth, AI triage, integrated patient journeys.
Then you look at what actually stops a practice working, and it is the internet dropping out on a Tuesday morning with a full waiting room.
Across the health and veterinary practices we look after, in the year to 18 August 2026, the jobs logged were internet outages, backups reporting failures, printers, consult room computers that would not connect, and requests to restore an email somebody needed. Thirty one jobs, eleven hours. Not one of them was about a platform.
That is not an argument against the clever stuff. It is an argument for doing these six things first, in this order.
The rule that catches small practices out
Before any of it, know where you stand legally, because most practice owners have been told something wrong.
The Privacy Act generally exempts businesses with an annual turnover of $3 million or less. A lot of small practices have heard that and concluded it applies to them.
It does not. The OAIC lists health service providers among the small businesses that are covered regardless of turnover, and its list is broad: private hospitals, day surgeries, medical practitioners, pharmacists and allied health professionals, along with complementary therapists, child care centres, private schools and private tertiary institutions.
A two-chair practice turning over a few hundred thousand dollars a year has the same obligations as a hospital group. Everything below follows from that.
1. A backup you have actually restored from
Every practice has a backup. Far fewer have restored one.
The distinction matters because patient records are the one thing you cannot rebuild. Invoices can be reissued and rosters rewritten. Ten years of clinical history cannot.
Two questions settle it. When did somebody last restore a file from that backup and open it? And does the backup include the practice management database in a state it can actually come back from, rather than an open file that was being written to at the time?
Backup failure alerts are among the most common things we see in this sector, and they have a habit of being quietly ignored because the practice is busy and nothing has gone wrong yet. Put someone’s name against checking them weekly. It takes two minutes and it is the highest value two minutes in the list.
2. Multi-factor authentication, everywhere, including the receptionist
The Australian Signals Directorate’s Essential Eight is the baseline: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
For a practice, multi-factor authentication on email is the single highest return item on that list. Most breaches in small businesses start with a mailbox, and a mailbox in a health practice contains referrals, results, and patients writing about things they would not tell their family.
The pushback is always about the front desk being too busy. Turn it on there first anyway. Reception mailboxes are the ones criminals want, precisely because they are shared, busy, and used to receiving attachments from strangers.
3. A plan for the day the internet goes out
This is the one that actually happens, and most practices have no plan beyond ringing the provider.
If your practice management system, your imaging, your bookings and your phones all run over one internet service, that service is your practice. Work out in advance what happens without it.
A mobile broadband failover on the router will keep bookings and payments running for most of a day. A written paper fallback for check-in and clinical notes means the day continues rather than stops. A pre-configured divert that sends the main number to a mobile means patients can still reach you.
None of that is expensive. All of it has to exist before the morning it is needed, because nobody sets up a failover during a power cut.
4. Access that matches the role
Not everyone in a practice needs to see everything, and in health that is not a preference, it is part of your obligations.
Set access by role rather than by person: reception, clinical, practice manager, owner. Then two habits. When someone leaves, their access goes the same day, not the next time someone remembers. And when someone changes roles, their old access comes off rather than accumulating.
The reason to do this by role is that it survives staff turnover. Permissions set one person at a time never do.
5. Managed devices, and no shared logins
Consult room computers, reception machines, the laptop the practice principal takes home, and the tablets. All of them hold or reach patient data.
Device management gives you the basics: full disk encryption so a stolen laptop is a hardware loss rather than a notifiable breach, enforced screen locks, and the ability to wipe a device that has gone missing.
The harder change is shared logins. Almost every practice has one, usually on a consult room or reception machine, and it exists because it is convenient. It also means that when something happens you cannot tell who did it. If you take one thing from this section, it is that individual logins are the thing that makes everything else in your audit trail true.
6. A written breach plan, before you need it
The OAIC publishes a data breach action plan for health service providers with four steps: contain, evaluate, notify, review.
Contain means taking immediate steps to limit further access to or distribution of the affected information. Evaluate means working out whether the breach is likely to cause serious harm, and whether remedial action can remove that risk. Notify means telling affected individuals and the OAIC where the breach is an eligible one under the Notifiable Data Breaches scheme. Review means finding out how it happened and changing something.
Two health specific points sit inside that. All data breaches related to the My Health Record system must be reported to the Australian Digital Health Agency, whether or not serious harm is likely. And if the breach involves Medicare, Centrelink or Child Support information, Services Australia needs to hear from you too.
Your version of this should be one page, printed, with three names and three phone numbers on it: whoever makes the decision, your IT provider, and your practice indemnity insurer. The time to write it is not the morning you need it.
Then, and only then, the clever stuff
Telehealth, online bookings, digital forms, AI scribes. These are genuinely good, and several of them will save a practice real hours a week.
They also all depend on the six things above. An AI scribe writing into a practice management system with no working backup is a faster way to lose notes. Telehealth on a single internet service without failover is a cancelled clinic.
One step for today: ask whoever supports your IT to restore one file from last night’s backup and email it to you. If that takes longer than an hour, or produces an explanation instead of a file, you have found your first project.
If you would like a second opinion on how your practice is set up, get in touch.