What gets in the way
- Care workers on the road all day. Visit details, care notes and messages to coordinators all happen on a phone between homes, so the phone has to be as well looked after as the office PC.
- Records that must be accurate and private. The strengthened standards expect a system that securely manages records and gives the right people the right information at the right time, and nobody else.
- Care doesn’t stop when the system does. If the care management system, the internet or the phones go down, workers still need to know who they’re seeing and what each person needs.
- A busy coordination line. Older people, families and hospitals all ring the same office. Calls need to reach a person, and after-hours calls need somewhere sensible to go.
How we help
- Microsoft 365 & Identity: Multi-factor sign-in for every worker and sign-in rules that keep the care management system and shared mailboxes closed to places your team never works.
- Managed Security Tiers: Endpoint protection on every office device, and on the Fortress tier, device and app management on workers’ phones so work data comes off a lost or departing worker’s phone the same day.
- Backup & Recovery: Backups of Microsoft 365 and your records with scheduled test restores, plus an offline plan for the critical details workers need when systems are down.
- Business Telephony: A hosted phone system with queues for the coordination line, after-hours routing and calls that follow coordinators to their mobile when they’re out.
- Security Awareness: Training for office staff and care workers on the scams aimed at them, including fake invoices and messages pretending to be a family member or the provider.
Obligations worth knowing
- From 1 November 2025 the Support at Home program replaced the Home Care Packages and Short-Term Restorative Care programs, and providers are registered in categories. Source
- Outcome 2.7 of the strengthened Quality Standards expects an information management system that securely manages records, and the Commission’s guidance asks providers to manage cyber security risks and keep critical information available when digital systems are offline. Source
- Outcome 2.10 expects emergency and disaster management plans that are put in place, shared with workers and people receiving care, and regularly tested and reviewed. Source
- Organisations covered by the Privacy Act must notify affected people and the OAIC when a data breach is likely to result in serious harm. Source
Offline doesn’t have to mean unavailable
The Commission’s guidance is direct about it: there should always be a way to reach critical information when digital systems are offline. In practice that means knowing which details a care worker can’t do without, keeping a current copy they can reach without the main system, and testing a restore through backup and recovery before the day you need one.
The phone line is part of the care
For many older people the phone is how they reach you. A hosted phone system can queue calls to whoever is free, send after-hours calls to the on-call person and keep working if the office itself is closed by a storm or a power cut.
Every worker, every device
Care workers start and finish often, and each one carries care notes on a phone. Multi-factor on every account through Microsoft 365 and identity, a leaver checklist that runs the same day, and device management that can remove work data from a phone are the controls an auditor and an older person’s family would both expect.