If you run a medical practice, an allied health clinic or a day surgery, you are already handling the most sensitive category of personal information there is, under the same law that covers the banks. Most practice owners know that in principle. What catches them is how far the obligation reaches and how short the clock is when something goes wrong.
Two facts set the scene. Health service providers report more data breaches to the regulator than any other sector in Australia. And the small business exemption that covers most businesses under three million dollars in turnover does not apply to you.
The small business exemption does not cover a health service
The Office of the Australian Information Commissioner is direct about this. An organisation that provides a health service and holds health information is covered by the Privacy Act 1988, even if it’s a small business, and even if providing a health service isn’t its main activity.
The list of who that catches is wider than most people expect. GPs and medical specialists, private hospitals and day procedure centres, dentists, pharmacists, allied health professionals such as physiotherapists and psychologists, complementary medicine therapists, online and telehealth businesses, disability service providers that hold health information, and gyms or weight loss clinics at the point where they start collecting health information about clients.
If a two person podiatry clinic is covered, so is everyone reading this.
What the law actually asks for
The obligations sit in the 13 Australian Privacy Principles. All of them apply, but three do most of the work in a clinic.
APP 1 requires open and transparent management of personal information. In practice that’s a privacy policy that reflects what you really do, not a template with someone else’s practice name still in it.
APP 11 is the security one. It requires an entity to take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. “Reasonable steps” is deliberately not a checklist, which frustrates people. It scales with how sensitive the information is, and health information sits at the top.
APP 12 covers access. A patient can ask for the information you hold about them, and you need to be able to find it and provide it. That’s a records and systems question as much as a legal one.
The 30 day clock nobody remembers until they need it
Under the Notifiable Data Breaches scheme, an eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information you hold, where it’s likely to result in serious harm to someone and you haven’t been able to head that harm off with remedial action.
Two timeframes matter. If you suspect an eligible breach, you must take all reasonable steps to complete an assessment within 30 calendar days. The Commissioner treats that as a maximum, not a target. And once you form a reasonable belief that an eligible breach has occurred, you notify the affected individuals and the Commissioner as soon as practicable.
Thirty days sounds generous until you’re trying to work out which mailbox was accessed and for how long, without sign in logs. The work that makes an assessment possible is done long before the incident: logging turned on, retained, and reachable by someone who knows where to look.
Why your sector is at the top of the list
The OAIC reported 1,205 data breach notifications in 2025, an 8% increase on the 1,112 notified in 2024 and the highest year since the scheme began. Health service providers were the most affected sector, with 225 notifications, 19% of the total. Of all notifications, 716 were attributed to malicious or criminal attack.
Health data is attractive because it doesn’t expire. A leaked credit card is cancelled in a day. A patient’s diagnosis is theirs for life.
The technical baseline to work to
Australia’s practical benchmark is ASD’s Essential Eight. It was written for government but it’s the standard most Australian businesses are now measured against by insurers and larger customers. The eight strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
For a clinic, the order to attack them in is usually multi-factor authentication first, then backups you’ve actually tested, then restricting who holds administrator rights, then patching. Those four remove the majority of the risk and none of them require a new server.
Where practices actually come unstuck
Shared logins. One account on the reception machine that four people use is the single most common finding in a small practice. It’s convenient and it destroys your ability to answer the only question that matters after an incident: who accessed that record. Individual accounts, every time.
Passwords that have been used somewhere else. Over the twelve months to 18 August 2026, our service desk handled 68 password requests and resets across 44 client businesses. Every one of those is a moment where someone either reaches for the password manager or reaches for the one they use on everything. ASD’s guidance is a passphrase of four or more random words, unique per account, held in a password manager.
Practice software and third parties. Your practice management system, your billing provider, your transcription service and your cloud backup all hold or touch patient data. Their breach becomes your notification. Ask each one where the data is stored, who at their end can read it, and what they’d tell you within 30 days of an incident.
Staff who leave. Access that isn’t removed on the last day is the quietest risk in healthcare, because a former employee’s login rarely looks suspicious. Make offboarding a written checklist with a name against it.
Backups nobody has restored. A backup that has never been tested is a belief, not a control. Pick a file, restore it, write down how long it took.
Where to start
Do these in order, over a quarter rather than a weekend.
- Turn multi-factor authentication on for every account that touches patient data, starting with email.
- Get rid of shared logins.
- Test a restore, and diarise the next test.
- List every third party that holds or touches patient information, and ask each one the breach question.
- Write a one page incident plan naming who decides, who rings the IT provider, and who talks to patients.
- Review your privacy policy and your offboarding checklist against what you actually do.
Compliance for a clinic isn’t a project you finish. It’s a set of habits that make the hard day survivable.
The one step for today: pick one account that more than one person signs into, and give each of those people their own login.
If you’d like a second opinion on where your practice sits, get in touch.