DC
← Back to writing
Healthcare Security 9 min read September 2023

Data Security Deep Dive: Cybersecurity Legal Obligations for Australian Medical Practices

A Regulated Industry

The healthcare industry in Australia is highly regulated, with national and state laws governing how medical practices, pharmacies, allied health professionals, and other healthcare providers handle patient information and digital health records.

Many healthcare professionals may not be aware that their daily operations must comply with multiple cybersecurity and data protection laws. Key legislation includes:

  • The National Health Act 1953 --- Governs the Pharmaceutical Benefits Scheme (PBS) and mandates record-keeping requirements.
  • The My Health Records Act 2012 --- Regulates the My Health Record system, ensuring patient data is securely stored and shared.

The Importance of Cybersecurity in Healthcare

Healthcare providers have a duty of care to their patients. This includes protecting personal health information (PHI) to ensure:

  • Confidentiality --- Preventing unauthorised access to patient data.
  • Integrity --- Ensuring accurate and unaltered medical records.
  • Availability --- Guaranteeing timely access to critical health information.

In today’s digital environment, most medical practices, pharmacies, and hospitals store patient records electronically. This means that cybersecurity risks---such as data breaches, ransomware attacks, and unauthorised access---are now part of patient safety and clinical responsibility.

Key Legislation Impacting Cybersecurity in Australian Healthcare

1. The Privacy Act 1988 & Australian Privacy Principles (APPs)

The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs), which apply to all private healthcare providers in Australia.

APP 11: Security of Personal Information requires healthcare providers to take reasonable steps to protect patient data from:

  • Misuse & interference
  • Loss
  • Unauthorised access, modification, or disclosure

The Office of the Australian Information Commissioner (OAIC) has outlined security measures to help healthcare providers comply with APP 11, including:

  • Physical security controls --- Locks, alarm systems, access limitations.
  • Network and computer security --- User passwords, multi-factor authentication, logging, and auditing.
  • Communication security --- Encrypted emails, secure messaging for patient data.
  • Personnel security --- Staff training on handling sensitive information.

Healthcare providers must understand the types of patient data they store and implement strict security controls to remain compliant.

2. Data Retention & Secure Data Disposal

APP 11 also requires healthcare providers to dispose of or de-identify patient data when it is no longer needed. However, state legislation in NSW, VIC, and ACT requires medical records to be retained for years after the last service date.

Challenge: Healthcare providers must balance long-term data retention with data protection obligations.

Solution: Strong cybersecurity protections, including data encryption, access controls, and secure backup management, are necessary to protect long-held patient records from cyber threats.

3. Mandatory Data Breach Notification Scheme (NDB Scheme)

Since February 22, 2018, the NDB Scheme has required health service providers to report eligible data breaches to:

  • The OAIC
  • Affected individuals

A data breach is defined as the loss, unauthorised access, or theft of personally identifiable health data.

Does Your Healthcare Practice Need to Report Breaches?

Most small businesses with a turnover under $3 million are exempt from the Privacy Act. However, health service providers must report data breaches---regardless of size or revenue.

This applies to:

  • Private medical practices & doctors’ surgeries
  • Pharmacies
  • Allied health professionals (physiotherapists, psychologists, dietitians, etc.)
  • Private hospitals & day surgeries
  • Gyms & weight loss clinics

Failure to report a breach can result in:

  • Public apologies (damaging your reputation)
  • Compensation claims
  • Fines of up to:
    • $360,000 for individuals
    • $1.8 million for organisations

Every healthcare provider should have a Notifiable Data Breach Plan to detect, assess, and report data breaches promptly---including ransomware incidents.

Cybersecurity Best Practices for Australian Healthcare Providers

1. Establish a Cybersecurity Incident Response Plan

Healthcare providers must be prepared for cyber incidents. Key elements of an Incident Response Plan (IRP) include:

  • Identifying cyber threats (e.g., phishing, ransomware, insider threats)
  • Containing the breach to prevent further damage
  • Eradicating threats and recovering data
  • Notifying affected individuals and regulatory bodies
  • Reviewing & improving security measures

Medical practices should conduct regular cybersecurity drills to test their IRP.

2. Maintain a Secure IT Environment

Healthcare providers should implement strong technical controls, including:

  • Data encryption --- Protecting patient data in transit and at rest
  • Regular backups --- Ensuring offline, immutable backups in case of ransomware
  • Access controls --- Limiting data access to authorised personnel only
  • Security monitoring --- Logging and auditing system activity

Protecting patient data requires more than just antivirus software---it requires a multi-layered security approach.

3. Conduct Regular Cybersecurity Training

Staff are the first line of defense against cyber threats. Regular training on:

  • Recognising phishing scams
  • Handling sensitive patient data securely
  • Using strong passwords & multi-factor authentication (MFA)

A well-trained workforce reduces the risk of human errors leading to breaches.

Additional Cybersecurity Legislation Impacting Australian Healthcare Providers

Cybercrime Act 2001

Covers computer-related offences, including:

  • Unauthorised access & hacking
  • Data theft & fraud
  • Denial-of-Service (DoS) attacks

Spam Act 2003

Regulates email and SMS marketing for healthcare providers. Requirements include:

  • Gaining consent before sending marketing messages