RemoteIT for medical practices
Health was the most breached sector in 2025. Size doesn't exempt a practice.
The Privacy Act covers every health service provider, whatever its turnover, and My Health Record adds its own security rules. Here is what applies to a practice, the controls that matter most, and a 10-point check for GPs, specialists and allied health.
Details from the OAIC and the Australian Digital Health Agency, checked 31 October 2026. General information, not legal advice.
- Obligations explained
- My Health Record rule 42
- 10-point check
Reviewed by Blake Bath, General Manager, on 31 October 2026.
What we find
Five IT gaps we see in practices.
Each one is a privacy risk as well as an IT one.
Shared logins
One reception login, or a doctor's account left open on a shared PC.
- Named accounts
- Fast user switching
- Auto-lock
Leavers and locums
Accounts that outlive the contract.
- Last-day removal
- Locum process
- Quarterly review
Patient data on USB
Reports and images carried home on unencrypted drives.
- USB blocked
- Secure sharing
- Encryption
Untested backups
The clinical database backs up nightly. Nobody has restored it.
- Restore test
- Off-network copy
- Recovery time known
Email takeover
A practice manager's mailbox used to send fake invoices to suppliers.
- MFA
- Rule alerts
- Payment checks
Medical practice IT check
How ready is your practice?
Tick what is true today. You get the gaps in the order we would close them.
Tick what is true for your practice today.
Where you stand
0of 10 controls in place
10 gaps to close.
- Every person has their own login to clinical softwareMy Health Record rules require each user to be identified on every access.
- MFA on email, clinical software and remote accessA taken-over mailbox is the usual start of a practice breach.
- Access matches the roleAccess beyond the role is a privacy risk on its own.
- Leavers and locums lose access on their last dayAccounts must be deactivated when duties change or someone leaves.
- A My Health Record security and access policy, reviewed this yearRule 42 requires it, reviewed at least annually.
- Staff trained before they get accessTraining must come before authorisation under the My Health Record rules.
- Clinical data backed up apart from the network, restore testedA practice cannot see patients without its records.
- Encrypted, managed devices onlyA lost device with patient data is a likely notifiable breach.
- Email protected against spoofing and phishingFake referrals and invoices target practices.
- A breach plan with OAIC and My Health Record stepsHealth information breaches are often likely to cause serious harm.
What applies
The obligations that shape practice IT.
| Obligation | What it means for IT | Applies to |
|---|---|---|
| Privacy Act and APP 11 | Reasonable steps to protect health information, which is sensitive information | Every health service provider, regardless of turnover |
| Notifiable Data Breaches | Assess suspected breaches; notify the OAIC and patients where serious harm is likely | Every health service provider |
| My Health Record (rule 42) | Written security and access policy, reviewed at least annually; training before access; unique user identification | Registered healthcare provider organisations |
| State health records laws | Additional requirements in some states, such as Victoria and New South Wales | Practices in those states |
| RACGP Standards | Information security expectations for accredited general practices | General practices seeking accreditation |
General information only. Check your obligations with your medical defence organisation, accreditor or legal adviser.
Rule 42
What your My Health Record policy must cover.
- Authorising and removing accessHow staff are given access, and how it is suspended when they leave or their duties change.
- Training firstUsers trained before they are authorised, with a training register.
- Identifying each userEach access tied to an individual, usually through the clinical software.
- Security and accountsPhysical and information security, access by role, unique IDs, compromised accounts suspended promptly.
- Incidents and reportingHow security risks and breaches are identified, acted on and reported.
- Version and reviewVersion number, date of effect, every version kept, reviewed at least annually.
What good looks like
The controls that matter most in a practice.
- Named logins and MFAEvery person, every system. Phishing-resistant for managers and admins.
- Access by roleClinical, nursing, reception and billing see what their job needs.
- Managed devicesEncrypted, updated, lockable and wipeable, including tablets.
- Separate, tested backupsClinical data, documents and email, with a known recovery time.
- Email protectionFiltering, DMARC at reject and payment verification.
- Monitoring and auditSign-ins and mailbox rules watched; clinical software audit logs reviewed.
Our view
Fix logins and leavers first.
The quickest wins in a practice are almost always identity: everyone on their own login, MFA on email and clinical software, and a process that removes locums and leavers on their last day. Those also satisfy the core of the My Health Record rules.
Then we make sure the practice could keep seeing patients after an incident, with clinical data backed up apart from the network and a restore that has actually been tested.
The order
Securing a practice in five steps.
- Step 1Named logins and MFA
Everyone, every system.
- Step 2Leavers and roles
Last-day removal, access by role.
- Step 3Policy and training
My Health Record policy reviewed, staff trained.
- Step 4Backups and devices
Tested restore, managed devices.
- Step 5Plan and monitor
Breach plan, sign-in and mailbox alerts.
Related guides
Practice IT in depth. Start with logins.
Sign-in, data, onboarding and incidents.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What practices ask about IT and privacy.
Does the Privacy Act apply to small medical practices?
Yes. The Privacy Act covers any business that provides a health service and holds health information, regardless of turnover. The small business exemption does not apply.
What does My Health Record require of a practice's IT?
A written security and access policy under rule 42, reviewed at least annually. It covers how staff are authorised and deactivated, training before access, identifying each user on every access, security and account controls, and how you respond to and report security incidents.
How common are data breaches in healthcare?
Health service providers were the most affected sector in 2025, with 225 of the 1,205 notifications to the OAIC (19%), according to the OAIC's statistics released in July 2026.
Can reception and clinical staff share a login?
No. Each person needs their own login so access can be attributed. Shared logins break the My Health Record requirement to identify each user and make any investigation guesswork.
Is our cloud clinical software backed up?
The provider protects its platform, but check what you can restore and how fast, and whether you can export your data. Back up email, documents and anything stored locally separately, and test a restore.
What should we do first after a suspected breach?
Contain it, then assess whether it is likely to cause serious harm under the Notifiable Data Breaches scheme. Follow your My Health Record policy for incidents involving the system, call your insurer, and get help preserving evidence. This is general information, not legal advice.
Next step
Want an IT assessment built for a medical practice?
We review logins, access by role, your My Health Record policy, backups and devices, then give you a prioritised plan and evidence for your accreditor and insurer.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. Regulatory details from the OAIC, the Australian Digital Health Agency and the RACGP. General information only, not legal advice. Checked 31 October 2026. OAIC, Small business and the Privacy Act; OAIC, Data breach notifications increase to all-time high in 2025; My Health Record, Security and access policy checklist; OAIC, Security and access policies: rule 42 guidance; RACGP, My Health Record security and privacy requirements