Cybersecurity and resilience: A brief guide for medical practice

Cybersecurity is no longer a back-office technical matter for IT departments and specialists.  It is now a board-level responsibility with significant legal, regulatory and reputational consequences. A single breach can damage patient trust, interrupt operations and expose your practice to avoidable consequences. 

Legal considerations

Medical practices and practitioners, who handle sensitive health information of patients, are required to comply with the data security measures under the Privacy Act 1988 (Cth) (Privacy Act).

For board directors of a medical practice through a company structure (including a company trustee of a trust), they have a duty under the Corporations Act 2001 (Cth) (Corporations Act).

As a result of recent reforms to the Privacy Act and enforcement actions by the Australian Securities and Information Commissioner (ASIC), board directors are now expected to formally integrate cyber risk into their enterprise risk management frameworks.

• Corporations Act – Section 180: Director duty of care and diligence to exercise their powers and discharge their duties with care and diligence. ASIC has launched legal action against RI Advice Group Pty Ltd, HSBC Bank Australia Limited and FIIG Securities Limited in connection with cybersecurity incidents. All three companies are in the financial services industry, but the ASIC actions are relevant to all companies of any industry on the basis that companies are now expected to have adequate cybersecurity risk management in place and a failure to do so can be a breach of directors’ duties.  
• Privacy Act – Australian Privacy Principles 1 and 11: Taking ‘reasonable steps’ beyond technical security measures to protect and ensure the integrity of personal information throughout the information lifecycle, including implementing strategies in relation to governance, internal practices, processes and systems, and dealing with third party providers.
• Notifiable Data Brach Scheme under the Privacy Act – the mandatory reporting of breaches to the regulator and affected individuals provides visibility of compliance with relevant security standards and allows affected individuals to mitigate personal risk.
• Contractual obligations – companies will enter into contractual arrangements with third parties (including suppliers) where they are likely to have obligations that relate to the retention and security of information. In the medical industry, this will inevitably include contracts with IT providers and practice management software businesses that involve the sharing of patient data (in addition to employee and supplier information).

How this impacts medical practices

According to the Office of that Australian Information Commissioner (OAIC), the health sector consistently reports the highest volume of data breaches with recent data showing it's the most targeted industry.

These developments should compel medical practice owners to invest in strong cyber strategy measures – not just IT-focused approaches, but rather governance led in which decisions are made from an overall organisational strategy to take reasonable steps to protect the integrity of personal data. This includes IT solutions as well as employee training and strong contractual protections with third party providers.

Reasonable steps your practice can take now

It is worth downloading our self-assessment tool and following along as you read this article. If you answer no or unsure to any section, it may be a sign that your practice is exposed to cyber risks and may not meet privacy or security expectations. 

Each section below expands on an area raised in the self-assessment to help you understand its impact on your business and also to facilitate compliance with legislative requirements and contractual obligations:

• Cybersecurity and automated systems: A strong cybersecurity framework begins with understanding your systems. Every practice should know when it last reviewed its cybersecurity protections, including automated processes such as data back-ups and file transfers. Regular assessments help confirm that your technology is working as intended and that your systems are resilient to attacks. 
• IT team and vendor management: Your IT support plays a critical role in protecting your practice. Stability in your IT team reduces errors, miscommunication and overlooked risks. When you bring in external IT vendors, due diligence is essential. You need clarity about their capabilities and contracts that outline responsibilities, response times and security standards. 
• Employee training and cyber awareness: Your employees are often the first line of defence. Staff should receive regular training on how to identify suspicious emails, unusual activity and potential threats. Without this training, even the best security systems can fail. A well trained team helps prevent cyber complacency and ensures issues are reported quickly. 
• Systems, tools and technical protections: Every practice needs tools that can block harmful websites, monitor systems for unusual activity and filter suspicious emails. Consistent back ups of patient records and practice data are essential for keeping your information safe if something goes wrong. Updated anti virus and end point security software then add another layer of protection by reducing the risk of ransomware attacks and helping secure every device connected to your network. 
• Internal protocols and response plans: Cybersecurity is not only about prevention. It is also about knowing what to do when something goes wrong. Your practice should have internal rules that restrict who can access sensitive information. You also need a clear business continuity plan that guides your response to a cyber attack and outlines who must be notified, including key stakeholders and regulators. 
• Privacy and security documentation: Policies should be reviewed regularly to make sure they reflect current risks and legal requirements. This includes your privacy policy, website terms and conditions, patient forms, acceptable use policies and your data breach notification policy. Up to date documents help protect your business and show that you take privacy obligations seriously.