Cybercriminals love healthcare — AI could be making it easier

Despite growing awareness of cyber threats, Australia’s healthcare sector continues to report the highest number of data breaches of any industry — a trend that has held steady for six years¹. For medical practices, the risks are real and rising. Sensitive patient data, reputational damage, and regulatory consequences all hinge on the strength of your cybersecurity framework. Why do I need separate indemnity cover if my hospital employer provides it? 

Why healthcare remains a prime target 

Healthcare data is one of the most valuable forms of information for cyber criminals. The recent Genea Fertility breach brought this into sharp focus, exposing Medicare numbers, medical diagnoses, and fertility treatment details of thousands of patients². The fallout included identity theft risks and significant emotional distress, given the personal nature of the information. 

However, the appeal to cybercriminals goes beyond just data value. Medical practices vary widely in size and digital maturity. Many are under financial pressure, and cybersecurity often competes with clinical priorities for funding. This combination creates vulnerabilities, leading to outdated systems, limited staff training, and gaps in incident response planning. 

The impact of digital transformation in healthcare 

These existing vulnerabilities are becoming more complex as digital transformation reshapes healthcare. While new technologies bring efficiencies, they also introduce fresh risks that many practices aren't prepared for. Many practice staff are already using AI-powered tools, like scribes, diagnostic aids, imaging analysis, and chatbots, which are increasingly embedded in everyday workflows.  

The impact of these fast-evolving technologies on healthcare includes: 

• Efficiency and workflow improvements – AI tools can streamline clinical documentation, assist in diagnosis, and enhance patient engagement. This can reduce administrative burden, improve accuracy, and free up time for patient care. However, practices should have clear protocols for reviewing AI-generated content and ensure staff understand where clinical oversight is required to avoid errors that could lead to liability. 
• Legal and ethical responsibilities – When AI influences clinical decisions, practices must update privacy policies and inform patients. Diagnostic and decision-support tools are regulated by the Therapeutic Goods Administration (TGA), while AI scribes currently are not. Nevertheless, doctors remain ultimately responsible for the accuracy of their clinical notes. 
• Cybersecurity and data privacy – Protecting sensitive data is essential. Only use closed-source AI tools designed for medical use, trained on Australian healthcare data, and compliant with local privacy laws. Informed patient consent is critical, and patients must understand how their data is used.  Where AI training data is de-identified, it’s not considered personal information under the Privacy Act, but re-identification risks remain. The OAIC’s recent review of I-MED’s practices found their de-identification approach met expectations, highlighting the need for robust processes. 
• Risk management and compliance – Practices must assess AI providers’ cybersecurity protocols, checking how data is stored, encrypted, and whether it’s shared or retained. If data is stored overseas, additional privacy obligations apply. Robust protocols for data breaches and system failures must be in place. 

Strengthening cybersecurity in an AI-enabled environment

Given these expanding digital touchpoints and their associated risks, practices need a comprehensive approach to cybersecurity that evolves with their technology use. As AI tools become more embedded in healthcare, they bring new cybersecurity challenges. Without a strong cyber and privacy framework, practices are more exposed to risks like data breaches, misuse, and system vulnerabilities.

Email security remains critical

One of the most persistent vulnerabilities continues to be email communication. According to the OAIC’s Notifiable Data Breaches Report, most human error breaches involve emails, while malicious attacks are still the leading cause overall. To reduce risk, practices should have clear protocols for managing incoming and outgoing emails, including steps to take when mistakes happen. Staff training, regular refreshers, and a culture of accountability are essential.

Building baseline defences

Beyond email security, a good starting point for comprehensive protection is the Essential Eight, a set of baseline strategies from the Australian Cyber Security Centre designed to help organisations defend against common threats. When combined with ongoing evaluation and tailored safeguards, these measures can help practices stay secure in a rapidly evolving digital landscape. 

What’s more,  with the Cyber Security Act 2024 introducing mandatory reporting for cyber extortion, staying compliant and proactive is more important than ever. 

Getting the right support 

For practices navigating this complex cybersecurity landscape, professional support and appropriate insurance covers are essential safeguards. 

If you are a victim of a cyber-attack on your practice and you are an Avant practice policy holder, you can contact the medico-legal advice team here, or call 1800 128 268, 24/7 in emergencies.  

Not an Avant practice policy holder? Protect your practice with Avant’s extensive practice indemnity and complimentary cyber cover, for eligible practices. Learn more about our policies here.

References 

1. Burnside T. Why Australian healthcare can’t shake its cyber problem [Internet]. Medical Republic. 2025 Jul 9 [cited 2025 Jul 29]. Available from: https://www.medicalrepublic.com.au/why-australian-healthcare-cant-shake-its-cyber-problem/118228 
2. Whitson R. IVF giant Genea confirms sensitive patient health information on dark web [Internet]. ABC News. 2025 Jul 23 [cited 2025 Jul 29]. Available from: https://www.abc.net.au/news/2025-07-23/ivf-giant-genea-confirms-sensitive-patient-information-stolen/105562042