Guarding your practice against cyber threats: Real-life lessons and practical tips
Tuesday, 29 April 2025

Cybersecurity is a crucial aspect of running a medical practice. An Avant webinar on cybersecurity and privacy highlighted an all-too-common scenario, the ramifications, and practical tips to help protect your practice.
The phishing email
Mary*, a receptionist at a busy medical practice, received an email that looked like it was from their telecommunications provider. The email included a link to view an outstanding bill. After clicking the link and entering her Microsoft 365 email and password, Mary realised there was no bill.
The next day, patients started calling about emails they received from the practice, asking them to click a link to view their test results. It turned out the email was a phishing attempt. By entering her credentials, Mary had unknowingly given hackers access to the practice's email account. The hackers then used this access to send phishing emails to patients.
To prevent these kinds of incidents, it's crucial to implement multi-factor authentication (MFA) to add an extra layer of security and prevent unauthorised access even if passwords are compromised. Regularly training staff to recognise phishing emails and other cyber threats is also essential. Additionally, avoid using email as a storage system for sensitive information; instead, transfer important data to secure storage locations and delete unnecessary emails.
The network compromise
Following the phishing attack, the practice's IT provider conducted a thorough threat hunt to check for any further network compromise. They discovered the entire email inbox, containing five years of emails, had been downloaded by the hackers. This meant the hackers had access to a significant amount of sensitive patient information.
To mitigate these risks, it's important to ensure all critical data is backed up regularly and stored securely, separate from the main network. Engaging an external IT provider with healthcare experience can help implement robust cybersecurity measures and conduct regular security audits. Additionally, developing a contingency plan to prepare for cyber incidents and ensure operations can continue if systems are compromised is vital.
The data breach notification
The practice, with the help of a law firm, assessed the data breach and determined it was likely to cause serious harm to individuals. They notified the Office of the Information Commissioner (OAIC) and took steps to contact affected patients. The practice reviewed all emails to identify affected individuals and notify them about the breach, providing guidance on how to protect their data.
To handle such situations effectively, it's important to be aware of the requirements under the Notifiable Data Breach scheme and take appropriate steps to notify affected individuals and authorities. Working with legal and public relations experts to create clear and concise communications for patients is crucial. Plus, providing support to staff involved in the incident to manage stress and ensure they understand the steps being taken to resolve the issue is key.
The importance of cyber insurance
Despite best efforts to prevent cyber incidents, they can still occur. Cyber insurance, such as the one offered through Avant Practice Medical Indemnity Insurance, can provide protection and support in the event of a cyber-attack. It can cover cyber incidents involving digital asset damage, extortion, and reputational damage.
Key lessons:
- Implement multi-factor authentication (MFA): MFA adds an extra layer of security, making it harder for hackers to access your systems.
- Train staff regularly: Regular staff training ensures everyone can recognise and respond to cyber threats.
- Ensure regular backups and engage an external IT provider: Regularly back up critical data and store it securely, separate from your main network. An external IT provider with healthcare experience can help implement strong cybersecurity measures and conduct regular audits.
- Develop a contingency plan: Have a plan in place to maintain operations during a cyber incident.
- Understand legal obligations: Understand your legal obligations under the Notifiable Data Breach scheme to ensure timely notification of affected individuals and authorities.
- Consider cyber insurance for financial protection and expert support: Cyber insurance provides financial protection and expert support in the event of a cyber-attack, covering costs like data recovery, legal fees, and reputational damage.
More information
If you are a victim of a cyber-attack on your practice and you are an Avant practice policy holder, you can contact the medico-legal advice team here, or call 1800 128 268, 24/7 in emergencies.
Not an Avant practice policy holder? Protect your practice with Avant’s comprehensive practice indemnity and complimentary cyber cover for eligible practices. Learn more about our policies here.
Useful resources
Avant webinar: Protecting your practice: A webinar on cybersecurity and privacy
Avant case study: Unauthorised access to patient records
Avant factsheet: Storing, retaining, and disposing of medical records
Avant factsheet: Responding to a cyber security incident
*Fictional character
Disclaimers
Avant Practice Medical Indemnity Insurance is issued by Avant Insurance Limited ABN 82 003 707 471, AFSL 238 765. The policy wording is available at www.avant.org.au or by contacting us on 1800 128 268. Practices need to consider other forms of insurance including directors’ and officers’ liability, public and products liability, property and business interruption insurance, and workers compensation. Avant Cyber Insurance cover is available to eligible Avant Practice Medical Indemnity Policy holders up to the cessation of their policy and is provided under a Group Policy between Liberty Mutual Insurance Company ABN 61 086 083 605 (Liberty) and Avant Insurance.
IMPORTANT: This publication is not comprehensive and does not constitute legal or medical advice. You should seek legal or other professional advice before relying on any content, and practise proper clinical decision making with regard to the individual circumstances. Persons implementing any recommendations contained in this publication must exercise their own independent skill or judgement or seek appropriate professional advice relevant to their own particular practice. Compliance with any recommendations will not in any way guarantee discharge of the duty of care owed to patients and others coming into contact with the health professional or practice. Avant is not responsible to you or anyone else for any loss suffered in connection with the use of this information. Information is only current at the date initially published.
More ways we can help you
Our CPD courses for Avant members
Tick off some CPD hours and learn more with our in-depth eLearning courses, free for Avant members. Our courses include education activities, reviewing performance and measuring outcomes.