Patient records are a prime target. We put practical, audited security in place for GP, specialist and allied health practices: Essential Eight controls, multi factor authentication, monitored endpoints and email, tested backups and a breach response plan your team can actually follow.
Next step: get your Essential Eight readiness score, or book a security review. Prefer to talk now? Call 1800 316 529.
GP practices and medical centres that hold patient records in a practice management system and Microsoft 365.
Specialist and allied health practices with a small team and no in house security staff.
Practices preparing for RACGP accreditation or answering a cyber insurance questionnaire.
Practices with an existing IT provider that want security run as a co managed service alongside it.
Radiology and imaging practices have extra exposure through modalities, PACS and remote reporting, so they have their own page: cyber security for radiology, linked below.
Proof a practice principal can verify
Trucell has operated since 2005. These are the signals we bring to accreditation, insurer and procurement conversations.
Certified security management
ISO/IEC 27001:2022 certified (certificate 500-27285-IS), with an annual SOC 2 Type II report. See certifications.
Health information is valuable, practices run on a small number of shared systems, and downtime stops patient care. Many incidents start with one of a few familiar gaps, so that is where we start.
•A phished password on an account without multi factor authentication.
•An unpatched system or application left exposed.
•A backup that was never restored, so recovery is a hope rather than a plan. See backup and recovery.
A security incident that involves patient information can also be a notifiable data breach, so security and breach readiness belong in the same plan. Our Essential Eight guide for medical practices explains the controls in plain language.
What we put in place
Practical controls, implemented and documented so you can show them to an accreditation reviewer or insurer.
Identity and access
Multi factor authentication on email, remote access and clinical systems, individual logins (no shared reception accounts), and access removed the day staff leave.
Essential Eight controls
Application control, patching of applications and operating systems, macro settings, user application hardening, restricted admin privileges and regular backups, implemented to a target maturity level and documented. See Essential Eight and the Essential Eight uplift packages.
Monitored endpoints and email
Endpoint detection and response on every workstation and server, monitored by a security operations team, plus email filtering. See managed security services and SOC and SIEM.
Backups that survive ransomware
Immutable, off site backups of the practice database and documents, with recorded restore tests. See backup and recovery and SaaS backup for Microsoft 365.
Breach readiness
A short incident response plan, contact list and decision tree for the Notifiable Data Breaches scheme, rehearsed with the practice manager.
Imaging archives need backup and restore testing sized for study volumes.
Cyber security for medical practices FAQ
What practice principals and managers ask about security, accreditation and breaches.
Is the Essential Eight mandatory for private medical practices?
It is mandatory for non corporate Commonwealth entities, not for private practices. It is still the clearest Australian baseline, and insurers and accreditation reviewers increasingly ask about it.
What maturity level should a medical practice aim for?
Most practices should aim for Maturity Level One across all eight strategies first, then move to Level Two for the controls that matter most to them, usually MFA, patching and backups.
What must a practice do after a data breach?
The Notifiable Data Breaches scheme sets out when a breach has to be reported to the OAIC and to the people affected. We help you contain a suspected breach, work through the assessment and prepare what a notification needs.
Do you replace our existing antivirus?
Usually yes. We move practices to monitored endpoint detection and response so threats are investigated by people, not just logged.
Can you work with our current IT provider?
Yes. We can run security as a co managed service alongside your existing provider, or take over IT entirely.
How long does an Essential Eight uplift take?
It depends on the size of the practice and its starting point. After the review we give you a written plan with the order of work, starting with the urgent items.
Find your biggest security gap this week
Start with the Essential Eight readiness score, or call us and we will walk through where your practice stands on MFA, patching, backups and breach readiness.
On the call, mention your practice software, whether you use Microsoft 365, how many staff and sites you have, and any accreditation visit or insurance renewal coming up.
Explore related areas
Security work usually touches more than one of these.
