Healthcare Cyber Security Assessment for GP Clinics and Medical Centres
One independent assessment of your cyber risks, your IT security and your compliance position, whatever clinical software you use.
Who this is for
GP clinics, medical centres, specialist and allied health practices, and their owners, managers and compliance leads, across Sydney, NSW, Melbourne and Victoria, and nationally by arrangement. It suits practices preparing for an audit, an accreditation review, a client request or simply wanting to know where they stand.
Whether you use Best Practice, MedicalDirector, Zedmed, a cloud-based clinical application, locally hosted servers or paper-based records, the assessment looks at how patient information is actually protected.
Three views of your security, in one assessment
Choose one, or combine them. We confirm the scope with you on a scoping call.
What could go wrong, and how badly
- Where patient data is stored and who can reach it
- Threats such as ransomware, phishing and account compromise
- Backups, recovery and third-party software risk
- Incident readiness and existing controls
How your systems are actually set up
- Computers, servers, updates and malware protection
- Network, Wi-Fi segmentation and remote access
- User accounts, passwords and multi-factor authentication
- Email protection and staff phishing exposure
What applies and what you could show
- Privacy Act 1988, APP 11 and the Notifiable Data Breaches scheme
- NSW or Victorian health privacy law and My Health Record, where relevant
- RACGP accreditation expectations, where accredited
- Policies, evidence and optional Essential Eight or ISO/IEC 27001 baseline
How the assessment works
- 01
Scoping call
We agree the scope, sites, systems and users involved, and any deadlines.
- 02
Review
We review documents, configurations and controls, and speak with your team, within the agreed scope and with written authorisation.
- 03
Rate the findings
Each finding is rated by likelihood and impact, explained in plain English and linked to the requirement it relates to.
- 04
Report and walkthrough
You receive a written report and a walkthrough with your team. Your IT provider can use it to fix the issues.
What you receive
- Cybersecurity risk register with prioritised ratings
- IT security audit findings with practical recommendations
- Compliance gap analysis and evidence register
- Prioritised remediation roadmap with suggested owners
- Executive summary for practice owners and managers
This is not penetration testing. If deeper technical testing is justified, vulnerability assessment and penetration testing is scoped and quoted separately. Remediation support is also available as a separately quoted service.
Where possible we review systems without accessing patient records, and agree any access in writing first. ISO/IEC 27001 certification and ASD Essential Eight maturity are not mandatory for every private medical practice; we use them only where you want a recognised baseline. We do not provide legal advice.
Is your practice cyber secure?
Find out where your practice may be exposed to cybersecurity risks and what improvements should be prioritised. We are independent and software-agnostic: we assess your whole IT environment, whether you use Best Practice, MedicalDirector, Zedmed, cloud applications, local servers or paper records.
Please do not send patient records or personal health information through this website or in your first email.
Discuss a Healthcare Cyber Security Assessment
Tell us about your practice and what you need reviewed. We reply to talk through scope, then send a written proposal.
Request a scoping callRelated pages
- Australian Privacy Act & APP 11 Security Assessment
- My Health Record Security Readiness Assessment
- Free Healthcare Cyber Security Score
- Ten healthcare scenarios
- Knowledge Centre
Content reviewed 24 October 2026. This page describes an independent gap assessment service, not a formal compliance certification or a legal opinion. Assessments do not guarantee regulatory compliance or prevent all cyber incidents.