Australian Privacy Act and APP 11 Security Assessment for Healthcare
Assess whether your practice is taking reasonable steps to protect patient information, and whether it is ready to respond to a data breach.
Who this is for
Private medical centres, GP clinics and healthcare providers that handle health information. Health information is sensitive information under the Privacy Act 1988, and private health service providers are generally covered. We help you check how the Act applies to your practice.
Whether you use Best Practice, MedicalDirector, Zedmed, a cloud-based clinical application, locally hosted servers or paper-based records, the assessment looks at how patient information is actually protected.
What we assess
- 01
Reasonable steps under APP 11
Whether the security measures in place are reasonable for the sensitivity of the patient information you hold, protecting it from misuse, interference, loss and unauthorised access, modification or disclosure.
- 02
Access and authentication
Who can see patient information, how access is granted and removed, and how logins are protected.
- 03
Data protection and backups
Protection of patient data in clinical software, local computers, email and paper files.
- 04
Suppliers and cloud services
Where patient data is stored by third parties and what your arrangements say about security.
- 05
Breach readiness
Whether you can recognise, assess, contain and notify an eligible data breach under the Notifiable Data Breaches scheme.
- 06
NSW health privacy law
Whether the NSW Health Records and Information Privacy Act 2002 or the Victorian Health Records Act 2001 may also apply to your practice.
How the assessment works
- 01
Confirm applicability
We confirm which privacy duties are likely to apply to your practice.
- 02
Review practice
We review controls, policies and records within the agreed scope.
- 03
Test breach readiness
We walk through a realistic breach scenario with your team.
- 04
Report and plan
You receive findings and a prioritised plan.
What you receive
- APP 11 security gap assessment
- Data breach readiness review, including a response outline
- Recommendations to strengthen reasonable steps
- Prioritised remediation roadmap
Under the Notifiable Data Breaches scheme, a suspected eligible breach should be assessed promptly, and the OAIC treats 30 days as the outer limit for completing the assessment.
This is a security assessment, not legal advice. Official guidance is on the OAIC website.
Is your practice cyber secure?
Find out where your practice may be exposed to cybersecurity risks and what improvements should be prioritised. We are independent and software-agnostic: we assess your whole IT environment, whether you use Best Practice, MedicalDirector, Zedmed, cloud applications, local servers or paper records.
Please do not send patient records or personal health information through this website or in your first email.
Discuss a Healthcare Cyber Security Assessment
Tell us about your practice and what you need reviewed. We reply to talk through scope, then send a written proposal.
Request a scoping callRelated pages
- Healthcare Cyber Security Assessment
- My Health Record Security Readiness Assessment
- Free Healthcare Cyber Security Score
- Ten healthcare scenarios
- Knowledge Centre
Content reviewed 24 October 2026. This page describes an independent gap assessment service, not a formal compliance certification or a legal opinion. Assessments do not guarantee regulatory compliance or prevent all cyber incidents.