Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All industries // ALLIED HEALTH

Health records are the most protected data you can hold

Managed security and IT for Australian allied health practices, built around sensitive information, practice management software and the reality of a clinic's budget.

Talk to us about your practice
 Free, no access needed See what you are exposing
// WHAT YOU ARE ACTUALLY UP AGAINST

The obligations and pressures, in plain English

The specific pressures on allied health in Australia, with the regulator or source named. Where a duty comes from a contract or an insurer rather than a statute, it says so.

01

Health information is sensitive information

Under the Privacy Act, health information is sensitive information, with stricter rules on collection, use and disclosure than ordinary personal information. Organisations that provide a health service and hold health information are covered by the Act whatever their turnover.

02

Health breaches often meet the notification test

Health service providers regularly report more notifiable data breaches than any other sector in the OAIC's published statistics. A breach is notifiable where there is unauthorised access to, disclosure of or loss of personal information that is likely to result in serious harm, and remedial action has not prevented that harm. Clinical information makes serious harm more likely, so each incident needs a real assessment against those criteria rather than an assumption in either direction.

The OAIC on when to report a data breach

03

Retention runs for years, not months

In Victoria and New South Wales, for example, health records legislation requires records of adults to be kept for seven years from the last occasion of service, and records of children until they turn twenty five. Other states and territories set their own rules. Either way you are protecting data you cannot delete, on systems that will change several times in that window.

04

My Health Record raises the bar again

Practices registered for My Health Record must have a written security policy covering matters such as staff access and training. Unauthorised access to a record by a staff member can be a breach in the same way that access by an outside attacker can.

My Health Record for healthcare providers

// WHAT ACTUALLY GOES WRONG

Four patterns we keep seeing

Practice software that cannot be patched

Clinical systems are often old, sometimes on-premise, and frequently unsupported. Replacing them is disruptive and expensive, so the real answer is usually isolation and compensating controls rather than avoidance.

Curiosity, not attackers

A meaningful share of health breaches are internal: a staff member looking at a record they had no clinical reason to open. Access controls and reviewed audit logs are the main way to catch it.

Reception is the front line

Front desk staff handle Medicare details, identity documents and referrals all day under time pressure. They are the people phishing is aimed at, and usually the people who get the least training.

The shared drive that grew

Scans, referrals and reports accumulate in folders nobody has reviewed since the practice was half the size, generally readable by everyone.

// FROM THE FIELD

Two findings nobody would have fixed, and what they did together

A scan had already found both issues and rated them low and medium. Manual testing showed that one ordinary signed-in account could read other patients' clinical records, and that the low one made real accounts easier to target. This is the part of a penetration test that automation cannot do.

Read the write-up
// WHERE TO START

What matters most for allied health, in order

01

Managed Security

Monitoring and response across the devices and identities in the clinic, including the ones running practice software that cannot be modernised yet.

 02

Security Baseline Assessment

Fixed price and read-only. It shows who can reach the patient information held in your Microsoft 365 email, files and accounts.

 03

Cybersecurity Governance and Compliance

The written policies My Health Record participation requires, plus staff training and a tested response plan.

 04

Security Assessments and Penetration Testing

Testing the booking portal or patient-facing application before someone else does.
// ASKED BY ALLIED HEALTH CLIENTS

Frequently asked questions

The obligations under the Privacy Act do not scale down with your size, and neither does the harm to a patient whose clinical history is exposed. What should scale is the spend. Two free tools are a reasonable first step. The Essential Eight readiness checklist asks for nothing and reflects your own answers about your controls. The Exposure Check needs a work email at your domain and shows what your domain reveals to the outside world. Neither can see inside your systems. Looking at the configuration itself is what the Security Baseline Assessment does.

Run the free Exposure Check

Partly, and it is worth reading your agreement to see exactly how far. Their hosting is their responsibility. Your staff accounts, the devices those accounts are used on, your email and who in the practice can see which records remain yours, and that is where many incidents begin.

It is a common cause of health breaches, and it is only detectable if access is logged and someone reviews the logs. The Security Baseline Assessment reads your Microsoft 365 and Entra configuration and reports whether audit logging is enabled and how long logs are kept. Being read-only, it does not switch anything on. If logging needs enabling, that is a separate change made only with your permission. Access logging inside your practice management software is a question for that system and its vendor.

Yes. The assessment is read-only and nothing is installed, so patients and clinicians will not notice it happening. Remediation is staged around your schedule, and anything likely to disrupt clinics is flagged and agreed before it goes anywhere near a consulting day.

Working nationally from Melbourne, Victoria. How the national service works, or see the other sectors we write about.

Tell us what you are protecting.

Get in touch