A medical practice runs on trust. Patients hand over some of the most sensitive information they have, and they assume it is held safely. Most practice owners want that to be true. Far fewer can say, with confidence, that they know the actual state of their systems.
That gap between assumption and evidence is where the risk lives. An audit closes it. It turns “we think we are fine” into a documented picture of where you stand, and from there the path to a real cyber baseline is a matter of fixing the right things in the right order.
This is a 90-day plan to do that. It is built around the gaps that hit clinics hardest, because a practice that holds patient records, runs busy clinical areas, and brings in locums and visiting practitioners faces risks a typical office does not. For the broader picture for your sector, our guide to IT for medical practices sets the scene.
Why a Baseline, Not a Product
When clinics start worrying about cyber security, the instinct is to buy something: a new firewall, a security product, a tool a colleague mentioned. That is usually the wrong first move.
The right first move is a baseline. Patient data carries real weight under Australian privacy law, and a breach is not just an IT problem, it is a notification, a trust problem, and a disruption to care. A baseline gives you a clear read on your exposure so that any spending goes to the gaps that actually matter, not the ones a salesperson happens to be selling.
The goal over the next 90 days is a documented, honest picture of where your practice stands, with the biggest gaps closed in order.
The First 30 Days: See Where You Stand
You cannot protect what you have not mapped. The first month is about getting an honest picture, not buying anything.
Inventory every system that holds patient data or controls access: your clinical and practice management software, Microsoft 365, the systems that connect to pathology and imaging, any patient portal, and the devices in consult rooms and at reception. For each one, answer plainly: is multi-factor authentication actually enforced, or are you assuming?
Most practices find the surprise here. Multi-factor authentication is usually on for email and missing from the systems that hold the most sensitive data. Map it before you decide what to fix. Note too where devices in shared clinical areas sit logged in and unlocked, because that is a common and quiet exposure.
Days 30 to 60: Close the Clinic-Specific Gaps
With a clear picture, the second month closes the gaps that matter most in a clinical setting.
Patient data and privacy. Not everyone in the practice needs access to every patient record. Review who can see what, restrict access to what each role genuinely needs, and make sure access maps to the duties someone actually performs. Multi-factor authentication on the practice systems that hold patient data is the single control that does the most to keep a leaked password from becoming a breach.
Device lockdown in clinical areas. Consult rooms and reception are busy, and screens are often left open while staff move between patients. A short auto-lock timeout, screen privacy, and accounts that are personal rather than shared mean a passing glance or a wandering visitor cannot read or copy patient information. This is low-cost and high-value, and patients notice when a practice takes it seriously.
Locum and visiting practitioner access. Clinics bring people in and out constantly: locums, registrars, visiting specialists, agency reception. Each one needs the right access for the time they are there and nothing after. The common gap is an account that lingers long after the person has gone. Grant access by role, for a defined period, and remove it promptly when the engagement ends.
Tested clinical backups. A backup nobody has restored from is a guess, and for a clinic that means risking access to patient histories at the worst possible moment. Confirm your clinical records are backed up, tested on a schedule, and that at least one copy is protected so ransomware cannot encrypt or delete it.
Days 60 to 90: Make It Stick and Map It to a Standard
The final month turns the cleanup into something that holds.
Security drifts. A new locum account stays live, patching slips behind, a backup quietly stops running. The practices that stay secure are the ones with ongoing monitoring and reporting, so the state of the controls is visible rather than assumed. For a clinic with privacy obligations, that visibility is also your evidence that you are taking patient data seriously.
Everything in this plan maps to Essential Eight, the baseline controls published by the Australian Cyber Security Centre: multi-factor authentication, patching, tested backups, restricting access. You do not need to memorise the framework. You need the controls behind it working in your practice, which is what these 90 days deliver, and it significantly reduces the risk to the patient data you are trusted to hold.
Where to Start
If you cannot say with confidence where your practice stands, do not guess. Get a clear picture first, then close the biggest gaps in order.
Our IT maturity assessment gives you a plain-English read on your current security in a few minutes and shows what needs attention first. From there you can decide what to handle internally and what to hand over.
We are a Sydney-based team in Bella Vista, and we work with medical and healthcare practices across the metro area. We understand the way a clinic actually runs, busy, mobile, and bound by privacy obligations, and we secure it without getting in the way of patient care. Talk to our team when you are ready.
