An I.T. checklist for GP and allied health practices

The RACGP's Information security in general practice guide supports Criterion C6.4 of the Standards for general practices (5th edition). It is written for GPs, but the same controls suit physiotherapy, psychology, podiatry and other allied health practices that hold health records. This checklist turns the guidance into tasks a practice manager can tick off. It is a plain-English summary, so check the Standards and the OAIC guidance, or ask your adviser, before relying on it for accreditation or legal purposes.

Criterion C6.4 at a glance

Criterion C6.4 has seven indicators. Your practice:

• A: has a team member with primary responsibility for electronic systems and computer security
• B: does not store or leave patient health information where the public could see or access it
• C: limits clinical software access to unique individual identification, matched to each person's level of authorisation
• D: has a business continuity and information recovery plan
• E: has procedures for storage, retention and destruction of records
• F: has a policy about the use of email
• G: has a policy about the use of social media.

1. People and governance

• Name your information security lead. The RACGP describes this person as knowing who to contact for expert advice, training staff on data security and monitoring compliance.
• Write position descriptions that state each role's security responsibilities and system access.
• Get signed agreements from external I.T. providers. The RACGP lists these as part of the business continuity plan.
• Have a written privacy policy. It is a must under several C6.4 indicators.

2. Know what you have

The RACGP says your practice should maintain an asset register. It should cover:

• physical assets: computers, network gear, phones, tablets, connected medical devices, backup drives and UPS units
• information assets: data stores, files, images, manuals, and continuity and recovery plans
• software assets: operating systems, clinical and admin applications, licence keys and installation media
• contacts for staff and suppliers such as your internet, phone and cloud providers.

3. Logins and access

• Every person has their own login to clinical software. No shared accounts and no shared passwords.
• Access matches the role. Reception does not need the same access as clinicians.
• Passwords meet a minimum length, are not reused and are changed immediately if compromised.
• Use two-factor or multi-factor authentication. The RACGP recommends it where appropriate for your practice. For email and remote access, treat it as essential.
• Write a policy on who holds administration rights. Day-to-day accounts should not be administrators.
• Screens lock when unattended, using a password-protected screensaver.
• Document remote access and wireless use policies if remote access is allowed. The Standards require this.

4. Protect devices and the network

• Up-to-date antivirus and hardware and software firewalls are a must under indicator D.
• Operating system and application security updates are deployed automatically, on a schedule that suits the practice.
• Replace unsupported hardware and software. The RACGP warns that it puts the practice at risk of data breaches.
• Isolate your internal Wi-Fi from other networks. If you offer patient Wi-Fi, keep it separate and have a policy for its use.
• Encrypt and password protect laptops, phones and tablets that hold health data, and keep a register of devices that staff borrow.
• Wipe drives and photocopiers before disposal. Deleting files does not remove the data.

5. Backups and recovery

• Keep a server backup log. It is a must under indicator D.
• Run daily, weekly, monthly and annual backups, and confirm each one finished. The RACGP notes failures are often only found when a restore is needed.
• Store backups offsite in a secure location, with controlled access. Keep installation media, licence details and operating system details with them so systems can be rebuilt.
• Test restores regularly. Ask your clinical software vendor how its backups run and how you access them.
• Test the UPS too. Put a sticker on it with the battery change date.
• Maintain and test the business continuity and information recovery plan. Cover frequent backups of appointments, billing and health information, and the offsite location.

6. Email, social media and records

• The email policy covers password security, verifying patient email addresses, warning patients about unencrypted email, and getting consent. If you do not use email with patients, the policy says so.
• The social media policy reflects AHPRA's social media guidance for registered practitioners. The RACGP provides a template.
• Talk to your medical defence organisation before destroying old records. Use cross-cut shredding for paper.

7. Data breaches

Private sector health service providers are covered by the Privacy Act and the Notifiable Data Breaches scheme even if they are a small business. The OAIC lists GPs, dentists, pharmacists and allied health professionals as examples of health service providers.

• Record all breaches and suspected breaches in a data breach register, and notify practice management. The RACGP guide recommends this.
• If you suspect an eligible data breach, take all reasonable steps to complete your assessment within 30 calendar days.
• If the breach is likely to result in serious harm, notify affected individuals and the OAIC as soon as practicable.
• If a breach is notified under the My Health Records Act, you do not need to notify separately under the NDB scheme.

The RACGP guide does not mention the ASD Essential Eight, but the two fit together. MFA, patching, restricted admin rights and backups appear in both. This is what we check in a free risk check: the Essential Eight as the technical baseline, mapped back to C6.4.

Quick checklist

• Security lead named and position descriptions updated
• Signed agreement with your I.T. provider
• Asset register current
• Unique logins, role-based access, MFA on email and remote access
• Antivirus, firewalls and automatic updates in place
• No unsupported operating systems or software
• Guest Wi-Fi separated and portable devices encrypted
• Backup log kept, offsite copy, restore tested
• Business continuity plan written and tested
• Email, social media, privacy and records policies written
• Data breach register and response steps ready