Blog Post

A data breach does not automatically mean a healthcare provider has failed to meet its privacy obligations or take reasonable steps to protect patient information. But a $5.8 million Federal Court penalty is proof hat inadequate safeguards and a delayed response can carry serious consequences.

In October 2025, Australian Clinical Labs was ordered to pay the penalty following a 2022 cyberattack on its Medlab Pathology business. The incident resulted in the personal information of more than 223,000 people being accessed and stolen.

Of the total penalty, $4.2 million related to failures to take reasonable steps to protect the information held on Medlab’s systems. A further $1.6 million addressed failures to assess the suspected breach promptly and notify the regulator as soon as practicable.

The case resulted in the first civil penalties ordered under Australia’s Privacy Act, marking a turning point for healthcare cyber security compliance in Australia. For healthcare and medical practices across Perth, Mandurah and the Peel region, it reinforces the importance of having effective safeguards and a documented and regularly tested response plan in place before an incident occurs.

Why Is Healthcare Cyber Security Under Greater Scrutiny?

Healthcare practices are attractive targets because they hold valuable combinations of personal, financial and medical information. A password can be reset, but a patient cannot replace their medical history.

This risk is not limited to large healthcare networks. Smaller GP and allied health practices hold the same sensitive information and rely on continuous access to patient records, appointment systems and Medicare workflows, often with fewer internal cyber security and compliance resources.

Recent incidents show that the threat remains active. In June 2026, Partnered Health experienced a cyber incident affecting clinics across its national network, including practices in Western Australia. Information taken included Medicare details, consultation notes, referral letters and pathology or diagnostic results. The organisation became aware of the unauthorised access on 23 June and began notifying potentially affected patients more than three weeks later, placing its response time under scrutiny.

Regulatory expectations are also tightening. Mandatory ransomware payment reporting took effect in May 2025, requiring eligible businesses to report payments within 72 hours. Although this requirement does not apply to every clinic, healthcare providers are covered by the Privacy Act regardless of size or turnover. The Act governs how they handle and protect personal information, including their response to a data breach.

Together, these developments make proactive cyber security a priority for every healthcare practice in Australia, not only large providers.

What Does Healthcare Cyber Security  Compliance Require?

Under the Privacy Act, healthcare providers must take reasonable steps to protect the personal information they hold. What qualifies as reasonable depends on factors including the sensitivity and volume of information, the potential harm to patients and the practice’s size and resources.

Cyber security compliance for GP clinics and allied health practices therefore involves more than installing antivirus software. Practical safeguards should include:

• Secure and tested backups: Critical information and systems should be backed up regularly, with recovery processes tested.
• Breach readiness: A documented response plan should explain how a suspected incident will be contained, investigated and reported.
• Clear access controls: Staff should only have access to the systems and patient information required for their roles.
• Policies and staff training: Employees should understand how information can be accessed, stored and shared, as well as how to report suspicious activity.
• Evidence of action: Assessments, policies, training records and security reports can help demonstrate the steps taken to protect patient information.

How Does SMB1001 Support Healthcare Cyber Security Compliance?

The Privacy Act establishes the legal responsibility to protect patient information, but it does not provide clinics with a complete cyber security checklist. SMB1001 helps translate that responsibility into practical, measurable action.

Created specifically for small and medium-sized businesses, SMB1001 is a tiered cyber security standard and certification pathway. Rather than expecting every practice to reach the same level immediately, it provides a progressive roadmap for strengthening technology, staff awareness, policies, incident response and ongoing risk management. This makes it particularly relevant to smaller GP and allied health practices with limited internal cyber security resources.

Platinum and Diamond certification require independent assessment rather than relying on self-declaration, providing greater assurance that the required controls have been implemented.

SMB1001 certification is not generally mandatory for private healthcare practices, nor does certification automatically guarantee compliance with the Privacy Act. However, it can help practices identify gaps, prioritise improvements and provide evidence that recognised steps are being taken to protect patient information.

Strengthen Your Practice with Local Healthcare IT Support

The first step towards stronger compliance is understanding where your practice stands today.

Impact ICT provides local healthcare cyber security support to GP clinics and allied health practices across Mandurah, the Peel region and Perth, helping them identify gaps and strengthen their protection. Our local team understands healthcare technology, including practice management systems, patient records and Medicare workflows.

With SMB1001 Platinum certification, we provide practical security guidance and ongoing fixed-fee IT support tailored to your practice.

Book your free healthcare IT and cyber security health check to understand your current position and the steps you can take next.

FAQs

Is the SMB1001 Certification Mandatory for Healthcare Providers?

SMB1001 certification is not generally mandatory for private healthcare providers. However, it offers a structured and practical way to identify security gaps, prioritise improvements and measure progress. Certification can also help practices demonstrate that recognised steps are being taken to protect patient information and support their responsibilities under the Privacy Act.

What happens if a healthcare provider has a data breach in Australia?

A healthcare provider should act quickly to contain the incident, investigate what information was affected and assess whether serious harm is likely. Under the Privacy Act’s Notifiable Data Breaches scheme, eligible breaches must be reported to the Office of the Australian Information Commissioner (OAIC) and affected individuals. Depending on the circumstances, other relevant authorities may also need to be notified.

How much can a business be fined for a data breach in Australia?

Under the Privacy Act 1988, the maximum civil penalty for a serious interference with privacy by a company is the greater of $50 million, three times the value of any benefit obtained or 30% of adjusted turnover during the relevant period. A court determines the actual penalty based on the circumstances and severity of the breach.

What Is the Difference Between Privacy Compliance and Cyber Security?

Privacy compliance covers how a medical practice collects, uses, stores, shares and disposes of patient information in accordance with its legal obligations. Cyber security focuses on protecting that information and the systems holding it from threats such as unauthorised access, theft or disruption. The two areas overlap, but they are not interchangeable.

How Often Should a Medical Practice Review Its Cyber Security?

A medical practice should conduct a full cyber security review at least annually and after significant changes to its systems, suppliers or operations. Key safeguards, including access permissions, backups, software updates and incident response plans, should be checked more regularly to ensure they remain effective.

How can a Perth or Mandurah medical practice check its cyber security compliance?

A healthcare-focused IT and cyber security health check can assess your systems, safeguards, policies and response readiness against recognised frameworks. Impact ICT’s local team can identify gaps, explain the risks in plain English and recommend practical improvements suited to your practice, priorities and available resources.