Cybersecurity for small medical practices: a floor, not a fortress

A five-GP clinic in a suburban strip mall is not a bank, and it should stop trying to sound like one in its privacy poster. It is something more awkward: a small business that holds some of the most sensitive personal information in the country, runs on vendor software it does not really control, and has a practice manager who already does payroll, immunisation fridge logs and the staff Christmas party.

That clinic will not get a security operations centre. It can get a floor. The floor is the set of habits that mean a stolen laptop is an inconvenience, a phishing email is a recoverable afternoon, and a ransomware incident is a bad week rather than a closed practice reading a script to patients about paper records "for the foreseeable future".

This is a sceptical piece for people who already know they should do better and have not, because the last IT quote looked like a renovation. It is not a penetration-test report, and it will not name a product. If you want the adjacent arguments about ambient AI scribes and health apps and privacy, they sit in the same messy living room: more data, more vendors, same old clinic.

Why clinics get hit without being special

Ransomware groups do not need a reason to dislike your practice. They need a way in, a way to encrypt or steal files, and a belief you will pay or suffer. Healthcare is attractive because downtime hurts immediately and because health information is useful for identity fraud and extortion. Small clinics are attractive because they share logins, postpone patches, and keep a backup disk in the same cupboard as the server.

Phishing remains the unglamorous front door. A receptionist is expecting invoices. A GP is expecting a "secure" pathology link. A practice manager is expecting a message that looks like Services Australia. One click, one reused password, and the rest is a vendor conversation you did not want to have.

Remote access is the other front door. The pandemic taught everyone to log in from home. Not everyone taught the home computer to behave. A virtual private network without multi-factor authentication, or a remote-desktop port that someone opened "just for the locum", is a gift.

None of this requires you to believe a particular statistic. It requires you to believe that clinics are ordinary networked businesses with extraordinary data. The Australian Signals Directorate's Essential Eight is a well-known public baseline for a reason. You will not implement all of it this quarter. You can stop pretending that antivirus purchased in 2019 is a strategy.

Privacy law is already in the building

The Privacy Act and the Australian Privacy Principles apply to most health service providers. Health information is sensitive information. APP 11 is the boring one about security: take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. "Reasonable" scales with what you hold. You hold a lot.

The Notifiable Data Breaches scheme sits on top. If there is a data breach of personal information that is likely to cause serious harm, you assess it promptly and you may have to notify the Office of the Australian Information Commissioner and the people affected. A missing USB of export files, a misdirected email with a mental health letter, a ransomware event that included data theft — these are assessment events, not only IT events.

My Health Record access adds another layer of rules for registered healthcare provider organisations. Snooping, shared smartcards, and leftover access for a staff member who left in March are not "small clinic culture". They are how you end up explaining yourself to a regulator and an aggrieved patient at the same time.

State health records statutes and professional standards still apply. AHPRA does not need a ransomware group to take an interest in a GP who left a logged-in session on a reception computer. The law is not waiting for you to hire a Chief Information Security Officer. It is waiting for you to be reasonable.

Reasonable security for a five-GP clinic is a floor of dull controls, not a fortress, and a shared password is already below that floor.

The controls that actually move risk

Identity, copies and the unglamorous patch

Start with identity. Every person who uses a system gets their own login. Reception, nurses, GPs, registrars, the bookkeeper, the locum, the after-hours cleaner who should not have a login at all. Shared "nurse1" accounts make it impossible to say who opened a file, which means you cannot defend yourself and you cannot teach anyone.

Multi-factor authentication on email, on remote access, and on any cloud clinical or billing system that offers it. SMS is better than nothing and worse than an authenticator app or a hardware key. Arguments about friction should be tested against the friction of rebuilding a practice.

A password manager for staff, so the "we had to write it down" story dies. If a locum needs access for a week, they get a time-limited account, not the practice principal's password on a sticky note.

Then look at copies. A backup that has never been restored is a rumour. You want a copy that is not sitting on the same machine, not mapped as a convenient drive letter for ransomware to find, and not dependent on one person's home NAS. Test a restore on a boring afternoon. Know how long it would take you to get the appointment book and the clinical record back.

Patch the obvious things: Windows, browsers, the VPN, the firewall, the practice software. Unsupported operating systems on a reception PC are a decision to outsource your security to luck. Turn off remote desktop to the open internet. If a vendor insists on a permanent inbound port, that vendor is part of your threat model.

Encryption on laptops and phones, with the ability to wipe them. A stolen bag from a GP's car is an old story. If the device is encrypted and locked, your assessment under the Notifiable Data Breaches scheme looks very different from a stolen unencrypted export of the whole database.

Email is where good people do harm. Do not send identified mental health letters as ordinary attachments if a secure channel exists. Check the address twice. Autocomplete is a hazard. If you must use consumer email for anything clinical, you do not understand the assignment.

Vendors, contracts and the fiction of "the cloud is their problem"

Your clinical software, SMS reminder tool, dictation service, AI scribe, cloud backup, and billing platform are processing health information on your behalf. APP 8 matters if any of that processing happens overseas. Patients are entitled to know, in ordinary language, that a vendor in another country may see metadata or content.

Contracts should say, in words a practice manager can find at 6pm:

• what the vendor stores, for how long, and where
• whether they subcontract, and where those subcontractors live
• how quickly they will tell you about a breach
• how you get your data out if you sack them
• whether they train models on your consultations (the correct answer is no, unless you have a very good reason and a very clear consent story)
• who pays for what if their failure causes your notification

A two-page terms-of-service link is not a contract you have read. If a salesperson cannot answer where the data lives, do not buy the product because the demo was slick. Interoperability, FHIR and the HI Service will not save you from a vendor that treats general practice as a data source.

Access for vendors should be logged and limited. A support session that requires a permanent administrator account is a smell. Watch for "we'll just install this remote tool". Watch for integrations that copy the entire address book into a marketing platform.

When a staff member leaves, there is a list: clinical software, billing, email, SMS, intranet, the Facebook page nobody admits is used for recalls, the pharmacy portal, My Health Record organisation access. That list should exist before someone resigns in tears on a Thursday.

A realistic checklist for a five-GP clinic

This is a floor. It assumes you have a part-time practice manager, a contracted IT person, and no appetite for a 40-page policy that nobody reads.

• Unique accounts for every staff member and locum; no shared clinical logins.
• Multi-factor authentication on email, remote access, and cloud clinical systems.
• A written list of who has access to what, reviewed when people start, stop or change roles.
• Encrypted laptops and phones; screen locks that actually engage; no unlocked sessions at reception.
• Automatic patching, plus a monthly half-hour to catch the machines that failed.
• A backup that is separate, recent, and has been restored in the last quarter.
• A named person who can decide, on a Sunday, that this is a possible eligible data breach.
• A one-page incident card: who to call (IT, insurer, legal, OAIC guidance), who tells patients, who tells staff not to pay a ransom from their personal credit card.
• Vendor register with data location and breach-notification clause, including the scribe and the SMS tool.
• Annual phishing conversation that is not humiliating. Shame makes people hide clicks.
• Paper fallback for appointments and scripts that you have practised once, so ransomware does not also become a public-relations novel.
• A privacy poster that matches reality. If you say you never send information overseas, check the vendors.

If you do only four things this year, do unique logins, MFA, a tested backup, and an incident card. That is not a fortress. It is the difference between a bad week and a practice that cannot prove who opened a file.

What not to waste money on first

A framed certificate from a vendor who scanned your website. An expensive dashboard nobody logs into. A policy binder written by someone who has never sat in your reception. Training videos that staff mute while they work.

Physical security still matters — a server in a cupboard patients can open is a comedy sketch — but a new alarm will not fix shared passwords. Cyber insurance matters more after you can answer the proposal form honestly. If the form asks whether you use MFA and you do not, the conversation you need is not with a broker.

Do not pay a ransom as a plan. Payment is a business and legal decision with no guarantee of a working key, and it does not remove your privacy obligations. Have the conversation with your insurer and lawyer before you need it, not in a chat window with a criminal.

Culture is the control that does not come in a box

GPs who override every warning train registrars to override every warning. Principals who demand that "IT just make it open" are choosing convenience with other people's records. Reception staff who are punished for slowing a queue to check an identity will stop checking.

The opposite culture is not paranoia. It is permission to pause. Permission to say the email looks odd. Permission to refuse a USB from a drug-company representative. Permission for a nurse to lock a screen in front of a GP who wandered off. Permission to tell a parent that they cannot have a login to a partner's record because it is convenient.

Patients notice. They notice when a screen faces the waiting room. They notice when a staff member shouts a diagnosis across reception. They notice when you ask them to fill a form on an unknown QR code. Cybersecurity in a clinic is partly encryption and partly not being sloppy in public.

The floor is dull on purpose. Dull is what keeps a Tuesday appointment book intact. Fortress language is how small practices delay the work. Do the dull things, write down who does them, and then go back to medicine.