Healthcare practices are one of the most targeted sectors for cyberattacks in Australia — patient records are valuable, and many practices run on ageing systems with limited IT support. Here’s what every medical or dental practice should have in place.

1. Multi-factor authentication (MFA)

If a password is ever compromised, MFA is the single biggest barrier stopping an attacker from accessing your systems. It should be enabled on email, practice management software, and any remote access tools.

2. Regular, tested backups

Backups only help if they actually work. Practices should have backups running automatically, stored offsite or in the cloud, and tested periodically to confirm they can actually be restored.

3. Staff awareness training

Most breaches start with a phishing email, not a technical exploit. Regular, simple staff training on spotting suspicious emails is one of the most cost-effective protections available.

4. Keeping software and systems updated

Outdated software is one of the most common entry points for attackers. Practice management software, operating systems, and network devices should be kept on supported, patched versions.

5. A written data breach response plan

Under the Notifiable Data Breaches scheme, practices have obligations if patient data is compromised. Having a plan in place before an incident happens makes the difference between a controlled response and a chaotic one.