Aged Care Quality Standards Outcome 2.7: An IT and Cyber Security Checklist for Providers

What the aged care information management standard requires

The aged care information management standard is Outcome 2.7 of the strengthened Aged Care Quality Standards. It sits in Standard 2, The organisation, and it is where your records, care systems and cyber security meet the regulator's expectations. For residential and home care providers in South East Queensland, it is the outcome your IT supports daily.

The Department of Health, Disability and Ageing says the strengthened Quality Standards were implemented under the Aged Care Act 2024 on 1 November 2025, the day the new Act started. The November 2025 version of the standards adds that the Aged Care Rules 2025 "operationalise the strengthened Quality Standards by making the outcome statements legal obligations".

The Outcome 2.7 outcome statement on the Aged Care Quality and Safety Commission's website reads:

The provider must ensure that information recorded about an individual is accurate and current, is able to be accessed and understood by the individual, supporters of the individual, aged care workers, registered health practitioners, allied health professionals, allied health assistants and others involved in the individual's care.

The provider must ensure that the information of individuals is kept confidential and is managed appropriately, in line with their informed consent.

It has three actions:

• 2.7.1 "The provider implements an information management system to securely manage records."
• 2.7.2 "The provider's information management system ensures that: a) aged care workers and individuals, supporters of the individual, registered health practitioners, allied health professionals, allied health assistants and others involved in the individual's care have access to the right information at the right time to deliver and receive quality funded aged care services; b) the accuracy and completeness of information collected and stored is maintained; c) informed consent is sought to collect, use and store the information of individuals or to disclose their information (including assessments) to other parties; d) individuals understand their right to access or correct their information or withdraw their consent to share information; e) information from different sources is integrated."
• 2.7.3 "The provider regularly reviews and improves the effectiveness of the information management system."

What the Commission's guidance adds for IT

The Commission's key tasks for Outcome 2.7 hold the technology detail. Your system for managing information, including the clinical information system, should be one that "manages cyber security risks (Outcome 2.4)" and "has enough data storage for the records you need to keep". Two more points matter to whoever runs your IT:

• Offline access. "There should always be ways to access critical information when digital systems are offline", such as recording clinical information on paper during internet or power outages.
• Role based access. Everyone's access should be "appropriate to their role", including Commission Quality Auditors.

How Outcome 2.4 brings cyber risk into risk management

Outcome 2.7 points to Outcome 2.4 for cyber security, so read them together. The Outcome 2.4 outcome statement is: "The provider must use a risk management system to identify, manage and continuously review risks to individuals, aged care workers and the provider's operations."

Its actions are:

• 2.4.1 "The provider implements a risk management system to identify, assess, document, manage and regularly review risks to individuals, aged care workers and the organisation."
• 2.4.2 "The provider puts strategies in place and undertakes actions to prevent, control, minimise or eliminate identified risks."
• 2.4.3 "The provider collects and analyses data and engages with individuals and aged care workers to inform risk assessment and management. This feeds into the provider's quality system to improve funded aged care services."
• 2.4.4 "The provider regularly reviews and improves the effectiveness of the risk management system."

The Commission's key tasks say that, at a minimum, your risk management system should have documented processes, roles and responsibilities for managing risks to business continuity and to "your information management system (Outcome 2.7) including data and digital records, such as cyber security risks." It asks for at least one organisation wide risk register, reviewed periodically, and says some risks may need escalating to the governing body.

So ransomware, a failed backup, a lost tablet or a care platform outage each belongs on the risk register with an owner, controls and a review date, alongside falls and medication risk, not in a separate IT document nobody reads.

Outcome 2.10 connects here too: the Commission's guidance on testing emergency plans says drills "can also include scenarios like power and internet outages". Tested recovery, not assumed recovery.

What your governing body must oversee

The Commission's Standard 2 guidance for governing bodies says the provider needs systems to:

• "report and monitor information security incidents. These reports must be regularly reviewed by the governing body"
• record that the governing body has reviewed the information management system
• record the governing body's roles in overseeing information management and cyber incidents and responses
• make sure key information security issues are discussed at governing body meetings
• give the governing body current data and analysis from the information management system.

It also suggests regular audits of information management and record keeping, including checking records for unauthorised changes or file damage and "monitoring and reviewing cyber security threats, with timely worker communication and training."

The Commission's Topic guide 17: Technology and cyber security says cyber risks "are not simply an information and technology issue" and that boards should not rely solely on technical specialists. It expects clear accountabilities and reporting lines for cyber security, provider wide cyber training, and cyber security on the board's agenda.

Your IT provider can run the controls and produce the evidence. It cannot hold the accountability for you.

Topic guide 17 is direct on that point: while a senior officer may manage cyber risk day to day, "final accountability for cyber security remains with the governing body."

A simple board report on information security

The Commission doesn't prescribe a format. Here is a one page structure we suggest:

1. Incidents. Information security incidents and near misses, their impact on residents or clients, and any notified to the OAIC.
2. Risk register. Changes to information management and cyber risks, and overdue actions.
3. Backup and recovery. Backup success, the last restore test result and the last outage drill.
4. Access. Leavers removed on time, privileged accounts reviewed, MFA coverage.
5. Patching. Unprotected or out of date devices and open critical vulnerabilities.
6. Training. Staff and board members trained in cyber security and privacy.
7. Changes. New systems or vendors, how their security was assessed, and the next 2.7.3 review date.

Minute the discussion. The guidance asks you to record that the board reviewed the system, so the minutes are part of your evidence.

Privacy, incidents and reporting obligations

Outcome 2.7 sits alongside your privacy obligations, not instead of them. The Commission's Topic guide 10: Information management names the Aged Care Act 2024 and the Privacy Act 1988 as the two key regulatory categories for boards. It notes that health information is sensitive information with a higher level of protection, and that protected information under the Act should only be accessed or used for permitted reasons.

Notifiable Data Breaches

Under the Notifiable Data Breaches scheme, an organisation must notify affected individuals and the OAIC about an eligible data breach: one likely to result in serious harm that remedial action hasn't been able to prevent. The OAIC's guidance on the scheme says an entity must take all reasonable steps to assess a suspected breach within 30 calendar days, treated as a maximum. The scheme covers organisations with an annual turnover of more than $3 million and, regardless of size, organisations that provide a health service to, and hold health information about, individuals. Check with your privacy adviser how this applies to you.

Other reporting

• Ransomware payments. Under the Cyber Security Act 2024, an entity carrying on business in Australia with an annual turnover for the previous financial year equal to or above $3 million must report a ransomware or cyber extortion payment within 72 hours.
• Cyber incidents. You can report a cyber incident to ASD's ACSC at any time.

Topic guide 10 says your information management policy should set out expected actions when a data breach occurs, "including any external reporting obligations". Write the list, with names and numbers, before you need it.

AI and automated systems

Consent under 2.7.2 applies to resident information used in AI tools too. From 10 December 2026, your privacy policy may also need to say when software makes or informs significant decisions about people: see our guide to automated decision making and the Privacy Act.

Who does what: your IT provider and your governance

Most of Outcomes 2.7 and 2.4 is shared work. Here is how we suggest splitting it.

Securely managing records (2.7.1)

• Your IT provider can: run backups with offsite copies, test restores, encrypt devices, manage storage, and keep systems patched and monitored.
• Stays with you: your record keeping and retention rules, the information management policy, and approving where data is stored.

Access, accuracy and integration (2.7.2 a, b and e)

• Your IT provider can: set up individual logins matched to roles, apply MFA, remove leavers promptly, keep audit logs, manage staff devices, and keep integrations working with your software vendors.
• Stays with you: deciding who sees what, approving access for agency staff, visiting practitioners and auditors, checking records are accurate, and agreeing data sharing with other providers.

Consent and rights (2.7.2 c and d)

• Your IT provider can: make sure your systems can record consent, withdrawal and correction requests, and control what is shared with other parties.
• Stays with you: seeking consent, explaining rights to older people and supporters, and deciding what to disclose.

Cyber risk (2.4.1 to 2.4.4)

• Your IT provider can: run endpoint protection, email security, vulnerability scanning and 24/7 monitoring, report on cyber risks and incidents, and contribute evidence to your risk register.
• Stays with you: owning the risk register, setting risk appetite, deciding on controls and investment, and escalating to the board.

Continuity and recovery

• Your IT provider can: design failover, document recovery steps for each critical system, and help run outage drills.
• Stays with you: paper and offline procedures for care staff, and who triggers them.

Review and improvement (2.7.3 and 2.4.4)

• Your IT provider can: review your technology yearly, flag systems near end of support, and assess new software's security.
• Stays with you: deciding what to change and recording that the governing body reviewed the system.

An Outcome 2.7 and 2.4 IT checklist

Work through this with your executive team and your IT provider.

How CSG helps aged care providers

We are a Gold Coast based team, supporting organisations across South East Queensland and Tweed Heads since 1999. We are ISO/IEC 27001:2022 certified and audited annually, and we work to the ACSC Essential Eight.

Our aged care IT support covers much of the IT side of Outcomes 2.7 and 2.4: user provisioning and access control, MFA across Microsoft 365 and critical systems, endpoint detection and response, email security, and vulnerability scanning and patching. We support platforms such as Leecare and work with your software vendors during incidents and upgrades. As part of our cyber security work for aged care, we provide security awareness training and incident response aligned to the Notifiable Data Breaches scheme. Our backup and disaster recovery service provides automated daily backups with immutable offsite copies and tested recovery procedures. Monitoring runs 24/7.

The governance stays with your board and executive team, and it should. We can give them clear, regular evidence on backups, restore tests, access and security to base their decisions on. Talk to our team or call us on (07) 5551 2333.