Data breaches in Australian general practice: what the numbers show
If you manage a GP clinic, a data breach in general practice in Australia is no longer an unlikely event you can plan for later. The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in calendar year 2025, up 8% on 2024 and the highest annual number since the Notifiable Data Breaches (NDB) scheme began in 2018. Health service providers were the most affected sector, with 225 notifications, or about 19%.
These are the latest figures. The OAIC released them on 6 July 2026, and its NDB statistics dashboard says updates covering July to December 2025 and January to June 2026 are forthcoming. When we checked on 22 October 2026, no January to June 2026 figures had been published.
What causes breaches in health
The OAIC's dataset for July to December 2025, published on data.gov.au, breaks down the 128 notifications from health service providers in that half year:
- Malicious or criminal attack: 64 notifications (50%)
- Human error: 51 notifications (about 40%)
- System fault: 5 notifications
- Other or currently unknown: 8 notifications
Across all sectors in the same period, human error caused 194 of 670 notifications, about 29%, so it is a noticeably bigger problem in health. Across all sectors, the most common human error was personal information emailed to the wrong recipient (66 notifications). Among malicious attacks, cyber incidents led (253), followed by social engineering or impersonation (88).
Two more numbers from that dataset matter for a clinic. Health information was involved in 228 of the 670 breaches. And of the 124 health service provider notifications with timing data, 41 took more than 30 days to reach the OAIC.
Your clinic is covered, whatever its size
Most small businesses under $3 million turnover are exempt from the Privacy Act, but health is not. The OAIC's guidance on the NDB scheme says businesses of any size are covered if they provide a health service to, and hold health information about, individuals. A general practice fits that description.
The first Privacy Act penalty was against a healthcare company
In October 2025 the Federal Court ordered Australian Clinical Labs (ACL) to pay $5.8 million in penalties over a February 2022 cyberattack on Medlab Pathology's IT systems. It was the first time civil penalties had been imposed under the Privacy Act. The OAIC's media release breaks the total down:
- $4.2 million for failing to take reasonable steps to protect personal information on Medlab Pathology's IT systems under Australian Privacy Principle 11.1, which amounted to more than 223,000 contraventions
- $800,000 for failing to carry out a reasonable and expeditious assessment of whether an eligible data breach had occurred
- $800,000 for failing to give the Commissioner a statement about the eligible data breach as soon as practicable.
Notice that $1.6 million relates to the response, not the attack: a slow assessment and a late notification were penalised separately.
Privacy Commissioner Carly Kind said the outcome "should serve as a vivid reminder to entities, particularly providers operating within Australia's healthcare system, that there will be consequences of serious failures to protect the privacy of those individuals whose healthcare and information they hold."
The penalties were set under the regime in force at the time, with a maximum of $2.22 million per contravention. The OAIC notes that under the regime in force since 13 December 2022, the maximum per contravention can be $50 million, three times the benefit derived, or 30% of a business's annual turnover.
The attack was only part of the penalty. A slow assessment and a late notification cost $1.6 million on their own.
The common causes in a GP clinic, and what prevents them
The OAIC's categories translate into a handful of everyday risks in general practice.
Phishing and compromised accounts
A convincing email asks a receptionist to "confirm" their Microsoft 365 password, and an attacker now has the practice inbox, referral letters included.
- Turn on multi factor authentication (MFA), a second check such as an app prompt on top of the password, for email, remote access and any cloud clinical or booking system. ASD's guidance on implementing MFA explains the options.
- Train staff to spot phishing and give them an easy way to report a suspicious email. ASD's small business cyber security guide recommends training on "how to spot scams and phishing attacks" and processes for reporting suspicious emails.
- Keep systems patched and work towards the Essential Eight, ASD's baseline set of controls.
How CSG fixes this
Through our cyber security service we enforce MFA across email, remote access and your clinical and administrative systems, add phishing protection to your email, and run phishing and social engineering training for practice staff. Patches for high risk vulnerabilities go on within 48 hours, and we work through an Essential Eight roadmap with you.
Misdirected emails, letters and faxes
A specialist letter goes to the wrong "Dr Smith", or a fax goes to a mistyped number. This is where human error shows up most in the OAIC's data.
- Use secure messaging for clinical correspondence where the recipient supports it. RACGP criterion F9.A of the 6th edition asks practices to use "a secure message system or other method of encryption" when communicating electronically with or about patients, unless the patient has consented otherwise.
- Keep a verified address book of specialists, pathology and imaging providers, and check fax numbers and email addresses before sending.
- Use BCC, or better, individual messages, for any group email to patients.
How CSG fixes this
Under our GP and medical practice IT support we set up and support secure messaging (Healthlink, Argus, Medical Objects) in Bp Premier or MedicalDirector, so specialist letters go encrypted to a verified recipient. In Microsoft 365 we configure data loss prevention so staff get a warning before patient information is emailed outside the practice.
Lost or stolen devices and paperwork
A laptop left in a car, an unencrypted USB drive, or a box of old files put out for collection.
- Encrypt laptops and phones, set screen locks, and be able to wipe a lost device remotely.
- Follow documented procedures for storing and destroying records, including wiping printers and photocopiers before disposal, as RACGP criterion F8.E's guidance describes.
How CSG fixes this
We encrypt clinic laptops and phones, enforce screen locks and enrol them in mobile device management, so a lost device can be wiped remotely. When equipment is retired, we securely dispose of devices and storage media and give you destruction certificates.
Unauthorised access, including by insiders
Shared logins, former staff whose accounts were never closed, or a team member looking up a record they have no reason to see.
- Give every person their own login with access matched to their role, as F9.B requires, and remove access on a staff member's last day.
- Review who has administrator rights in Bp Premier, MedicalDirector and your other systems, and keep audit logs you can actually search.
How CSG fixes this
We give each staff member their own login with role based access in Bp Premier or MedicalDirector, manage privileged access to clinical software, and close accounts through our offboarding procedure. You get an access register and a quarterly user review, backed by audit logs.
Third party and software vendor breaches
Your patient data also lives with your clinical software, booking and recall platforms, pathology and imaging links, your IT provider and your backup service. A breach at any of them can become your breach. The OAIC's guidance on the NDB scheme explains that where personal information is held jointly, for example through outsourcing or cloud storage, a breach can be an eligible data breach for every entity holding it. Only one needs to notify, and the OAIC suggests it is usually best done by the entity with the most direct relationship with the affected individuals. For a GP clinic, that is often you.
- List every vendor that holds or can access patient data, and where that data is stored.
- Ask each one how they would detect a breach, how quickly they would tell you, and who would notify patients, and write it into the contract.
- Turn on MFA for every vendor portal and remove accounts nobody uses.
How CSG fixes this
We list the vendors connected to the systems we manage for you and where their data sits, turn on MFA for vendor portals and remove unused accounts. As your IT provider, our support agreement sets out our own obligations, and our backups of clinical databases stay in Australian data centres.
Our guide to the RACGP 6th edition's information security criteria covers F8.B's expectations of external IT providers and the vendor questions in the AI guidance.
Your data breach response plan: contain, assess, notify, review
The OAIC's data breach response guide sets out four steps, and its quick reference guide, published in June 2026, summarises them on a page. Your plan should follow the same order.
1. Contain
Stop the breach getting worse: reset passwords and sign out sessions on a compromised account, disconnect an infected computer, ask the wrong recipient to delete a misdirected email, or wipe a lost device. Keep evidence, such as logs and the original email.
2. Assess, within 30 days
Gather the facts: what information was involved, how many patients, who may have it, and whether your actions have reduced the risk. Then decide whether it is an eligible data breach, meaning one likely to result in serious harm to someone that remedial action hasn't prevented. The quick reference guide says your entity "must take all reasonable steps to complete this assessment within 30 calendar days" after becoming aware of grounds to suspect an eligible breach. The OAIC's guidance adds that the Commissioner expects entities to treat 30 days as a maximum and to aim for a much shorter timeframe, because the risk of serious harm often increases with time. Write down the reasoning either way.
3. Notify
If it is an eligible data breach, notify affected patients and report it to the OAIC as soon as practicable. The statement to the Commissioner must include your clinic's identity and contact details, a description of the breach, the kinds of information involved, and the steps you recommend patients take. If a cyber attack is involved, you can also report it to ASD's ACSC through cyber.gov.au or the hotline on 1300 CYBER1 (1300 292 371).
4. Review
Once it is over, work out what went wrong and fix it: a new control, a changed process, refresher training, or a contract change with a vendor. Then update the plan.
Decide who decides before it happens
The 30 days start when you become aware of grounds to suspect a breach, not when you get around to looking. Your plan should name who your IT provider calls at any hour, who decides whether a breach is notifiable, and who signs off on notifying patients and the OAIC.
How CSG fixes this
Our 24/7 monitoring sends real alerts to a person on our team, who contains the problem (resetting passwords, signing out sessions, isolating a computer or wiping a lost device), keeps the logs and calls the contact your plan names. We then give you a written summary of what was affected, so you can make the 30 day assessment quickly.
What goes in the plan
The OAIC's guidance on preparing a response plan says the plan "should be in writing" and should cover what a data breach is, a strategy for containing and assessing one, who communicates with patients and regulators, staff roles and escalation, how every incident is recorded, and how the response is reviewed. It suggests a second contact for each role, and testing the plan by working through a hypothetical breach.
For the technical side, ASD's cyber security incident response planning guidance acts as a template, with a readiness checklist. In a small clinic the plan can be a few pages, as long as the people named in it have read it.
How CSG fixes this
We write the technical part of your plan with you, aligned to the Notifiable Data Breaches scheme, with our team named as your IT contact and a second contact for each role. Each year we work through a hypothetical breach with you, such as a compromised inbox, and update the plan from what it shows.
This also lines up with accreditation. In the RACGP's 6th edition, criterion F8.A asks for a cyber security incident response plan and procedures to tell patients about a data breach, and F9.A asks practices to inform patients of their data breach protocols. Our RACGP 6th edition guide explains these criteria and where the transition stands.
A data breach readiness checklist for GP clinics
Work through this with your practice owner, privacy officer and IT provider.
- Name your privacy officer, and the person who decides whether a breach is notifiable
- Write a data breach response plan that covers contain, assess, notify and review, with a second contact for each role
- Keep the OAIC's quick reference guide and the 1300 CYBER1 number with the plan, on paper as well as online
- Run a tabletop exercise on a hypothetical breach, such as a misdirected referral or a compromised inbox, at least once a year
- Turn on MFA for email, remote access, clinical software, booking platforms and vendor portals
- Train every staff member to spot phishing and report suspicious emails, and repeat it regularly
- Use secure messaging for clinical correspondence, and keep a verified directory of specialist, pathology and fax details
- Give everyone their own login with role based access, and remove leavers on their last day
- Encrypt laptops and phones, and make sure lost devices can be wiped remotely
- Keep backups of clinical data offsite or in the cloud, and test a restore
- List every vendor that holds or accesses patient data, and confirm in writing how they would tell you about a breach
- Check your privacy policy explains how you manage patient information and your data breach protocols
- Record every incident and near miss, even the ones that turn out not to be notifiable
How CSG helps GP clinics prevent and respond to breaches
We are a Gold Coast based team, supporting organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. We are ISO/IEC 27001:2022 certified and audited annually, and we work to the ACSC Essential Eight.
The fixes above sum up our work for clinics: MFA, email security and phishing training, secure messaging, managed and encrypted devices, role based access, immutable backups with tested recovery, 24/7 monitoring and an incident response plan aligned to the Notifiable Data Breaches scheme. We bring specialist experience with Best Practice (Bp Premier), MedicalDirector and Pracsoft, and support specialist clinics and allied health through our healthcare IT support.
Whether to notify, and what to tell patients, stays with your practice. We help you find out quickly, contain the problem and have the facts to decide within the 30 days. Prevention you can show, not prevention you assume. Talk to our team or call us on (07) 5551 2333.