RACGP 6th Edition Information Security, Privacy and AI: F8 to F11

Where the 6th edition stands today

The Royal Australian College of General Practitioners (RACGP) has published the Standards for general practices (6th edition). RACGP 6th edition information security now sits within a group of IT and digital criteria, and practice managers want to know two things: what will my IT need to show, and when?

The "when" is not settled yet. The Australian Commission on Safety and Quality in Health Care (the Commission), which runs the National General Practice Accreditation (NGPA) Scheme, says on its 6th edition page that "Accreditation under the NGPA Scheme currently uses the 5th edition of the Standards" and that information about arrangements for the 6th edition "will be provided in due course". When we checked in October 2026 (the page was last updated on 26 August 2026), neither the Commission nor the RACGP had published a start date, transition period or end date for 5th edition assessment.

The RACGP's What practices need to know about the sixth edition says timing "will be communicated by the Australian Commission on Safety and Quality in Health Care", and that all practices will need to meet the 6th edition "following the determined transition period". Meanwhile, the Commission encourages practices to begin implementing the 6th edition now, and says your accrediting agency will explain future assessment arrangements to you directly.

How the IT and digital criteria fit in

The 6th edition has four standards plus an optional point of care testing standard. Four criteria in the first, Foundations of general practice, cover most of what an IT provider helps a practice with:

• F8 Information security
• F9 Confidentiality and privacy of health and other information
• F10 Digital health technologies
• F11 Artificial intelligence (AI)

The 6th edition "no longer uses the flagged and unflagged indicator approach" of the 5th edition, and the RACGP's required and aspirational criteria page says "All criteria in the Standards need to be met to achieve accreditation, apart from Aspirational Criterion." Across F8 to F11, only F8.F is labelled aspirational. F8.A to F8.E, F9.A, F9.B, F10.A, F11.A and F11.B are all required, with one condition: the RACGP says the AI criteria "are only applicable and mandatory for practices who use AI tools."

RACGP 6th edition information security: criterion F8

Here is each part of criterion F8 in the RACGP's wording.

F8.A: an ICT continuity, protection and recovery plan

"The practice has an information and communication technology (ICT) continuity, protection, and recovery plan." Under F8.A, the practice:

• maintains, documents and regularly tests that plan, and the plan includes a cyber security incident response plan
• has a backup log operated by the practice or its contracted provider
• maintains up to date antivirus protection and hardware and software firewalls
• keeps information securely in offsite or cloud storage, with the ability to restore it from those backups
• has procedures to tell patients about any data breach affecting their personal information.

The guidance says the incident response plan should cover detection and analysis, containment and eradication (for example blocking compromised accounts), recovery, communication with patients and authorities, and a review afterwards. It also expects daily (or more frequent) backups of critical data such as appointments, billing and patient health information, ideally automated; regular tests that backups can be accessed and read; scanning of incoming email and attachments; timely automatic updates of antivirus and software patches; ongoing staff training on cyber safety and incident reporting; and documented policies for remote access if you allow it.

F8.B: secure electronic systems and ICT

"The practice has secure electronic systems and ICT." The practice must have at least one person, a team member or a contracted provider, with primary responsibility for the security of its electronic systems and ICT. If that person is an external contracted provider, the practice must also have at least one member of its own team with primary responsibility for digital governance. The guidance says this person knows when and how to escalate ICT issues, shares contact details for external experts, educates the team on data security, monitors compliance with security policies, oversees buying and maintaining ICT systems, and aligns ICT with the practice's strategic plan.

F8.B also asks you to document your policies for storing and accessing health information, including remote access, in your privacy policy. When you use an outside IT provider, the guidance asks you to confirm that the provider understands and complies with your data security policies, is experienced with sensitive health data, and has a contract that specifies its obligations, including for remote access.

F8.C to F8.F: communications, social media, records and patient information

• F8.C requires the practice to use digital communications "in a way that protects the privacy of patients and the practice team", and F8.D says the same of social media.
• F8.E requires documented procedures for the storage, retention and destruction of records, both digital and hard copy. The guidance asks for documented processes for disposing of hard drives and other storage media, and for wiping devices such as printers and photocopiers before recycling or disposal.
• F8.F (aspirational): the practice informs patients about the communication products or platforms it uses with them to support their care.

What F8 doesn't spell out

Multi-factor authentication. F8 doesn't mention multi-factor authentication (MFA), a second check such as an app prompt on top of a password, or set password rules, so MFA isn't an F8 requirement. It is an early control in the Australian Signals Directorate's Essential Eight maturity model: at Maturity Level One, MFA is used for online services that process, store or communicate sensitive data. Patient records qualify, so MFA on email, remote access and cloud clinical systems is a sensible way to protect what F8 asks you to secure.

Where your data lives. The guidance says "wherever possible" to store health information and backups in Australia. If you store data overseas, your privacy policy needs to say so and patients need to be told.

Breach notification law. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. F8's guidance also names the Australian Signals Directorate, police and the Department of Home Affairs as contacts for a cyber emergency.

A backup log that nobody reads is not a recovery plan. F8 asks you to test that you can get your data back.

F9: confidentiality and privacy of health information

Criterion F9 has two required criteria.

F9.A: managing health information securely

"The practice manages health information securely and confidentially." Under F9.A, the practice informs patients how their information is managed, has a team member with primary responsibility for privacy, and maintains a privacy policy consistent with the Australian Privacy Principles that the team understands and implements. Two parts are about technology. The practice:

• "protects patient privacy when communicating electronically with or about patients by using a secure message system or other method of encryption, unless the patient has provided informed consent to their information being sent without such protection"
• "informs patients of its data breach protocols."

F9.B: authorised access only

"The practice has a policy and procedure so that only authorised members of the practice team can access its clinical information system, prescription forms, and other official documents." The practice only allows authorised team members to access the clinical information system "via unique individual identification and according to the person's level of authorisation", and describes in its privacy policy how access levels are determined and allocated.

The guidance extends role based access to government online services such as Medicare, My Health Record and correspondence, and asks for screens out of public view, screensavers on unattended devices, and laptops and phones secured to the same standard as desktops.

Where an IT provider helps: setting up individual logins and role based permissions in Bp Premier or MedicalDirector, removing access promptly when staff leave, screen locking and device security, and secure messaging. What stays with the practice: the privacy officer role, the privacy policy itself, and deciding who should have which level of access.

F10: digital health technologies

Criterion F10 is new. It has one required criterion: "The practice uses digital health technologies safely and securely." Examples include telehealth, patient portals, health apps, remote monitoring and secure messaging. Under F10.A, the practice:

• facilitates processes for clinicians to obtain informed consent from patients when using digital health technologies
• "has a documented process for assessing, costing, implementing and managing digital health technologies, including consideration of their potential impacts on the practice, members of the practice team and patients"
• gives the team access to, and collaboration with, technical experts for the digital health technologies it uses.

The guidance is practical about IT: an internet connection that can support multiple video calls if you offer telehealth, equipment with sound and image good enough for clinical use, regular testing of hardware and software including after updates, and remote access to clinical records for staff who work off site. Before introducing a technology, it suggests assessing its safety, workflow impact, support needs and costs, including licensing, upgrades and integration. And it says collaboration with technical experts "goes beyond arranging technical support after implementation", suggesting regular performance reviews and involving them in workflow design.

Where an IT provider helps: internet capacity and failover, telehealth equipment, testing after updates, remote access, the technical side of the assessment and costing, and regular performance reviews. What stays with the practice: the consent process, the decision to adopt a technology, and the documented assessment itself.

F11: artificial intelligence

Criterion F11 is new, and it only applies if your practice uses AI. The RACGP says the Standards "do not require practices to adopt or use AI tools." The guidance names AI scribes, clinical decision support, patient engagement platforms, diagnostic aids and administrative automation as examples.

F11.A: safe and secure use

"Where the practice uses artificial intelligence, it does so safely and securely and consistent with existing standards." Under F11.A, the practice:

• facilitates processes for clinicians "to obtain and document informed consent from patients when aspects of care will be delivered using AI"
• "facilitates data deidentification/anonymisation when using AI tools that process patient data"
• "ensures that identified patient data is not used by AI tools unless its use is clinically necessary, explicitly authorised, and supported by documented governance and consent processes"
• discusses the implementation and use of AI with the practice team to identify practical implications and training needs
• "establishes governance processes for AI use, including accountability and compliance with legislation"
• "documents processes that support clinical oversight of AI outputs."

Members of the clinical team "are accountable for care decisions supported by AI tools."

F11.B: assessing and evaluating AI

"The practice assesses and evaluates its use of artificial intelligence." The practice has a process to assess AI, including risk mitigation, before implementation, and processes for monitoring, review and quality improvement afterwards.

What the guidance says about AI scribes and vendors

AI scribes. The guidance notes that tools used to transcribe consultations may need to access patient records or listen to the consultation, and that this could have data security implications if the tool doesn't comply with Australian privacy law.

Consent and withdrawal. Patients can withdraw consent for AI at any time, and must be told so and given a clear way to opt out. If they withdraw, the practice documents it in the health record, stops using AI in their care unless clinically necessary and authorised again, and offers alternatives where feasible.

Questions for vendors. The guidance suggests asking: does the vendor confirm compliance with the Privacy Act and APPs; can collected data be used or sold for secondary purposes; how is patient data encrypted, stored and destroyed; how is personal information managed; and can clinicians review and confirm AI outputs before use. Contracts with vendors should address data handling, consent and accountability, and the RACGP is clear that practices "remain responsible for their safe and appropriate use" when a third party provides the tool.

Clinical oversight. Clinicians need to be able to review and override AI outputs, patients and the team need a way to question them, and the practice should monitor performance, including reviewing vendor updates for new risks.

ARTG listing. Some AI tools, for example diagnostic aids, decision support systems and transcription tools, "may be classified as medical devices under the Therapeutic Goods Act 1989". If a tool meets that definition, it must be on the Australian Register of Therapeutic Goods (ARTG) before it can be lawfully supplied or used in Australia, and the practice should get documentation from the vendor on its regulatory status. If you're unsure, the RACGP suggests seeking legal or regulatory advice.

What has changed since the 5th edition

In the 5th edition, information security was criterion C6.4, with seven indicators, and privacy was criterion C6.3. The RACGP's mapping of the 6th edition to the 5th edition shows where they went:

• C6.4 D, business continuity and information recovery plan → F8.A, expanded. The 5th edition already asked for a backup log, antivirus and firewalls, tested backups and secure offsite storage. F8.A adds the cyber security incident response plan and procedures for telling patients about a data breach. Emergency and business continuity planning more broadly moves to criterion F2, Response planning.
• C6.4 A and C6.4 B, the person responsible for computer security and keeping health information out of public view → F8.B, expanded. The digital governance role for practices that outsource IT is new.
• C6.4 F and C6.4 G, email and social media policies → F8.C and F8.D, expanded.
• C6.4 E, storage, retention and destruction of records → F8.E, retained or consolidated.
• C6.3 A and C6.3 B, telling patients how their information is managed and how to access it → F9.A, expanded.
• C6.3 D, authorised access to records and official documents, and C6.4 C, unique individual identification for clinical software → F9.B, retained or consolidated.
• F8.F, F10.A, F11.A and F11.B have no direct 5th edition equivalent and are classed as new.

The RACGP says F8's "cyber security emphasis, digital governance role, cyber incident planning and broader ICT governance are all significantly strengthened compared to the fifth edition." It also warns the mapping is for familiarisation only, so don't assume your 5th edition evidence carries straight over.

A readiness checklist for practice managers

You don't need to wait for transition dates to work through these. Many of them also strengthen your evidence for C6.3 and C6.4 at your next 5th edition assessment.

How CSG helps GP clinics with IT and digital standards

We have supported organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. We are a Gold Coast based team, ISO/IEC 27001:2022 certified and audited annually, and we work to the ACSC Essential Eight. For general practices, we bring specialist experience with Best Practice (Bp Premier), MedicalDirector and Pracsoft, and we align clinics to the RACGP Standards for general practices (5th edition), the edition practices are currently accredited against.

Our GP and medical practice IT support already covers much of what F8 to F10 build on: backup and disaster recovery with tested restores, 24/7 monitoring, cyber security controls such as MFA and staff phishing training, secure messaging setup, and telehealth with failover internet. We also supported Gold Coast Primary Health Network through Essential Eight Maturity Level 1 and ISO 27001 certification; you can read about it in our GCPHN case study.

If you are considering AI tools, our AI and automation team can help you work through the technical questions in F11's vendor list, such as where data is stored and how access is controlled. If staff already use AI for admin work, our Claude for business service deploys Claude Team under proper management, so that use sits in accounts your practice controls. The clinical decisions, consent and ARTG questions in F11 remain with your practice.

If you outsource your IT, F8.B means someone in your practice still owns digital governance. We can give that person clear reports on backups, restore tests and security to show an assessor. Tested recovery, not assumed recovery. Talk to our team or call us on (07) 5551 2333.