The checklist
§01
What it covers.
12 areasFor practice managers, clinical leads, and partners at New Zealand GP and specialist practices. It is built around the controls clinical IT environments actually need: the ones that protect patient information, keep the clinical system available during a ransomware incident, and produce defensible evidence for an Office of the Privacy Commissioner inquiry. Each area is grounded in a specific NZ rule, a specific clinical workflow, or a specific failure mode.
- ✓ Health Information Privacy Code 2020 (HIPC) The thirteen Health Information Privacy Rules applied to anyone collecting, holding, or disclosing health information.
- ✓ Privacy Act 2020 in a clinical setting Mandatory breach notification and the serious-harm threshold as they apply to patient records.
- ✓ indici, Medtech, Profile, MyPractice security Securing the small, well-known set of NZ clinical systems and the access around them.
- ✓ Healthlink and secure messaging Protecting referrals, lab results, and clinical correspondence as they move between systems.
- ✓ Patient portal MFA Multi-factor authentication on the portal that exposes patient data to the outside world.
- ✓ Clinical-grade uptime and continuity of care Keeping the clinical system available so care does not stop when IT does.
- ✓ Ransomware exposure for NZ practices The realistic attack scenarios, and why network segmentation matters more than the entry point.
- ✓ Ministry of Health and Te Whatu Ora guidance Aligning your controls with the sector guidance practices are expected to follow.
- ✓ Breach notification to the OPC A defensible process for assessing and notifying a health information breach.
- ✓ Staff training and clinical workflows Training that fits the way clinical staff actually work, not generic security slides.
- ✓ BYOD policy for clinical staff Personal devices touching patient data, and the controls that contain the risk.
- ✓ Backup testing and after-hours support continuity Tested restores and a support path that holds up outside business hours.
Want the controls
implemented, not just listed?
We work with Australian GP and specialist practices on clinical IT, HIPC alignment, and continuity of care.
