Healthcare Privacy Act IT Compliance Perth

"Access control — only authorised staff access patient records"

Every staff member should have an individual account. Shared logins are not acceptable. Role-based access means reception staff can't access clinical notes they don't need.

"Multi-factor authentication on all accounts"

MFA is the single most effective control for preventing unauthorised access to systems containing patient data. DM1 enables MFA across all Microsoft 365 accounts as standard.

"Device management for all devices accessing patient data"

Every device that accesses patient data must be enrolled and managed. DM1 uses Microsoft Intune to enforce compliance on all devices.

"Encrypted storage for all patient data"

Data at rest on laptops and desktops must be encrypted. DM1 enables BitLocker on all Windows devices and monitors encryption compliance through Intune.

"Data breach detection and notification capability"

The Privacy Act requires notification of eligible data breaches. DM1 configures Microsoft Defender and Entra ID audit logging to detect potential breaches.

"Documented data retention and destruction policy"

Patient records must be retained for required periods and then securely destroyed. DM1 configures Microsoft 365 retention policies aligned with your practice's retention requirements.