NZ medical practice cyber readiness.

For practice managers, clinical leads, and partners at New Zealand GP and specialist practices. It is built around the controls clinical IT environments actually need: the ones that protect patient information, keep the clinical system available during a ransomware incident, and produce defensible evidence for an Office of the Privacy Commissioner inquiry. Each area is grounded in a specific NZ rule, a specific clinical workflow, or a specific failure mode.

• ✓
  Health Information Privacy Code 2020 (HIPC) The thirteen Health Information Privacy Rules applied to anyone collecting, holding, or disclosing health information.
• ✓
  Privacy Act 2020 in a clinical setting Mandatory breach notification and the serious-harm threshold as they apply to patient records.
• ✓
  indici, Medtech, Profile, MyPractice security Securing the small, well-known set of NZ clinical systems and the access around them.
• ✓
  Healthlink and secure messaging Protecting referrals, lab results, and clinical correspondence as they move between systems.
• ✓
  Patient portal MFA Multi-factor authentication on the portal that exposes patient data to the outside world.
• ✓
  Clinical-grade uptime and continuity of care Keeping the clinical system available so care does not stop when IT does.
• ✓
  Ransomware exposure for NZ practices The realistic attack scenarios, and why network segmentation matters more than the entry point.
• ✓
  Ministry of Health and Te Whatu Ora guidance Aligning your controls with the sector guidance practices are expected to follow.
• ✓
  Breach notification to the OPC A defensible process for assessing and notifying a health information breach.
• ✓
  Staff training and clinical workflows Training that fits the way clinical staff actually work, not generic security slides.
• ✓
  BYOD policy for clinical staff Personal devices touching patient data, and the controls that contain the risk.
• ✓
  Backup testing and after-hours support continuity Tested restores and a support path that holds up outside business hours.