Managed IT for NZ medical practices, built around patient care.

In healthcare, IT decisions show up at the appointment desk. When the PMS is slow, the day backs up. When Healthlink is down, results don't move. When a privacy breach lands, the OPC has 72 hours of patience and the HDC is watching too.

NZ practices work under a specific set of obligations: the Privacy Act 2020 and the Health Information Privacy Code 2020 set the rules for patient data, the Health Practitioners Competence Assurance Act 2003 governs clinical conduct, and the Health (Retention of Health Information) Regulations 1996 require ten-year minimum retention. Your IT setup needs to make those obligations the easy path, not a compliance burden bolted on top.

This page covers the regulatory framework we work to, the practice management and clinical platforms we deploy and support, and the questions practice managers ask before they switch IT providers.

Three frameworks shape almost every IT decision in a healthcare setting. Your IT provider should know what they are and how they translate into systems.

Health Information Privacy Code 2020 (HIPC). A code of practice issued under the Privacy Act 2020. Sets specific rules for collecting, storing, using and disclosing health information. The Office of the Privacy Commissioner expects breach notification within 72 hours of confirming a notifiable privacy breach.

Health Practitioners Competence Assurance Act 2003. Governs clinical conduct and registration. The Health and Disability Commissioner can investigate complaints, including those involving record-keeping, privacy and continuity of care. Your IT needs to support that scrutiny with reliable audit trails.

Health (Retention of Health Information) Regulations 1996. Patient records must be retained for at least ten years from the date of last service (longer for minors). Practices commonly retain longer for clinical continuity. Backup and archival systems need to demonstrably hold the right data for the right period, with point-in-time recovery and tamper-evident logs.

In practice, these obligations translate to a specific set of IT controls: HIPC-aligned access controls in the PMS, secure messaging through Healthlink rather than ad-hoc email, twelve-year rolling backup with verified restores, multi-factor authentication on every account that touches patient data, and a breach response runbook your senior staff can run on a Saturday morning.

The clinical platforms we deploy and support

We are platform-agnostic but practical. The systems we work with are the ones most NZ practice managers and clinicians will already recognise.

• Practice management: Indici, Medtech32, Medtech Evolution, MyPractice, Profile, Houston Medical
• Secure messaging & clinical integration: Healthlink, HealthOne, ManageMyHealth patient portal, National Health Index (NHI) lookups
• Telehealth: Doxy.me, Whereby for Healthcare, attend Anywhere, Microsoft Teams for Healthcare
• Email and collaboration: Microsoft 365 with conditional access and Defender for Office 365 tuned for healthcare
• Backup & archival: immutable cloud backup with twelve-year rolling retention and verified restore reports
• Specialist clinical platforms: imaging integrations (Carestream, Sectra), medical device network segmentation, multi-site networking for branch surgeries

We are not selling you any specific platform. We make sure the ones you have chosen, or the ones you choose, work properly together with the security, backup and audit evidence the OPC and HDC expect. If a platform decision is genuinely complex (PMS migration, telehealth selection, multi-site network design) we will run a structured assessment before recommending anything.