How to prevent data breaches in healthcare: a practical guide

August 16, 2026
IT Start

The quickest way to prevent most healthcare data breaches is to pair multi-factor authentication with verified, offline backups and a tested incident response plan. That combination stops the majority of attacks before they cause serious harm.

If you want a short checklist to start with:

Enable MFA on all remote access, Microsoft 365 accounts and privileged logins
Verify your backups with actual restore tests, not just job success indicators
Map your sensitive data flows and know where patient records actually sit
Segment your network so clinical systems are isolated from admin and guest traffic
Run phishing simulations and role-based training regularly
Have a written, tested incident response plan aligned to OAIC’s four-step framework

The NIST Cybersecurity Framework, ACSC guidance, and OAIC’s health provider obligations all point to the same priorities. The gap between knowing this and actually doing it is where most healthcare organisations get hurt.

Key takeaways

Preventing healthcare data breaches requires MFA, verified backups and a tested incident response plan as the non-negotiable baseline, supported by governance, training and continuous monitoring.

Point	Details
MFA is the highest-impact control	Enable MFA on all Microsoft 365 accounts, remote access and privileged logins before anything else.
Backups must be tested, not assumed	Run a full restore test at least quarterly; a green backup job does not confirm recoverability.
Contain first, then notify	Follow the OAIC four-step plan: contain, evaluate, notify OAIC and affected individuals, then review.
Training must be role-based and repeated	Clinical, reception and IT staff need different training; phishing simulations should run at least quarterly.
IT Start delivers the baseline fast	IT Start’s managed security service covers MFA rollout, backup verification and M365 hardening in the first 90 days.

What to do in the first 24 hours when a breach is suspected
Governance, risk assessment and data mapping
Core technical controls that stop the majority of healthcare breaches
Network segmentation, endpoint detection and continuous monitoring
Managing third parties and cloud suppliers safely
People: phishing, role-based training and insider threat controls
Incident response playbook, notification steps and legal obligations
Penetration testing, vulnerability scanning and continuous improvement
A practical 90/180/365 day roadmap for healthcare organisations
What most organisations get wrong: MSP field notes
The trade-offs no one talks about
How IT Start supports healthcare providers with managed security
Sources
FAQ

What to do in the first 24 hours when a breach is suspected

Speed matters here. The first hour is about limiting damage and preserving evidence, not fixing everything at once. Here is a time-sequenced checklist your IT lead or on-call team can follow.

0 to 1 hour: Contain immediately

Isolate the affected system or device from the network. Unplug the network cable or disable the Wi-Fi adapter. Do not power it off yet.
Revoke or rotate credentials for any accounts that may have been compromised. Start with admin accounts and shared logins.
Block the suspected attack vector. If it came through a phishing link, block the domain at your DNS filter or firewall.
Notify your internal IT lead or MSP account manager. Do not wait until you have all the facts.
Document everything you do, with timestamps. This record becomes your forensic log.

1 to 6 hours: Assess and preserve evidence

Capture memory dumps, system logs, authentication logs and network traffic captures before touching the affected system further. The ACSC can provide technical assistance and may request these artefacts if you escalate.
Identify what data was accessed or exfiltrated. Focus on whether patient records, My Health Record data or Medicare information was involved.
Check whether the incident affects other systems. Lateral movement is common in ransomware attacks.
Engage your legal counsel if patient data is confirmed as affected. Notification obligations may apply.

6 to 24 hours: Notify and stabilise

Report to the ACSC via cyber.gov.au if the incident is significant. Early reporting may trigger triage support.
Assess whether the OAIC Notifiable Data Breaches scheme applies. The OAIC’s four-step action plan for health providers covers contain, evaluate, notify and review.
Begin restoring from a known-clean backup only after confirming the attack vector is closed.

Pro Tip: Call your MSP account manager before you call your insurer. A good MSP will have your environment documented and can confirm which systems are clean, which backups are usable and what your recovery time looks like. That information is what your insurer and legal team need first.

The Verizon Data Breach Investigations Report consistently shows that the time between initial compromise and detection in healthcare incidents is measured in days or weeks, not hours. Getting your containment steps right in that first day makes a material difference to how much data is ultimately exposed.

Governance, risk assessment and data mapping

You cannot protect what you have not mapped. This is the step most small healthcare organisations skip, and it is why their technical controls end up protecting the wrong things.

A focused risk assessment for a healthcare organisation should cover three threat scenarios: ransomware and malicious external attack, credential theft and phishing, and insider error or misuse. Those three categories account for the large majority of healthcare data breaches analysed in published research. Your governance work should be scoped around them.

Asset inventory: what to document

Every system that stores or processes patient data, including EHR platforms, practice management software, imaging systems and billing tools
Where My Health Record or clinical data flows: which systems read or write to it, which staff have access and which third parties connect
Privileged accounts: local admin accounts, domain admins, shared service accounts and vendor remote access credentials
Data flows between systems, including any integrations or API connections
Physical locations where data is stored or accessed, including reception desks, consulting rooms and offsite locations

Data classification and minimisation

Health information is sensitive by definition under the Privacy Act 1988. Your classification policy should identify which data is most sensitive (identifiable patient records, Medicare numbers, mental health or reproductive health data), where it is stored, who can access it and how long it is retained. OAIC guidance on embedding privacy in health practice recommends a formal privacy management plan, a records register and documented accountability for data handling.

Data minimisation is practical, not just a compliance requirement. If a system does not need to hold a patient’s full Medicare number, configure it not to. If reception staff do not need access to clinical notes, restrict it. Less data in more places means a smaller breach when something goes wrong.

The NIST Cybersecurity Framework’s Identify function maps directly to this work. ACSC’s Essential Eight and the Information Security Manual both expect organisations to have a current asset register and a documented understanding of their data environment before applying technical controls.

Core technical controls that stop the majority of healthcare breaches

This is where most of the risk reduction happens. The controls below are not theoretical. They are the ones that, when missing, show up in breach reports.

Multi-factor authentication. Enable MFA on every remote access point, every Microsoft 365 account and every privileged login. No exceptions for senior clinicians or practice owners. The ACSC and OAIC both identify credential theft and phishing as leading breach causes and recommend MFA as the primary mitigation. Use an authenticator app rather than SMS where possible.
Patching and change control. Patch internet-facing services and clinical devices within 48 hours of a critical update. Everything else should be patched within a defined monthly window. Document every change. The ACSC rates ransomware as the most significant cybercrime threat to the health sector and notes that unpatched systems are a primary entry point.
Backups: verified, offline and tested. Your backup job showing green does not mean your data is recoverable. Run a full restore test regularly. Keep at least one copy offline or air-gapped, and one offsite or in a separate cloud tenancy. Define your recovery time objective and recovery point objective before you need them.
Encryption at rest and in transit. Encrypt laptops and portable devices using BitLocker or equivalent. Confirm that your EHR and practice management systems use TLS for data in transit. Check that cloud storage buckets or SharePoint libraries containing patient data are not publicly accessible.
Role-based access control (RBAC) and privileged access management. Every staff member should have the minimum access needed to do their job. Admin accounts should be separate from day-to-day user accounts. No one should be browsing the internet or reading email from a domain admin account.
Secure configuration for Microsoft 365 and EHR systems. Disable legacy authentication protocols in Microsoft 365 (they bypass MFA). Enable audit logging. Restrict macro execution in Office applications. Review external sharing settings in SharePoint and OneDrive. These are settings that often ship in a permissive default state and stay that way unless someone checks.
Secure default configurations and change control. Every new system or device should be configured against a documented baseline before it connects to the network. Changes to configurations should go through an approval process, even in small practices.

Pro Tip: In a single Microsoft 365 maintenance window, an MSP can disable legacy authentication, enable unified audit logging, set MFA to required for all users and review external sharing settings. That one session closes several of the most common attack paths we see in healthcare tenancies.

Network segmentation, endpoint detection and continuous monitoring

Network segmentation is the control that stops a breach on one system from becoming a breach across every system. For a small clinic or hospital, a practical segmentation model looks like this:

Clinical network: EHR servers, imaging systems and clinical workstations. No internet browsing from this segment. Strict firewall rules controlling what can connect in or out.
Admin network: Reception, billing, HR and management systems. Internet access permitted but filtered. Separate from clinical systems.
Guest Wi-Fi: Completely isolated from both clinical and admin networks. No access to internal resources.
Vendor access: Remote access for EHR vendors, MSPs and other third parties should use a dedicated VPN or jump server with per-session logging. Never give a vendor persistent, unmonitored access to your clinical network.

Endpoint detection and response (EDR)

Deploy an EDR solution on every endpoint, including clinical workstations. EDR tools monitor for behavioural indicators of compromise, not just known malware signatures. Set up alerting for high-risk events: new admin account creation, bulk file access or encryption activity, unusual outbound connections. Triage alerts promptly. Alert fatigue is a real problem, so tune your thresholds to reduce noise without suppressing genuine detections.

Logging and retention

The ISM specifies logging and retention requirements for organisations handling sensitive data. At minimum, retain authentication logs, endpoint event logs and network flow logs for 90 days, with longer retention (up to 12 months) for forensic readiness. Store logs in a location that is separate from the systems being monitored so an attacker cannot delete them.

Pro Tip: Start with authentication logs and failed login events. They are cheap to collect, easy to store and often the first indicator of a credential-stuffing or brute-force attack. Set an alert for more than five failed logins on any account within ten minutes.

Managing third parties and cloud suppliers safely

Third-party access is one of the most under-managed risks in small healthcare organisations. We see this a lot: an EHR vendor has had persistent remote access for three years, the credentials have never been rotated and no one can tell you what they accessed last Tuesday.

Vendor inventory and criticality scoring

List every third party with access to your systems or data: EHR vendors, cloud hosts, MSPs, billing services, pathology integrations and any software-as-a-service platforms
Score each by criticality: what happens to patient care if this vendor’s access is cut off or compromised?
Prioritise your highest-criticality vendors for formal risk assessments and contractual controls

Minimum contract clauses to demand

Access logging: the vendor must log all access to your systems and provide those logs on request
Data handling: specify what data the vendor can access, store and process, and where
Subprocessor disclosure: the vendor must tell you if they use subcontractors who will touch your data
Incident notification: the vendor must notify you within 24 hours of a suspected breach affecting your data

Authenticating and monitoring third-party access

Use just-in-time access where possible. Create a dedicated account for each vendor rather than sharing credentials. Require MFA for all vendor logins. Review active vendor sessions at least monthly and revoke access for vendors whose contracts have ended or whose work is complete.

Supply chain contingency planning

If your primary EHR vendor goes offline, what is your fallback? Document the answer. For cloud-hosted clinical systems, confirm your vendor’s recovery time commitments in writing and test them. Cloud security considerations for healthcare include understanding where your data is physically stored and what happens to it if the vendor experiences an outage or breach.

People: phishing, role-based training and insider threat controls

Human error is consistently one of the leading causes of healthcare data breaches, as the RACGP notes for general practice settings. Training is not optional and it is not a one-off event.

Role-based training calendar

Clinical staff (GPs, nurses, allied health): Annual security awareness training covering phishing recognition, safe handling of patient data and what to do if they suspect a breach. Quarterly phishing simulations.
Reception and admin staff: Same annual training plus specific guidance on verifying caller identity before disclosing patient information, and safe email practices. They are the most targeted group.
IT and admin account holders: Additional training on privileged account hygiene, change control and recognising signs of compromise. Semi-annual review of their access rights.
Practice managers and owners: Governance-level training covering their notification obligations under the Privacy Act, the Notifiable Data Breaches scheme and My Health Record rules.

Phishing simulation KPIs

Click rate on simulated phishing emails: target low across all staff
Reporting rate: target above 80% of staff reporting suspicious emails to IT
Repeat offenders: any staff member who clicks on three or more simulations in a 12-month period should receive one-on-one remediation training

Digital Health Australia frames security as a collective responsibility, not just an IT function. Training that builds a culture of scepticism and reporting reduces successful phishing incidents more than any technical filter alone.

Insider threat controls

Apply least privilege across all systems. Review access rights quarterly.
Separate admin accounts from standard user accounts for all IT staff.
Log and alert on unusual data access patterns: bulk downloads, access outside business hours, access to records the staff member has no clinical reason to view.
Tie training results back into your risk register. A team with a high phishing click rate is a documented risk that warrants additional controls.

For a practical staff cybersecurity training guide tailored to SMEs, the IT Start blog covers scheduling and simulation tools in more detail.

Incident response playbook, notification steps and legal obligations

A written incident response plan that has never been tested is not a plan. It is a document. The difference matters when a ransomware attack hits at 11pm on a Friday.

Stepwise playbook: Contain, Assess, Notify, Review

Contain: Isolate affected systems, revoke compromised credentials, block the attack vector. Preserve evidence before making changes.
Assess: Determine what data was accessed or exfiltrated. Identify whether My Health Record data, Medicare information or other sensitive health records were involved. Engage legal counsel.
Notify: Follow the OAIC’s notification requirements under the Notifiable Data Breaches scheme. If My Health Record data is involved, notify the System Operator (Australian Digital Health Agency) as well.
Review: Conduct a post-incident review within 30 days. Update your risk register, your controls and your incident response plan based on what you learned.

Notification timeline

Trigger	Notification recipient	Timeframe
Eligible data breach confirmed	OAIC (NDB scheme)	As soon as practicable
My Health Record data involved	Australian Digital Health Agency	As soon as practicable
Significant cyber incident	ACSC (cyber.gov.au)	Immediately or as soon as safe
Affected individuals	Direct notification or public statement	As soon as practicable after OAIC

The OAIC data breach action plan for health providers sets out what information to include in your notification to the OAIC and to affected individuals.

Tabletop exercise checklist

Run a tabletop exercise regularly. Invite clinical leadership, the practice manager, IT and legal counsel. Use a realistic scenario: ransomware encrypts your EHR server at 7am on a Monday. Walk through every decision point. Who declares the incident? Who calls the OAIC? Who communicates with patients? Legal and operational resilience guidance from Allens recommends supplier mapping and tabletop exercises as core components of healthcare incident preparedness.

Pro Tip: The most common mistake we see during containment is powering off the affected system immediately. That destroys volatile memory, which often contains the attacker’s tools and credentials. Isolate from the network first. Power off only when a forensic professional advises it. For guidance on forensic evidence collection after a breach, the steps matter as much as the speed.

Penetration testing, vulnerability scanning and continuous improvement

Testing is how you find out whether your controls actually work, rather than assuming they do.

Internal vulnerability scans: Run weekly or fortnightly using a tool like Tenable Nessus or Qualys. Focus on internet-facing services, unpatched systems and misconfigured services.
External scans: Monthly scans of your external attack surface. These simulate what an attacker sees from outside your network.
Annual penetration test: Engage a qualified penetration tester to attempt to compromise your environment. For healthcare organisations, include your EHR system, remote access infrastructure and Microsoft 365 tenancy in scope.
Post-change targeted checks: After any significant infrastructure change, run a targeted scan of the affected systems before returning them to production.

Prioritising remediation

Not every vulnerability is equal. Prioritise based on three factors: exploitability (is there a known exploit in the wild?), asset criticality (does this system hold patient data or support clinical operations?) and exposure (is the system internet-facing?). A critical vulnerability on an internet-facing EHR integration server is your first fix, every time.

Integrate test results into your risk register. Each finding should have an owner, a remediation deadline and a verification step. This is the evidence your accreditation body or practice manager needs to demonstrate continuous improvement. Reporting templates for board or practice manager review should include: findings by severity, remediation status, trend over time and any accepted risks with documented rationale.

A practical 90/180/365 day roadmap for healthcare organisations

This roadmap is designed for a small healthcare IT team or MSP managing a practice with 10 to 50 staff. Adjust timelines based on your current baseline.

Phase 1 priorities (0 to 90 days)

MFA on all accounts: this is the single highest-impact control and can be deployed in a maintenance window
Backup verification: run a full restore test and confirm your recovery point and recovery time objectives
Microsoft 365 hardening: disable legacy auth, enable audit logging, review sharing settings
Asset inventory: document every system and data flow

Phase 2 priorities (90 to 180 days)

Deploy EDR on all endpoints
Segment your network: clinical, admin and guest traffic on separate VLANs
Complete RBAC review and separate admin accounts
Write and distribute your incident response plan

Phase 3 priorities (180 to 365 days)

Commission an annual penetration test
Run your first tabletop exercise
Implement log aggregation and set up alerting
Complete your first formal vendor risk review

For healthcare organisations in Queensland, the IT optimisation and compliance guide covers how to sequence these investments alongside clinical system upgrades.

On cost: MFA and M365 hardening are largely a labour cost, not a licensing cost, if you are already on Microsoft 365 Business Premium. EDR adds a per-seat licensing cost. A penetration test for a small practice typically runs in the low thousands of dollars. The cost of a breach, including notification, legal fees, remediation and reputational damage, is orders of magnitude higher.

What most organisations get wrong: MSP field notes

Honestly, we see the same problems across almost every new healthcare client we onboard. The issues are not exotic. They are basic, fixable and surprisingly common.

The most common failings we find

No MFA anywhere, including on Microsoft 365 and remote access. Staff are using the same password they set up five years ago.
Backups that have never been tested. The backup job shows green every night. The last successful restore test was never done. We have seen practices discover their backup had been failing silently for months.
Admin accounts used for daily tasks. The practice owner logs into their domain admin account to check email. That account is one phishing click away from full network compromise.
Vendor access that was set up once and never reviewed. A software vendor has had VPN access for two years. No one knows what they have accessed.
No documented data flows. Staff cannot tell you where patient records are stored, which systems sync to the cloud or who has access to what.

Three quick wins an MSP can deliver in a single maintenance window

MFA rollout for Microsoft 365: Enable Conditional Access policies requiring MFA for all users. Exclude break-glass accounts with documented procedures. Takes two to three hours for a tenancy of 20 to 50 users.
Backup verification restore: Pull a recent backup and restore a non-critical system or a set of files to a test environment. Confirm the data is intact and the restore process works. Document the result.
Privilege separation: Identify all users with admin rights who are using those accounts for daily tasks. Create standard user accounts for daily use and restrict admin accounts to administrative tasks only.

The RACGP notes that information security must be an ongoing business priority, not a one-off project. We agree. The practices that stay secure are the ones that treat these controls as operational hygiene, not a compliance checkbox.

Pro Tip: *When you onboard a new healthcare client, check the Microsoft 365 Secure Score first. It gives you a baseline, flags the highest-impact gaps and lets you show the practice manager exactly what changed after your first maintenance window.

For more on protecting data for healthcare organisations and what the first engagement looks like in practice, the IT Start blog covers common starting points and quick wins in detail.

The trade-offs no one talks about

Patching is the control that causes the most friction in healthcare settings. Clinical systems, particularly older EHR platforms and medical imaging software, often have vendor-imposed restrictions on OS updates or patch timing. The vendor says “do not patch until we certify the update.” The security team says “patch now.” Both are right, and neither can fully give way.

The practical answer is to document the exception, compensate with additional monitoring on the unpatched system, and push the vendor for a certification timeline in writing. An unpatched system with enhanced logging and network isolation is meaningfully safer than an unpatched system with no visibility at all.

The other trade-off is MFA and clinical workflow. Clinicians moving between workstations in a busy ward or clinic find repeated MFA prompts disruptive. The answer is not to exempt clinical staff. It is to implement shared workstation solutions, Windows Hello for Business, or proximity card authentication that satisfies MFA requirements without adding friction to every login. The technology exists. The configuration takes time, but it is worth doing properly rather than creating blanket exemptions that undermine your whole MFA posture.

Security is not a one-off project. The RACGP is clear on this: it is a continuous business priority. The practices that treat it as a project to be completed and filed away are the ones that call us after a breach.

How IT Start supports healthcare providers with managed security

Healthcare IT teams are stretched. Clinical priorities come first, and security work gets pushed to weekends or skipped entirely. IT Start works with small and mid-sized healthcare providers to close the gaps that matter most, without requiring you to build an in-house security team.

The engagement starts with a risk snapshot: we review your Microsoft 365 configuration, your backup posture, your network layout and your current access controls. Most clients see their highest-risk gaps identified and addressed within the first 90 days. Services include managed cybersecurity, backup verification and recovery testing, Microsoft 365 hardening, EDR deployment and ongoing monitoring. For practices that need cloud-hosted infrastructure, IT Start’s cloud services cover secure configuration and ongoing management.

If you want to know where your practice stands right now, contact IT Start for a free security assessment.

Sources

These are the primary documents used to build the guidance in this article. Each is worth reading in full if you are responsible for security governance in a healthcare organisation.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is the most effective way to prevent healthcare data breaches?

Multi-factor authentication combined with verified offline backups and a tested incident response plan stops the majority of healthcare breaches. The ACSC and OAIC both identify credential theft and phishing as leading causes, making MFA the single highest-impact control to deploy first.

What is the biggest threat to healthcare data security?

Ransomware is the most significant cybercrime threat to the Australian health sector, according to the ACSC health sector snapshot. Phishing and credential theft are the most common entry points that enable ransomware attacks.

What are the top causes of healthcare data breaches?

The three leading causes are malicious external attacks (including ransomware and phishing), insider error (misdirected emails, incorrect access settings, accidental disclosure) and lost or stolen devices. Published research on healthcare breach classification confirms that human error and misconfiguration contribute to a significant share of incidents alongside deliberate attacks.

What are healthcare organisations legally required to do after a breach?

Under the Privacy Act 1988 and the Notifiable Data Breaches scheme, Australian health providers must notify the OAIC and affected individuals as soon as practicable after confirming an eligible data breach. If My Health Record data is involved, the Australian Digital Health Agency must also be notified. The OAIC data breach action plan sets out the full notification requirements. This is general information; confirm current obligations with your legal counsel.

How often should healthcare organisations test their incident response plan?

At least annually, using a tabletop exercise that includes clinical leadership, IT and legal counsel. A written plan that has not been tested under realistic conditions will not perform reliably during an actual incident.