Allied Health Cybersecurity Guide

Who This Guide Covers

Australian allied health is a diverse sector spanning dozens of professions, each with slightly different technology environments and risk profiles. This guide specifically addresses the cybersecurity needs of:

While the specific practice management software and clinical workflows differ across these professions, the underlying cybersecurity risks are remarkably consistent: BYOD devices, sensitive patient records, Medicare and NDIS billing credentials, and staff working across multiple clinic locations. The Office of the Australian Information Commissioner (OAIC) classifies all health information held by allied health providers as sensitive information under the Privacy Act, requiring the highest standard of protection.

BYOD Security Risks Unique to Allied Health

Allied health practitioners frequently work across multiple clinic locations — a physiotherapist may see patients at three different practices across the week, carrying their personal iPad from site to site. This "multi-site BYOD" model creates a web of risk that is far more complex than a single fixed-site GP practice.

When a physiotherapist's personal tablet connects to Clinic A's Wi-Fi on Monday, then carries whatever it picked up to Clinic B on Wednesday, any malware acquired at one site can potentially spread to the next. Personal devices are rarely maintained to enterprise security standards: they may run outdated operating systems, lack encryption, have no passcode or biometric lock, and be used by family members at home who download unauthorised apps.

Psychology practices face an elevated version of this risk. Psychologists often see patients in private rooms with personal laptops, access clinical notes via personal cloud accounts, and may work from home between clinic sessions. Each transition point — home to clinic, clinic to clinic — is an opportunity for data to be exposed or for malware to travel.

Telehealth Security: Securing Video Consultations

Telehealth expanded dramatically in Australian allied health post-COVID. Psychology, occupational therapy, speech pathology, and physiotherapy all now commonly deliver services via video consultation. The Medicare Benefits Schedule (MBS) includes telehealth items for most allied health professions, driving widespread adoption. However, the security and compliance dimensions of telehealth are often poorly understood.

Platform selection matters. Coviu is an Australian-developed telehealth platform purpose-built for healthcare, with Australian data storage, ADHA alignment, and Healthcare Identifier Service integration. It uses end-to-end encryption for video sessions and has a published security architecture. Zoom, while widely used, is not purpose-built for healthcare — its default settings do not meet healthcare-grade privacy requirements, and session recordings may be stored on Zoom's US servers without additional configuration to enforce data residency.

Patient consent is a specific telehealth obligation. Before conducting a telehealth consultation, you must obtain the patient's informed consent for the telehealth modality, and that consent must be documented in the patient record. Consent records are health information and must be stored securely in your practice management system — not in a personal email inbox or a personal Google Docs folder.

For a detailed guide to telehealth security compliance, see our Telehealth Security & Compliance Guide.

Dental Practice Security: Imaging Systems and Network Exposure

Dental practices face a specific technical risk that other allied health providers generally do not: diagnostic imaging equipment on the clinical network. Dental X-ray systems, OPG machines, and CBCT (Cone Beam Computed Tomography) scanners are networked devices running embedded software that is rarely updated and often runs on Windows 7 or earlier operating systems with no vendor patch support.

These imaging systems are frequently connected directly to the same network as the practice management system and internet-facing computers. An attacker who compromises an internet-facing workstation through a phishing email can, in a practice with poor network segmentation, move laterally within minutes to reach the clinical server hosting the patient database.

The solution is network segmentation: put imaging systems on an isolated network segment (VLAN) that cannot directly communicate with the practice management server or the internet-facing workstations. This limits the blast radius if one segment is compromised. Your IT provider can typically implement basic VLAN segmentation on a managed switch for minimal cost.

Allied Health Practice Management Systems

The most widely used practice management platforms in Australian allied health — Nookal, Cliniko, Power Diary, and Halaxy — are all cloud-based SaaS platforms. This shifts infrastructure security responsibility to the vendor, but preserves critical security obligations for your practice:

BYOD Policy: What Your Practice Must Require

Every allied health practice that allows practitioners to use personal devices to access patient records must have a formal, written BYOD policy. This is not optional — the OAIC expects it as part of your APP 11 security framework. Your BYOD policy must address:

Working From Home: VPN, Home Networks, and Printer Security

Allied health practitioners working from home between clinic sessions — reviewing notes, writing reports, completing telehealth consultations — introduce home network risks into the clinical environment. Home routers are typically consumer-grade devices with default passwords unchanged since installation, no firmware updates for years, and no network segmentation between work and IoT devices (smart TVs, baby monitors, and home assistants on the same network as your clinical laptop).

VPN requirement: All remote access to the practice management system or patient records must be conducted over a Virtual Private Network (VPN). A VPN encrypts the connection between the home computer and the practice network, preventing eavesdropping on unsecured home Wi-Fi. Microsoft Azure VPN Gateway or a simple business VPN service (NordLayer, Cisco AnyConnect) is adequate for most allied health practices.

Printer security: Home printers that receive patient documents are a frequently overlooked risk. Modern home printers store documents in internal memory that can be accessed if the printer is connected to the internet. Never print patient records on a home printer unless the printer is business-grade, firmware-patched, and not internet-facing. Most clinical printing should occur at the clinic, on managed, encrypted printers.

Medicare and NDIS Billing Security

Allied health providers billing under Medicare and the NDIS hold two sets of sensitive payment credentials: Medicare provider credentials (PRODA accounts) and NDIS portal access (myplace provider portal). Both are high-value targets for cybercriminals. A compromised NDIS provider account can be used to lodge fraudulent payment claims for services never delivered, resulting in financial loss and — if not caught quickly — a compliance investigation by the NDIS Quality and Safeguards Commission.

Related Resources