Health data carries the highest consequence if it is exposed, and healthcare businesses tend to run on the widest spread of systems. A single clinic can touch six places a patient record lives before lunch.
The Act applies to every organisation that holds personal data. What reasonable looks like changes a great deal by sector, and this is what it changes to here.
What makes this sector different
Clinics, diagnostic laboratories, day care centres, pharmacies and digital health platforms hold information people would not want shared under any circumstances. The sensitivity is understood. What is usually missing is the paperwork and the structure around it.
The pattern we see most often is a practice that is careful with the clinical record and unaware of other obligations around it. The record is locked down but other information continues to surface and move via WhatsApp or email or through spreadsheets without any access control. The appointment list is on WhatsApp, the reports go out by email, and the front desk keeps a spreadsheet.
Where personal data usually sits
Drawn from engagements and from the questions that come up most often on first calls in this sector.
| System | What it holds | What usually needs attention |
|---|---|---|
| Practice or hospital system | Patient demographics, clinical notes, prescriptions, billing | Staff who left still have active accounts |
| Diagnostic reports | Test results sent to patients and referring doctors | Reports emailed as unprotected attachments, or sent over WhatsApp |
| Appointments and front desk | Names, phone numbers, reasons for visit, walk-in registers | A spreadsheet or paper register that no system knows about |
| Referral network | Patient details shared with referring and receiving practitioners | No written basis for the sharing, and no record of what was sent |
| Insurance and TPA | Claims data, pre-authorisation documents, identity proof | Documents retained long after the claim closed |
| Marketing and recall | Campaign lists, health check reminders, follow-up messaging | Clinical information used to target messages without consent |
What we look at first here
Reports leaving by WhatsApp and personal email. Fast, convenient, and the single most common exposure we find in this sector.
Front desk registers. Paper or spreadsheet, outside every system, holding name, number and often the reason for the visit.
Marketing built on clinical data. Using what you know about a patient's condition to target a message is a different act from reminding them of an appointment, and it needs a different basis.
The referral chain. Data moves between practitioners constantly, and almost never with a written arrangement behind it.
Records about children. Paediatric practice, school health programmes and family plans all involve data about minors, which carries extra requirements.
Which steps carry the most weight
The full sequence is on the engagement page. In this sector, these three usually do the heavy lifting.
Discovery and mapping
We follow the patient journey end to end, including the parts that happen on phones and paper rather than in the clinical system.
Gap analysis
Where clinical necessity ends and marketing begins is the line that matters most here, and it is usually undrawn.
Compliance Support
Notices at registration, a secure route for reports, retention rules, and the rules on what may be used for recall and what may not.
Health information deserves more care than a generic compliance programme gives it. We size the controls to the practice, but this is one sector where we will push back if you want to do the minimum.
Not quite your business?
Every engagement is scoped to what you actually run, so none of these pages will match you exactly.
Thirty minutes, and you will know where you stand.
Tell us what your business runs on. We will tell you which gaps matter most, whether or not you engage us.