Privacy and Cyber Safety for the Whole Practice Team
A short yearly refresher for everyone who works in a general practice: what you say, show and send, who you tell and what you open, and what to do when a message asks you to click, pay or sign in.
Who this is for
Everyone who works in an Australian general practice or has access to the building: reception, nurses, GPs’ assistants, cleaners, contractors and practice managers. No clinical or technical knowledge is needed.
Practice managers who run the privacy and security systems should also take Privacy Systems, Records Requests and Responsible AI Use. Reception staff will find records requests covered in more depth in the Comprehensive GP Receptionist Certificate.
The people and practice in this course are made up; Rivergum General Practice’s rules are examples your practice can change. Your practice’s own policy always comes first.
Learning time: allow about 30 minutes for three short lessons and a nine-question check. There is no workbook or upload.
Why it matters
Health service providers made 225 of the 1,205 data breach notifications the privacy regulator, the OAIC, received in 2025, more than any other sector. Most of what protects a practice is ordinary and done by ordinary staff: a checked address, a locked screen, a phone call before a payment, and telling the practice manager immediately if information may have been accessed or disclosed, or a device is missing.
What you will practise
- Keeping patient information from being overheard at the desk or read from a screen or a piece of paper.
- Two checks before every email, fax or letter: the address and the attachment.
- What to say to a relative, an insurer or anyone else who asks about a patient.
- Opening only the records your work needs, including when the name is one you know.
- Reporting a possible breach straight away: you report, the practice decides.
- Spotting a suspicious email, text or call, and a fake request to change bank details.
- Protecting your login, your sign-in codes, your screen, your phone and the practice’s computers.
- Keeping patient and staff information out of unapproved AI tools, even when a name has been removed.
Three short lessons
- Heard, seen, sent: where patient information slips out
- Do you need to look, and who is asking?
- Scams, logins and devices
Learn by making decisions
Each lesson opens with a Rivergum situation and asks you to choose before it explains. You get the words to say and who to tell. Lessons 2 and 3 start with a quick recall question, and lesson 3 ends with mixed practice from all three lessons. Practice activities are not scored or saved. A one-page printable desk card sums up the scripts and steps to keep at your desk.
Assessment and completion
Complete the three lessons, then answer all nine questions in the check correctly (100%). Each question is a decision a staff member makes. There is no time limit; read the feedback and retry as often as you need. You receive a certificate of completion.
This is professional development, not accredited CPD, and it is not endorsed by the RACGP or any other body. It supports your practice’s own privacy and information security training; it does not replace your practice’s policies or induction, and it is general education, not legal advice.
Use Mark Complete when you finish a lesson, then return through My Courses.
Official sources
Checked October 2026.
- OAIC: Guide to health privacy
- OAIC: Guide to securing personal information
- OAIC: about the Notifiable Data Breaches scheme
- OAIC quick reference guide: responding to data breaches
- OAIC: data breach notifications in 2025 (media release, 6 July 2026)
- Australian Signals Directorate: Practical cyber security tips for business leaders (PDF)
- Australian Signals Directorate: protecting against business email compromise
- Australian Signals Directorate: recognise and report scams
- Australian Signals Directorate: secure your user account
- RACGP: Information security in general practice
- RACGP: Cyber security in general practice
- RACGP Standards for general practices, 5th edition: patient identification
- Australian Digital Health Agency: My Health Record for healthcare providers
DESK CARD · Privacy and Cyber Safety for the Whole Practice Team · GP Staff Academy · as at October 2026
Patient information
- Heard: call by name only, never with a reason. Sensitive calls away from the counter. Offer a pen: “Would you like to write it down for me?”
- Seen: lock your screen when you step away (Windows key + L; Mac: Control + Command + Q). Paper face down; collect printing at once; clear your desk nightly. Cleaners and contractors: turn stray paper face down and tell the practice manager.
- Sent: check address and attachment, then use the approved sending route. Confirm the patient’s privacy preferences; ask the manager for an accessible alternative if the usual route is unsuitable.
- Looking: “Do I need this for the task in front of me?” No task, no access, even your own record.
Who is asking?
- Identity: they tell you three identifiers, such as name, date of birth, address; never read them out. A Medicare number is not an approved identifier.
- A relative: “I can’t discuss anyone’s care without their permission. She’s welcome to call us, or I can pass a message to the doctor.”
- “Is she a patient?” “I’m not able to confirm or deny whether anyone is a patient here.”
- Insurer, employer, police: “I can take your request and pass it to our practice manager. I can’t confirm or release patient information.”
- Someone in danger: get the GP now.
If something goes wrong
Stop. Tell the practice manager now, in person or by phone. Delete nothing; do not fix it quietly. Note what, who, when. “I think I’ve sent a letter to the wrong address. It went yesterday. I haven’t changed anything.” You report; the practice decides.
Scams, logins and devices
- Click, pay or sign in? Do not click, reply or forward. “We check any link like this. I’ll ring you back on the number we have.” Keep it; tell the practice manager even if you did nothing, and if you clicked or typed your password.
- New bank details: no change or payment until confirmed with the person, face to face or on a number on file.
- Sign-in codes: never share one or approve a prompt you did not start; report unexpected ones now.
- AI: do not paste patient/staff information or distinctive real stories into an unapproved tool; removing a name may not make it anonymous.
- Login: your own only. Passphrase: four or more random words, at least 15 characters, different for each system, never shared, not kept by the computer.
- Devices: no outside USB sticks; no patient information on personal phones. Lost work phone, key or fob: report now, including after hours; use the backup if the manager does not answer.
- Ransom demand or locked files: stop using the device; call the manager/IT now from another phone. Follow the approved containment steps: wired and wireless connections matter. Use IT/local-plan direction if unsure or unable to isolate; do not reconnect, plug in backups or attempt repairs.
Who to tell
Practice manager: ______________ · Backup: ______________ · IT provider: ______________ · After-hours route: ______________
Keep these approved contacts available away from the practice computer. If the manager does not answer, call the backup/IT promptly.
Your practice’s own procedure always comes first.