PRACTICE MANAGER JOURNAL_MAR 26_Final

The Practice Manager M A RC H 20 26

Issue 1

AAPM Member Benefits AAPM’s supports and promotes members’ personal and professional growth through a system of:

CORE PRINCIPLES

QUALIFICATIONS

CERTIFICATION

ADVOCACY

AAPM EDUCARE

AAPM representation on government and industry advisory groups.

Access to AAPM’s Educare program at member rates. Includes a series of webinars and face-to-face event delivery.

HR ADVISORY SERVICE Comprehensive HR support and advice through telephone, email, website resources and templates.

MEMBER ASSISTANCE PROGRAM Confidential assistance to support health and wellbeing of members.

PULSE+IT SUBSCRIPTION Asia Pacific’s eHealth and Health IT digital platform.

MEMBERSHIP BADGE Recognition of AAPM membership.

THE PRACTICE SPACE Dedicated fortnightly eNewsletter providing latest industry updates.

THE PRACTICE MANAGER JOURNAL AAPM’s national journal, delivered electronically to members each quarter.

NATIONAL CONFERENCE Premier annual conference for Practice Management professionals at member rates.

NETWORKING MEETINGS Share knowledge and information.

Connect with, and support your peers.

ONLINE LEARNING MODULES Self-guided learning through Practice Management topics.

SCHOLARSHIPS Expand your skills through AAPM funded scholarships delivered though UNE Partnerships.

PRACTICE MANAGEMENT AWARDS Prestigious national industry awards program that recognises acknowledges Practice Management professionals.

CONTINUAL PROFESSIONAL DEVELOPMENT

CERTIFIED PRACTICE MANAGER (CPM) Cerification membership to recognise experience and skills in the profession of Practice Management.

FELLOWSHIP A prestigious honour in recognition of significant commitment and contribution to the profession of Practice Management.

CORPORATE PARTNERS Exclusive access to resources, savings and benefits from AAPM’s corporate partners.

DEDICATED ONLINE MEMBERS FORUM Dedicated and exclusive member only forum to share ideas, insights, information and support.

AUSDOC SUBSCRIPTION Free subscription to AusDoc. The leading communication platform for Australian Doctors.

WEBSITE ACCESS Access latest news, industry information, and member-only resources.

National President's Message The Enduring Value of the Certified Practice Manager and AAPM Fellowship

Deb Walter National President

Practice Managers are the steady, skilled leaders who ensure that healthcare organisations remain safe, efficient, compliant, and person‑centred. AAPM is committed to supporting effective practice management through professional recognition, continuing education, capability development, and strong professional standards.

Two of the most significant pathways that reflect this commitment are the Certified Practice Manager (CPM) credential and the AAPM Fellowship (FAAPM). These professional recognitions are far more than post‑nominals. They represent dedication, professionalism, and a deep commitment to excellence in healthcare leadership.

Healthcare continues to evolve rapidly, shaped by regulatory change, digital transformation, workforce pressures, and rising expectations from the communities we serve. In this environment, the role of the Practice Manager has never been more critical.

The AAPM Certified Practice Manager credential provides a nationally recognised benchmark of capability. It demonstrates proven competence across the core principles of practice management, a commitment to ongoing professional development, alignment with national standards for quality and governance, and the ability to guide teams and practices through complexity and change. For employers, CPM offers confidence.

For patients and communities, it strengthens trust. For Practice Managers, it is a meaningful milestone that validates expertise and supports career progression.

The AAPM Fellowship represents the highest level of professional recognition within our association. It acknowledges advanced capability, leadership, contribution, and service to the profession. Fellows demonstrate excellence in practice management, contribute to the advancement of the profession, and uphold the values of integrity and collaboration. In a healthcare environment where governance and strategic leadership are essential, FAAPM stands as a respected and meaningful credential that reflects both achievement and influence.

Maintaining professionalism is an ongoing responsibility and a cornerstone of our identity. It is essential that we remain mindful of the AAPM Code of Conduct, uphold the reputation of our profession, and recognise the reputational risks that can arise, particularly online and on social media. As colleagues, we each play a role in elevating the profile of practice management with clinicians, industry stakeholders, and government. The way we conduct ourselves shapes how our profession is perceived and strengthens the trust placed in us as leaders.

As we continue to advocate for the profession, these pathways strengthen capability, support high‑quality care, and build the next generation of healthcare leaders.

Together, we elevate our profession and contribute to a stronger, more sustainable healthcare system.

The Practice Manager

3

From the CEO's Desk

AAPM continues to strengthen its role as the leading professional body for healthcare Practice Management in Australia.

Our mission remains clear: to empower Practice Managers, streamline operational excellence, and foster a community that thrives on collaboration, innovation, and leadership.

Miranda Grace Chief Executive Officer

AAPM will focus on key strategic priorities that will deliver tangible value to our members and the broader healthcare community.

Beyond these initiatives, I want to leave our members with a thought that guides everything we We are rolling out a series of targeted professional development do at AAPM: the success of any healthcare practice is driven not programs designed for Practice only by systems and processes Management team members with but by the people who lead with the skills required to navigate an integrity, vision, and resilience. increasingly complex healthcare I encourage every member to environment. The 2026 Educare embrace opportunities for growth, series will deliver a series of challenge the status quo, and webinars and face-to-face events, featuring industry experts. AAPM is inspire those around them. focusing on providing, high-quality In this spirit, AAPM remains education that enables Practice committed to supporting Management professionals to members. The road ahead is full maintain operational efficiency but of possibilities, and I am confident also anticipate the challenges within that with our collective expertise, their organisations. passion, and dedication, we will continue to achieve excellence, Second, we are expanding our overcome challenges, and set advocacy engagement efforts. new benchmarks for Practice AAPM is committed to ensuring Management across Australia. that the voices of Practice Managers are heard. This work is critical in shaping a healthcare system that values efficiency, sustainability, and patient-centered outcomes.

4

Third, we are enhancing our community engagement initiatives.

AAPM’s strength lies in the power of connection. We have launched our new Member Engagent Groups, which offers our Practice Management community to connect from wherever they are across the country, with like-minded peers, in their particular healthcare cohort.

These groups will assist AAPM in its advocacy endevours and enable further connection between members.

Australian Association of Practice Management

Contents 03 National President's Message Deb Walter

04 From the CEO's Desk Miranda Grace

06 Environmental sustainability in health practice Sophie Piron

10 PayDay Super Stuart Chan Cutcher&Neale

12 Clean data, better care Cubiko

14 Is it time to update your Practice IT? Databox Solutions

18

20 No Suprises: strengthenin informed consent in your Practice Dr Sally Parsons Ms Ruanne Breli Avant

24 Chaperones and observers in medical practices MIGA

42 From vision to vigilance: building a secure digital future for health care Will Sharpe Telstra Health

44 Market update: From recovery to realignment Medical Practice Jobs

26 Cyber risk in 2026: Part 1 Miroslav Doncevic Digital Medical Systems

34 Why disonnected systems cost more than you think Michael Strachan Magentus

40 What the Digital Health?

Paul Piltz Best Practice Software

Attracting new Doctors throught digital presence Heartbeat Digital

The Practice Manager

5

SOPHIE PIRON

Environmental Sustainability in Health Practice _ an introduction Sophie Piron Business Manager

As I write this article, I can only guess what many of you might be thinking. That you have enough to do as a Practice Manager without adding responsibility for environmental sustainability to your list of duties.

It can be argued that the bulk of recommendations made on environmental grounds have significant additional benefits to the practice – be they financial, a streamlining of workload, a reduction of waste generation or a positive impact on workplace culture.

Having spoken to many Practice Managers and also Doctors on this issue over a number of years, many see becoming environmentally active as an add on rather than a fundamental part of what they do. Comments such as: It’s too expensive; Oh, you mean recycling paper; and We don’t need to do anything as we don’t have an impact, are indicative of the types of statements that have been made to me when I discuss environmental sustainability with healthcare providers.

Looking at the bigger picture it is important to consider why we should consider environmental sustainability be a priority for health practices? According to the World Economic Forum’s Global Risks Report 2021, the failure to mitigate and adapt to climate change is “the most impactful” risk facing communities worldwide.

As climate change transforms global ecosystems, it affects everything from the places we live to the water we drink to the air we breathe. And though climate change affects everyone in some way, it’s indisputable that its most negative impacts are borne disproportionately by certain groups: women, children, people of color, Indigenous communities, and the economically marginalized.

Climate is a human rights issue.

(World Economic Forum, The Global Risks Report, 2021).

However, I would argue that you as a Practice Manager are ideally placed to champion environmental sustainability in your organisation.

Every day, you are involved in making decisions which directly impact the purchase, use and disposal of resources. Adding environmental sustainability to the mix when considering the impact of a decision on the practice can only have positive impacts, both for the practice and for the planet. The environmental impact of decisions should be a key consideration in decision making, in much the same way as financial, HR and risk considerations are taken into account in most of the decisions we make as practice managers and in the recommendations we make to our practice owners.

6

Australian Association of Practice Management

It is estimated that the Australian health system makes up 5.44% of Australia’s total greenhouse gas emissions, of these, 59% results from the provision of health care services; 33% from the provision of residential care and social assistance services and 8% from the production of pharmaceutical and medicinal products. (Estimates of Australian Health System

Greenhouse Gas Emissions 202122, Interim Australian Centre for Disease Control, Department of Health and Aged Care, Australian Government).

make it easy for people ○ Waste management as part of orientation ○ Introducing additional recycling stations

My own experience as someone ○ Soft plastics who has prioritized environmental sustainability in our practice for ○ Printer Cartridges (Close the the last 15 years has been that the Loop) more you do, the more you want to ○ Batteries do. I love it when a staff member ○ Pens comes to me and lets me know of a new local government initiative for ○ Blister Packs recycling that we can add to our list ○ e-recycling of recycling practices. It is certainly ○ Compostables my experience that an attitude of ‘every little bit helps’, no matter how ○ Research if frequently used items small, fosters in people a sense of are recyclable – you might be wanting to do more and a culture of surprised positive action and inquisitiveness ○ Learn the difference between about what is possible. recyclable, biodegradable and Initial key areas which health compostable. practices can consider to determine Office Waste: look at ways of where best to put their energies reducing paper use. Encourage include: the use of electronic transfer Use of power and water, these of information for sending and can include big ticket items such as receiving documents. Develop an the installation of solar panels and understanding of the environmental batteries to small ongoing changes impact of cloud storage and how to such as more efficient use of power minimize this. and water. Asking questions such Purchasing Decisions: consider as: the environmental impact of ○ does it need to be turned on? purchasing decisions and look ○ are there any government energy for environmentally sustainable alternatives. This may include: saving schemes which might be available to us

○ do we have the most energy efficient lighting and appliances available – consider those when replacing existing appliances ○ are our water heaters the most efficient available?

Waste Management / Recycling ○ what strategies could we implement to improve our waste management and recycling efforts. These could include: ○ Recycling bins in every room –

○ Purchasing energy-efficient equipment

Advocacy / Education: as you become more engaged in introducing environmental initiatives within your own practice, you will see countless opportunities for engagement and advocacy at a broader level.

Make sure that your share your efforts with your patients; question suppliers; regularly review local government initiatives and lobby and engage with Government when opportunities arise.

My recommendations when looking at developing a sustainability plan for your practice would be to look at each of these areas individually and determine your starting point, where are you now and then to develop some strategies for improved efficiency. If this is new to your practice, start small and build on it.

On a final note I would suggest that whether you are introducing environmental sustainability initiatives into your practice for the first time, or building on an already well established record of action, it is important to embed a positive approach to environmental ‘activism’ into your practice culture.

Here are my top tips for achieving this: ○ Incorporate sustainability into your Business Plan ○ Make a record of your starting point

○ Reducing use of single-use plastics

○ Turn your projects into QI activities

○ Not over ordering (even if it is free)

○ Start small and gather speed

○ Purchasing environmentally friendly products

○ Focus on the things you can control ○ Be optimistic but realistic

○ Sourcing locally produced goods and services

○ Didn’t achieve your objective – identify why?

○ Asking the question – do we really need to buy a new one?

○ Choose a champion(s) ○ Make it easy for people ○ Share your successes The Practice Manager

7

off * 10% M AAP rs be m Me

Super-charge your career

Study a range of courses such as: 11293NAT Diploma of Leadership in Healthcare Practice HLT47715 Cert IV in Medical Practice Assisting HLT47321 Cert IV in Health Administration BSB40520 Cert IV in Leadership and Management And many more ...

Or call 1800 066 128 . *Discount applies to full qualification courses only, is not stackable or transferable and excludes Government subsidised training places.

ABN 74 003 099 125 I RTO 6754

www.unep.edu.au

Payday super is coming.

Is your business ready?

From 1 July 2026, super must be paid at the same time as wages.

Every pay cycle, without delay.

It’s the biggest compliance change in years, and it will impact your cashflow, your payroll systems, and the way you onboard new employees.

The good news? You don’t have to face it alone.

The new rules will create real-world pressures. We’re here to help you navigate them: Payroll systems and processes

Compliance support

Streamline your payroll, automate super

Stay on top of the new rules with expert

payments and eliminate errors so you meet

guidance that helps you meet every obligation

every deadline with confidence.

and protect your business.

Budgeting and cashflow forecasting

Practical strategies

Understand the impact of more frequent super

Learn what to prioritise and refine your

payments and keep your cashflow stable with

onboarding and payroll processes to save time,

clear forecasting.

money and stress.

Be prepared. Be compliant. Be ahead of the change.

Contact us today to claim your complimentary consultation, exclusive to AAPM members.

SYDNEY | MELBOURNE | BRISBANE | NEWCASTLE

1800 988 522 | medical@cutcher.com.au | cutcher.com.au

CUTCHER & NEALE

Payday Super: What it means for employers and employees Big changes are on the way for superannuation in Australia.

From 1 July 2026, employers will be required to pay their employees’ superannuation at the same time as their wages.

This “Payday Super” regime aims to improve transparency, increase retirement savings, and crack down on unpaid super. Here’s what you need to know.

Stuart Chan Partner, Cutcher & Neale Specialist Medical Services

What Is Payday Super?

Currently, employers only need to pay superannuation contributions quarterly. This system has led to delays and, in some cases, unpaid super slipping under the radar.

Payday Super changes all that. From 1 July 2026, super contributions will align with payday – this means employers must pay super into employees’ accounts on payday, and it must be received by the super fund within seven days of each pay run.

Why the Change?

This move is about making sure employees get what they’re entitled to when they’re entitled to it.

By matching super contributions with wages, employees can see their retirement savings growing in real-time. It’s also going to make it harder for non-compliant employers to dodge their obligations.

10

Australian Association of Practice Management

What Employers Need to Know Here’s a quick breakdown of what’s coming and how it might impact you as an employer: Super Deadlines: Super must be paid to an employee’s fund on payday and received by the fund within seven business days. Missing this deadline could result in penalties.

New Super Guarantee (SG) Charge: If you miss payments, the updated SG Charge will kick in.

This includes: Outstanding Shortfall: Any unpaid super.

Notional Earnings: Interest calculated daily to compensate employees.

Administrative Uplift: An extra charge of up to 60% to reflect enforcement costs.

Leave Entitlements: Annual leave and long-service leave often count towards an employee’s Ordinary Time Earnings (OTE), which directly affects their super contributions. If leave balances and payments aren’t tracked properly, it could lead to underpayments or missed deadlines – both of which can be costly.

Onboarding New Employees: Employers will need super fund details from new starters as a priority so contributions can be processed quickly after their first pay run. Missing or delayed information can quickly lead to late payments and penalties.

Cashflow Impact: Shifting to Payday Super will change the rhythm of cashflow. For businesses with tight margins or significant payroll costs, this means keeping a closer eye on cashflow forecasts and ensuring there’s always enough liquidity to meet obligations on time.

Changes to Payroll and Reporting The introduction of Payday Super means adjustments to payroll systems and processes: Single Touch Payroll (STP): Employers will need to report both OTE and total super liabilities for each employee.

Clearing House: The current Small Business Superannuation Clearing House will be retired, the ATO will assist with this transition.

Error Resolution: Expect stricter standards and quicker turnarounds to fix payment errors, thanks to updated SuperStream rules.

Getting Ready for Payday Super The 1 July 2026 start date might feel like a long way off, but employers should start preparing now:

superannuation obligations.

The Importance of a Good Payroll System A solid payroll system is going to be your best friend as businesses change to Payday Super. With super payments happening more often and reporting requirements getting stricter, there’s no room for mistakes.

A great payroll system can handle the heavy lifting – automating super contributions, syncing with Single Touch Payroll (STP), and catching any issues before they turn into big problems. It’s not just about ticking compliance boxes; it’s about saving time, reducing stress, and keeping both you and your employees happy. Early preparation will help avoid unnecessary compliance issues, reduce the risk of underpayments and give you time to iron out any kinks well before 1 July 2026.

Contact our award-winning team today and make sure you’re prepared for the upcoming changes with our expert advice.

Review Payroll Systems: Make sure they can handle real-time super payments and updated reporting requirements.

Train Your Team: Finance and payroll staff need to understand the new rules and their implications.

Communicate: Keep employees informed about what Payday Super means for them.

Contact our Xero Experts: You should plan ahead and implement new payroll software or upgrade your subscription (if required) from 1 July 2025, to ensure you are comfortable using the software before the deadline and know how to efficiently process your

The Practice Manager

11

CUBIKO

Clean data, better care: how data hygie drives quality improvement in general practice

Every general practice in Australia has a practice management system, often holding decades of patient information. But how much of that data is actually complete, up to date, and genuinely useful?

In our experience working with practices across the country, the answer is often less than you'd expect. And the consequences aren't just administrative. Gaps in patient records directly impact the quality and continuity of care your team delivers every day.

The link between data and patient outcomes When a patient's record is missing key demographic or clinical information, clinicians are making decisions without the full picture.

Information such as ethnicity, preferred language, smoking status, family history, or chronic condition indicators all inform clinical decision-making. Without them, care becomes reactive rather than proactive.

hundreds of patients. Across a practice cohort, incomplete data creates systemic gaps in care that are invisible until someone goes looking.

What data hygiene looks like in practice Data hygiene doesn't mean perfection. It means having a systematic approach to keeping patient records accurate, complete, and up to date.

For practice managers, this starts with understanding where the biggest gaps are. Which demographic fields have the lowest completion rates? Which patient cohorts are most affected? What's the practice's ethnicity recording rate compared to the RACGP standard?

Under the RACGP Standards for General Practices (5th edition), criterion QI 2.1 requires that at least 75% of active patient health records contain a current health summary.

This summary should capture key details such as ethnicity and cultural background. The draft 6th edition goes further, proposing that demographic records also include assigned sex at birth, gender, and pronouns.

and relatively straightforward.

It's why ethnicity recording is the featured activity in Cubiko's quality improvement calendar for February, giving practices a timely prompt to focus on this area.

When clinicians know a patient's cultural background, they can better tailor screening, communication, and referral pathways accordingly.

Some populations have a higher prevalence of specific conditions including cardiovascular disease, type 2 diabetes, thalassaemia, and particular cancers. Having ethnicity recorded allows clinicians to apply evidence-based screening frameworks, rather than relying on generic guidelines that may overlook the varying needs of different ethnic backgrounds.

It also supports culturally safe care.

When a practice understands the cultural

makeup of its patient population, it can invest in interpreter services, develop culturally appropriate resources, and create an environment where patients feel recognised and understood.

The RACGP Standards are clear Consider a patient with an on this point: understanding unrecorded chronic condition. the demographics and cultural Without that flag in the system, backgrounds of your patients helps they may not appear on the you provide the most appropriate These aren't arbitrary requirements. practice's chronic disease register. care.

They exist because better data and That means they're not being deeper context with patients leads For Aboriginal and Torres Strait recalled for regular care plan to better care.

Islander patients, accurate reviews, health assessments, or identification is especially preventive screening. They're not Ethnicity recording: a quality important. It opens access falling through the cracks because improvement initiative worth to targeted health programs, of a clinical oversight. They're falling prioritising including the annual health check through because the data wasn't Of all the data hygiene (MBS item 715), one of the most there in the first place. improvements a practice can make, comprehensive preventive health Now multiply that by dozens or ethnicity recording is both impactful tools available. Many eligible

12

Australian Association of Practice Management

patients are missing out simply because their Indigenous status hasn't been recorded. This represents a lost opportunity for early detection and timely intervention.

removes the hesitation and makes these conversations feel more comfortable for everyone involved.

A sensible starting point is to audit current completion rates and set realistic goals, you may consider focusing on one demographic item at a time, and cycle through new goals in a regular routine, so patients and reception staff do not get fatigued. Improving ethnicity recording takes time, and a PDSA (Plan-Do-Study-Act) cycle provides clear structure and accountability without overwhelming the team.

Reception teams are best placed to capture and verify demographic data, during check-in, new patient registration and at billing postconsult. Equipping front desk staff with simple, respectful scripts

follow naturally when the clinical foundations are in place. These outcomes matter, but they're a byproduct of good care, rather than the primary driver.

Tracking progress matters too.

When practices can see their ethnicity recording rate improving Reliable ethnicity data also month by month, the initiative strengthens a practice's relationship gains momentum. As the team with its broader community. starts to see the flow-on effects, Primary Health Networks use patients being identified for health demographic data to plan services, assessments they would otherwise allocate resources and design have missed, chronic condition targeted health programs. Practices cohorts being managed more with reliable ethnicity data are proactively, population health better positioned to advocate insights becoming clearer, data for their patient population and hygiene stops feeling like a chore participate in funded initiatives and starts feeling like a genuine that directly benefit the people contribution to patient care. they serve. And it's worth noting: The bigger picture the conversation itself is a positive one. When reception and clinical Data hygiene is ultimately about staff frame the question as "we ask creating the conditions for better everyone this so we can make sure care. Accurate and complete you're receiving the best possible patient records help clinicians to care," patients generally respond individualise care, enable practices well. It signals that the practice sees to identify and address health gaps them as individuals. across their population, and support the quality improvement activities Making it practical that underpin accreditation.

Quality improvement works best The financial benefits, including when it's becomes part of everyday appropriate billing for health workflows rather than an extra task assessments, care plan items, layered on top. and incentive payments, tend to

For practice managers, data hygiene is one of the most tangible levers you have to improve patient outcomes at scale. It doesn't require new technology or additional staff.

It requires attention, consistency, and a commitment to getting the basics right.

The Practice Manager

13

DATABOX SOLUTIONS

Is it time to upgrade your Practice IT? Key signs your healthcare techonology may be holding you back

In today’s healthcare environment, technology is no longer just a back-office function, it underpins nearly every aspect of patient care, compliance, and business operations. From appointment scheduling and clinical software to telehealth, cloud systems, and cyber security, your IT environment directly impacts how smoothly your practice runs each day.

Yet many practices continue operating on ageing systems that were implemented years ago, often with little review since. While these systems may still “work,” they may also be quietly increasing risk, creating inefficiencies, and limiting growth.

○ Poorly optimised networks The result? Lost productivity, frustrated staff, longer patient wait times, and increased reliance on workarounds.

Modern IT environments are designed for speed, reliability, and scalability. Upgrading infrastructure and optimising systems can significantly reduce disruptions and improve the day-to-day experience for your team.

2. Increasing Cyber Security Concerns Healthcare remains one of the most targeted industries for cybercrime.

Patient data is highly valuable, and even a single breach can result in: ○ Regulatory penalties

allows these protections to be built in by design.

3. Backups Are Unclear, Untested, or Inconsistent Many practices assume backups are running, but are they verified, monitored, and regularly tested?

Common risks include: ○ Backups stored on-site only ○ No offsite or cloud replication ○ No documented recovery process ○ No regular restore testing In the event of ransomware, hardware failure, or accidental deletion, unreliable backups can lead to prolonged downtime or permanent data loss.

○ Reputational damage

An upgraded IT environment should include:

So how do you know when it’s time to consider an IT upgrade?

○ Operational downtime

○ Automated, monitored backups

Below are some of the most common signs your practice’s technology may be ready for change, and how a proactive approach to IT can support better outcomes for your team and your patients.

○ Loss of patient trust Warning signs that your cyber security may be falling behind include:

○ Encrypted offsite or cloud storage

○ No multi-factor authentication (MFA) ○ Infrequent patching or updates

○ Regular test restores ○ Clearly documented disaster recovery plans This ensures business continuity and peace of mind.

1. Frequent Slowdowns, Crashes, or Freezing Systems

○ Limited visibility over threats ○ No centralised monitoring

If staff regularly experience slow logins, frozen applications, or system crashes, it’s more than just an inconvenience.

4. Your Practice Has Outgrown Its Current Setup

If your practice relies primarily on basic antivirus alone, this may no longer be sufficient.

Growth is a positive sign, but it often exposes IT limitations.

These issues often indicate: ○ Ageing servers or workstations ○ Outdated operating systems ○ Insufficient hardware resources

14

A modern cyber security approach includes layered protection, continuous monitoring, managed detection and response (MDR), regular vulnerability assessments, and staff cyber awareness training.

Upgrading your IT environment

Australian Association of Practice Management

Examples include: ○ Adding new clinicians or locations ○ Implementing telehealth services ○ Increasing reliance on cloudbased systems

○ Introducing new clinical or practice management software

your environment, rather than waiting for issues to arise.

Older infrastructure may struggle to support additional workloads, leading to bottlenecks and instability.

7. Compliance Requirements Are Becoming Harder to Meet

Modern IT environments are designed to scale easily, allowing practices to grow without constant “patch-up” fixes.

Healthcare compliance obligations continue to evolve. Practices must consider: ○ Data protection and privacy ○ Cyber security frameworks

5. Staff Are Creating Workarounds

○ Industry standards and best practices

When systems don’t work well, staff naturally find ways around them:

○ Vendor and software compliance

○ Using personal email or cloud storage ○ Writing down passwords ○ Sharing logins ○ Avoiding certain systems altogether While understandable, these behaviours increase security risk and reduce efficiency.

Upgrading IT systems can simplify workflows, improve usability, and reduce the need for risky workarounds.

6. You’re Unsure Who Is Responsible for Your IT Many practices operate with a mix of internal knowledge, ad-hoc contractors, and vendor support.

Over time, this can create gaps in accountability.

Without proper systems, policies, and monitoring in place, compliance becomes increasingly difficult.

Upgrading IT allows compliance to be built into everyday operations rather than treated as an afterthought.

○ Advanced cyber security protection ○ Reliable backups and disaster recovery ○ Optimised networks and infrastructure ○ Ongoing support and strategic guidance

A modern IT model provides a dedicated team that proactively manages, monitors, and supports

To arrange a complimentary IT health check, visit https:// databoxsolutions.com.au or contact our team on 1300 603 505.

○ Proactive monitoring and maintenance

○ No clear point of contact

○ Reactive rather than proactive support

This structured review provides a clear snapshot of your current IT environment, identifies risks and improvement opportunities, and offers practical recommendations to support security, compliance, and performance.

An IT upgrade is not just about replacing computers. It’s about implementing a modern, secure, and well-managed environment that includes:

○ Cloud and remote work readiness

○ Unclear documentation

If you’re unsure whether your practice’s IT environment is still fit for purpose, Databox Solutions offers a complimentary IT health check for AAPM members.

8. What an IT Upgrade Really Means Today

Signs of this include: ○ Slow response times

A Practical First Step

For Practice Managers, this translates to fewer emergencies, better budgeting, improved staff satisfaction, and stronger risk management.

The Practice Manager

15

Flu Season is coming...

With flu season fast approaching, our annual 'Flu Clinic Kit' is almost here.

Be the first to receive it!

Each Flu Kit Includes: PMS set-up guides (for BP, MD & ZM) Checklist of considerations HotDoc Product Guide Patient communication templates (SMS & email) HotDoc’s Flu Set Up Masterclass Flu Vaccine Clincial Update 2026 Webinar

Scan the QR code to secure your copy of our Flu Kit

Avant for practices

PracticeHub Quality, compliance, staff readiness and peace of mind – simply and seamlessly in one digital platform.

Designed for GPs, specialists and other healthcare practices.

From only $1,188 per year, get started with PracticeHub today to: 9 9 9 9

Streamline compliance Simplify risk management Reduce admin Access RACGP accreditation support.

Join practices across the country already saving time and staying ahead of regulatory obligations with PracticeHub.

Start your 15-day free trial* today or visit our website for details.

Avant for practices

Speak with our team to learn more 1800 010 236 | practicesolutions@avant.org.au *T&Cs apply. See website for details.

The information in this publication does not constitute legal, financial or other professional advice and should not be relied upon as such. It is intended only to provide a summary and general overview on matters of interest and it is not intended to be comprehensive. Persons implementing any recommendations contained in this publication must exercise their own independent skill or judgment and seek appropriate professional advice relevant to their own particular circumstances. Compliance with any recommendations will not in any way guarantee discharge of the duty of care owed to patients and others coming into contact with the health professional or practice. Avant Practice Solutions and its related entities are not responsible to any person for any loss suffered in connection with the use of this information. Information is only current at the date initially published. © Avant Mutual Group Limited 2026.

HEARTBEAT DIGITAL

Attracting new Doctors through digital presence ○ Your online presence can shape how potential doctors see it. ○ Simple tweaks can make a big difference. ○ Outdated or patient-only messaging can repel talent. ○ Every channel matters in attracting the right doctors.

Trying to attract new GPs is something most practices are familiar with, especially the newer ones out there.

In fact, such requests have been a growing theme here at HeartBeat Digital.

“Recruiting new doctors has become a much more common need, even a major campaign focus in some instances,” says HeartBeat Digital Owner & Founder, Lachlan McPherson.

Consider this: LinkedIn/Talentegy data shows around 71% of candidates research a company before applying.

services, but say little about the working environment, which can leave questions unanswered for anyone viewing the practice as a potential workplace.

Fix: Add light signals about how the practice operates. A short note on team structure, support staff, or clinical collaboration is often enough.

“Dedicated pages to nursing staff and even consultation room images and descriptions of equipment are good examples,” explains HeartBeat Digital’s Mick Carney.

“I think that this messaging can really resonate with both patients and potential doctors, it’s a ‘twobirds’ fix".

Repeller 2: Outdated content Old imagery, broken links, or generic bios introduce uncertainty.

They can suggest the practice is not keeping pace.

Fix: Update imagery and team information so the site reflects how the practice runs today.

Repeller 3: No sense of what it is like to work there

The behaviour is not unique to When people and the work healthcare, but the stakes often are. environment are invisible, it is In a climate where many Australian harder to imagine belonging. practices struggle to attract Fix: Use real photography or brief doctors, understanding the content that shows everyday subtleties of digital perception can practice life. Social media and really make a difference. website blogs can often prop this up.

In brief: Common repellers and “A simple news section can do the how to fix them trick,” says Mick.

Repeller 1: A digital presence that “Remember, you can share these speaks only to patients posts on social media and via eDM Practice websites often explain emails, which link back to your

18

Australian Association of Practice Management

website”.

Repeller 4: Stagnation An inactive website or social feed can suggest stagnation, even when a practice is actively evolving.

Fix: Simple, semi-regular updates are often enough. A new team member, service change, or community moment signals momentum.

“The most recent post containing COVID updates from 2020 isn’t a good look,” adds Mick.

Channel-specific tweaks that help Websites This isn't really about recruiting doctors, but it does showcase how the practice operates.

Navigation, language, and structure can answer questions like: Is this organised? Is this current? Does this reflect how the practice actually runs? And, importantly, does it look good?

Simple changes, such as clearer team pages, updated imagery, or a short explanation of how clinicians work within the practice, help reduce that uncertainty.

Landing pages A dedicated landing page for prospective doctors can also be powerful. Not a job ad, but a clear, well-structured page that outlines how the practice operates, what support looks like day-to-day.

Even the lifestyle benefits of the local area can answer questions before they’re asked, and act as a sweetener.

Social media Social media tends to reveal what a practice values, even unintentionally. Long gaps between posts, overly promotional content, or stock imagery can flatten perception.

Consistency and authenticity are big pillars of a practice that shows moments of real activity, whether that is welcoming a new team member or sharing a behind-thescenes update.

HeartBeat Digital Social Media Manager, Benedicta Genoveva, has seen it all before.

“When practices post intentionally, not “just coz”, it changes the tone completely. It signals that the practice is present and paying attention”.

Search visibility and discoverability We’re talking about when people look up a practice name, location, or general role-related information.

Inconsistent details, outdated pages, or missing information introduce friction.

Search visibility can provide accurate, current information that is easy to find when someone goes looking.

“If a practice is hard to understand online, people assume it’ll be hard to understand offline and leave the website” Mick notes.

“That assumption may be unfair, but it happens. This relates to bounce rates, when someone comes to a website and leaves quickly without engaging”.

even when they are not clicked.

EDM emails reveal how a practice communicates over time.

Mick sees this as a consistency issue rather than a marketing one.

“When the messaging across channels lines up, it creates trust.

When it doesn’t, people hesitate, even if they can’t explain why”.

“Sometimes, a single digital presence can look like several different businesses, you don't want that”.

Recruitment decisions can often be shaped by a collection of small signals that either build confidence or introduce doubt.

Lachlan McPherson frames it simply: “Most practices already have what doctors are looking for.

The challenge is that their digital presence doesn’t always reflect it.

“As such, who knows what it’s like to actually support healthcare there?”

FAQs answered by the HeartBeat Digital team Q1: With regard to attracting new doctors, what’s the first thing practices should do to their digital presence?

A: Look at it in your own time. On a day off, when you’re not amongst it, look at your website and socials on your phone. Does it look great?

Does it make you feel like you love working there?

If not, imagine it from an outside perspective, someone who doesn't know the ins and outs.

Q2: If we overhaul our online presence, how long will it take to attract new doctors?

A: This is one of those “it depends” answers. External factors like location make a difference, but put it this way; if potential new staff research you and the practice down the street, there’s more reasons to choose you if your online presence has greater impact.

Of course, most practices need With a few adjustments and a bit of a patient-first (not patient-only) curation, your digital presence can approach. communicate reassurance, stability, Q3: And, is overhauling it and momentum instead. expensive?

Considering the amount of work that can be involved, we don't believe so. Using analysis, experience and your goals means a customised, targeted approach. We would never recommend a hammer to tighten screws.

Data, ads, and email touchpoints These tend to sit in the background, but they reinforce patterns. Data highlights which content people return to. Ads shape perception

The Practice Manager

19

AVANT

No suprises: strengthening informed financial consent in your practice Six practical steps to get informed financial consent right Obtaining informed financial consent to treatment

Dr Sally Parsons GP and Medical Advisor, Avant BMBS DCH FRACGP

Ms Ruanne Breli Senior Legal Advisor, Avant BA, LLB (Hons)

Informed financial consent is often treated as an administrative formality. In reality, it’s one of the most common sources of patient frustration and one of the easiest ways for practices to find themselves on the back foot when a complaint arises.

Patients don’t just consent to treatment, they consent to the cost of treatment. When fees, rebates or out-of-pocket expenses come as a surprise, dissatisfaction can escalate quickly, even when the clinical care itself was appropriate.

Doctors have a professional obligation under the Medical Board’s Good medical practice: a code of conduct for doctors in Australia to obtain informed financial consent (IFC). In practice, it’s appropriate these conversations are led and supported by staff. It makes clear systems, consistent messaging and good documentation essential.

Tribunals have consistently maintained that doctors are entitled to set their own private fees. The issue is not necessarily what you charge, it’s whether the patient was provided with enough information to make an informed decision before costs were incurred.

Strong IFC processes protect patients, staff and the practice.

The following six steps will help reduce disputes, complaints and unnecessary stress.

20

Australian Association of Practice Management

1. Start the conversation early Patients should be informed about likely costs before they’re incurred – for example, before they arrive for their appointment, not when they are standing at reception or after treatment has already started.

Early disclosure gives patients time to consider their options, ask questions or make alternative arrangements. It also reduces pressure on staff who are otherwise left managing difficult fee conversations in the moment.

Practical steps include: ○ publishing billing policies and consultation fees on your website ○ including fee information in online and telephone booking processes ○ clearly displaying bulk-billing policies and standard fees in waiting areas When patients know what to expect, cost discussions are easier and less confrontational.

2. Help patients plan for the full cost of care Informed financial consent isn’t limited to your consultation fee. For many patients, the real cost lies in what follows, such as referrals, investigations, procedures and medications.

While referring doctors aren’t expected to know exactly what another provider will charge, they should help patients understand the types of costs they may encounter and where to find that information.

This might include: specialist consultation fees hospital or theatre charges pathology and imaging costs medication costs, particularlywhere PBS subsidies don’t apply For specialist practices, sharing fee information with referring practices or publishing it online, can help everyone align expectations early.

3. Match the financial consent process to the complexity of costs Not every situation requires the same level of financial disclosure.

The IFC process should be proportionate to the complexity and significance of the costs involved.

A single, fixed-fee consultation may only require verbal consent at the time of booking. By contrast, procedures involving multiple providers, staged treatment, or variable out-of-pocket costs will usually require more detailed explanation and written confirmation.

Make sure patients are informed about: ○ longer or complex appointment fees ○ telehealth charges ○ after-hours or call-out fees ○ fees that apply even if treatment does not proceed If fees or arrangements change, update the patient as soon as possible.

5. Use the right format for the situation Patients are often absorbing a large amount of clinical information.

Financial details can easily be missed or forgotten.

Written information, including item numbers, allows patients to check rebates with their insurer and consider costs in their own time.

This is particularly important for procedures and ongoing treatment.

For simpler interactions, verbal disclosure may be appropriate, but written confirmation provides clarity and reduces Importantly, cost complexity doesn’t misunderstandings. Many practices always mirror clinical complexity. now use electronic consent A seemingly straightforward at the time of booking, which investigation, such as an endoscopy, can be a good opportunity to may involve multiple providers, remind patients of the cost of the separate bills and unanticipated appointment. out-of-pocket expenses.

6. Document consent properly 4. Be consistent and update Good documentation is your safety patients when things change net.

Inconsistent information creates confusion and undermines trust.

Practices should have clear, documented billing policies that all staff understand and apply consistently. If only some doctors bulk-bill, or different fees apply depending on appointment length or time of day, patients need to know this upfront.

How consent is documented should reflect the complexity of the costs involved: ○ verbal consent for a consultation fee can be noted in the clinical record

○ brochures or fee schedules should be documented as having been provided, including the version used ○ significant or complex costs should be documented in writing and acknowledged by the patient (for example, via a read receipt, a signature or other written confirmation).

Clear records make it much easier to respond to billing disputes, complaints or regulatory scrutiny.

7. Why IFC matters for your practice and patients A robust approach to financial consent supports respect for patient autonomy and professional integrity. It enables patients to make informed choices about whether to proceed, seek alternatives or plan financially for their care. It recognises that for many, financial considerations are as significant as clinical ones.

While even the best IFC process cannot prevent every complaint, patients are far more likely to challenge a bill, or escalate concerns, when costs come as a surprise, particularly if they are already unhappy about an aspect of their care.

Clear communication, consistent processes and thorough documentation help build trust, reduce disputes, support staff, and protect the practice’s reputation.

Ultimately informed financial consent isn’t just a compliance requirement; it is a commitment to transparency, trust and the prevention of avoidable conflict.

○ electronic consent during booking provides a timestamped record

The Practice Manager

21

References and further reading Avant factshet Informed financial consent Avant case study Doctor found guilty of unprofessional conduct for overservicing and not gaining financial consent Avant factsheet Managing difficult interactions with patients

22

Australian Association of Practice Management

Avant for practices

Protection for your practice if a privacy breach or cyber incident occurs These unwelcome events can be stressful and costly, for you and your practice.

Priority Paediatrics, SA

Avant Practice Medical Indemnity Insurance with Cyber Insurance With Avant Practice Insurance, you’re covered for the actions of staff and claims made against the practice.

And for eligible practices, we include Cyber Insurance to help protect your practice against cyber extortion, privacy liabilities and damage to digital assets.

Protection for your practice and staff avant.org.au/practiceinsurance 1800 128 268 Professional indemnity insurance products are issued by Avant Insurance Limited (ACN 003 707 471, AFSL 238765) (AIL). Please read the relevant Product Disclosure Statement or policy wording (available at www.avant.org.au) before deciding whether to acquire, or continue to hold the product. Practices need to consider other forms of insurance including directors’ and officers’ liability, public and products liability, property and business interruption insurance, and workers compensation. Avant Cyber Insurance cover is available to eligible Avant Practice Medical Indemnity Policy holders up to the cessation of their policy and is provided under a Group Policy between Liberty Mutual Insurance Company (ACN 086 083 605) and AIL. 02/26 (MIM-1835)

MIGA

Chaperones and observers in medical practices: and old fashioned word with modern importance The word chaperone often sounds like it belongs in a period drama, perhaps uttered by someone wearing gloves and carrying a lace fan. But many people are surprised to learn it still has a place in modern healthcare, and is far from a quaint or outdated concept. Instead, it remains a practical safeguard that protects patients, clinicians, and the practice itself.

Why chaperones still matter today Intimate examinations can be uncomfortable for patients and stressful for clinicians, and even when everything is done correctly, misunderstandings can arise about what was said or why a particular step was necessary.

A chaperone provides an extra layer of reassurance. A chaperone is a trained staff member who supports the patient, observes the interaction, and can offer an independent account if concerns arise later.

A common misconception is that chaperones are only relevant when a male doctor examines a female patient. In reality, medicolegal risk can arise in any consultation, regardless of the age or gender of those involved, which is why a chaperone should be offered irrespective of who the clinician or patient is. This approach protects everyone and avoids assumptions that can unintentionally create blind spots.

24

For practices, chaperones are not simply a courtesy. They are a key part of a strong risk management culture, and when used well, they help prevent complaints, reduce uncertainty, and reinforce trust between patientsUnderstanding the medicolegal landscape The medicolegal risks associated with intimate examinations are significant. Allegations in this area are among the most serious a practice can face, and even when a claim is unfounded, the emotional and administrative burden can be substantial.

Australian standards and guidelines highlight the importance of clear communication, informed consent, and professional boundaries. The Medical Board of Australia’s Good Medical Practice: A Code of Conduct for Doctors in Australia sets expectations for respectful and transparent care.

The Australian Commission on Safety and Quality in Health Care standards emphasise patient rights, communication, and clinical governance. State and territory privacy and health records laws also apply, particularly when documenting whether a chaperone was offered, accepted, or declined.

These standards do not require a chaperone for every intimate examination. However, they do require practices to have systems that support safe and respectful care. Offering a chaperone when appropriate and recording the patient’s decision is a simple but powerful way to meet these expectations.

Australian Association of Practice Management

Putting chaperone policies into practice Practice Managers are the architects of reliable chaperone systems. Effective policies usually include clear guidance on when chaperones should be offered, who can act as one and how the process should be explained to patients. Staff training is essential so everyone understands their role, and documentation should be consistent and easy to follow.

Patients should be reminded that they can request a chaperone at any time. A chaperone should always be a trained member of the practice team. Family members or friends may provide comfort, but they do not fulfil the formal role of an observer. Before the examination begins, both the patient and the clinician should understand the chaperone’s purpose and presence.

Information in this article does not constitute legal or professional advice.

Please call Miga if you need advice on any of the issues covered in this article.

1800 777 156 miga.com.au

Get 12 months cover, for the price of 9.

AAPM members receive an extra 10% off

As a specialist insurer, we understand your business and the issues you face in providing healthcare services.

Comprehensive and high-quality cover

24/7 Legal and claims assistance

Education and upskilling for admin teams

This Offer is only available to companies that first insure with Miga under its Practice Indemnity Insurance and Healthcare Entity Indemnity Insurance policies where cover with Miga commences on or after 1 May 2025 and on or before 30 June 2026. This Offer is not available to current policyholders of Professional Indemnity Insurance for Healthcare Companies with Miga, entities whose annual turnover is greater than $10,000,000, entities that do not meet the underwriting criteria or where the limit of cover required is less than $5,000,000 or the annual premium before discount is less than $1,200. The Offer only applies to the first 12 months of cover after which the premium will revert to Miga’s standard annual pricing. This Offer is not available in conjunction with any other offer. Miga reserves the right to withdraw or amend the Offer at any time, other than in relation to policies which have already commenced or written quotations have not expired. Full Ts25 & Cs at Thethat Practice Manager miga.com.au/practices-12for9-tc. Insurance policies available through Miga are underwritten by Medical Insurance Australia Pty Ltd (AFSL 255906). The terms and conditions of the insurance provided by Medical Insurance Australia Pty Ltd are fully contained in the Policy Wording and any applicable endorsements. This document does not form part of the Policy Wording. Acceptance and pricing is subject to Miga’s usual underwriting guidelines including satisfactory claims and practice history. © Miga November 2025

DIGITAL MEDICAL SYSTEMS

Cyber Risk in 2026: Part 1: Be Prepared Miroslav Doncevic Managing Director Digital Medical Systems

The cyber security risk landscape has shifted decisively during 2025, and in 2026, for all Australian organisations that capture, hold and process Personally Identifiable Information (PII), and Protected Health Information (PHI), which of course includes Australian healthcare providers, which are Australian Privacy Principles (APP) entities under the Commonwealth Privacy Act 1988. 1 The decisive shift that has occurred is that Australian regulators, the Australian Securities and Investments Commission (ASIC), and the Australian Information Commissioner (AIC), in particular, are enforcing laws that perhaps have previously been perceived, incorrectly, as “guidelines” or to put it another way, moving from cyber security “best practices” to enforceable legal requirements and obligations with substantial penalties being sought and have been imposed by the Federal Court for cyber security failures.

The Australian Security and Investments Commission (ASIC) is the regulator for corporations, markets, financial services and consumer credit, under the Commonwealth Corporations Act 2001. 2 The Australian Information Commissioner (AIC) is the regulator for the Commonwealth Privacy Act 1988, 3, which includes “13 legally binding Australian Privacy Principles (APPs). The APPs apply

26

Australian Association of Practice Management

to organisations and government agencies covered by the Privacy Act (APP entities).” 4 To fully understand the legal implications regarding adequate cyber security and risk management measures, it is worth reviewing in some detail the summaries of three recent Federal Court judgements for cyber security failures from May 2022 through to February 2026.

These three cases highlight the decisive shift to the enforcement of laws and regulations regarding cyber security obligations, with the Federal Court increasingly imposing significant penalties for failing to protect clients and patients Personally Identifiable Information and Protected Health Information, by not taking “adequate cyber security measures” and for failing to take “reasonable steps” as defined in the Australian Privacy Principles.

2022 RI Advice Group Pty Ltd (RI Advice) was an Australian Financial Services (AFS) licensed advisory firm previously owned

by ANZ until it was sold to IOOF on 1 October 2018. RI Advice operated via Authorised Representatives (AR network) to provide financial advice services to retail customers, numbering up to 60,000 at times, and held confidential and sensitive personal and financial information about their clients.

Nine cybersecurity incidents occurred at AR practices between June 2014 and May 2020.

In ASIC vs RI Advice Group Pty

Ltd (RI Advice), in orders made

by Federal Court Justice Rofe on 5 May 2022, the Court declared that 5: “RI Advice contravened ss 912A(1)(a) and (h) of the Corporations Act from 15 May 2018 to 5 August 2021 as a result of its failure to have documentation and controls in respect of cybersecurity and cyber resilience in place that were adequate to manage risk in respect of cybersecurity and cyber resilience across its AR network, and as a result of this conduct, it: (a) failed to do all things necessary to ensure the financial services covered by the Licence were provided efficiently and fairly, in contravention of s 912A(1)(a) of the Corporations Act; and (b) failed to have adequate risk management systems, in contravention of s 912A(1)(h) of the Corporations Act. “ (Note - Bold emphasis added) The Court ordered that RI Advice must engage a cyber security expert (Security in Depth): ○ “…to identify what, if any, further documentation and controls in respect of cybersecurity and cyber resilience are necessary for RI Advice to implement to adequately manage risk in respect of cybersecurity and cyber resilience across its AR network (Further Measures)” ○ “…agree upon the earliest reasonably practicable date by which RI Advice will implement the Further Measures (Agreed Date) ○ “Within 30 days … RI Advice must provide ASIC with a

written report from Security in Depth, reporting as to whether Further Measures are required to be implemented, and if so, what the Further Measures are and the Agreed Date.” ○ “RI Advice must commence implementing the Further Measures by no later than 90 days from the engagement referred to in paragraph 3(a) and complete implementation by the Agreed Date ○ “RI Advice must provide ASIC with a written report from Security in Depth, within 30 days after the Agreed Date reporting on the outcome of the implementation of the Further Measures, including whether, and to what extent, the Further Measures have been fully and appropriately implemented.” ○ “The engagement of Security in Depth referred to in paragraph 3(a) is to commence by no later than 1 month from the date of these Orders…” ○ “The costs of Security in Depth and the implementation of any Further Measures are to be paid by RI Advice.” ○ The Court ordered RI Advice to pay ASIC legal costs totalling $750,000.

Note that no pecuniary penalty was imposed in this case.

In a Media Release on 5 May 2022, ASIC Deputy Chair Sarah Court said: “These cyber-attacks were significant events that allowed third parties to gain unauthorised access to sensitive personal information.

It is imperative for all entities, including licensees, to have

adequate cybersecurity systems in place to protect against unauthorised access.

‘ASIC strongly encourages all entities to follow the advice of the Australian Cyber Security Centre and adopt an enhanced cybersecurity position to improve cyber resilience in light of the heightened cyber-threat environment.” 6

2025 Australian Clinical Labs Limited (ACL) is a listed public company and is a “leading provider of pathology services in Australia…”.

7 ACL acquired Medlab Pathology Limited on 19 December 2021.

Medlab experienced a cyber attack and ransomware demand on 25 February 2022 by Quantum Group, resulting in “…86 gigabytes of data, including the personal and sensitive health information of more than 223,000 individuals, being exfiltrated and subsequently published on the dark web.” 8 In ASIC vs ACL, in orders made

by Federal Court Justice Halley on October 8, 2025, the Court declared the following contraventions under the Privacy Act 1988 9: “Breach of APP 11.1 – failure to take reasonable steps to protect personal information 1. In contravention of s 13G(a) of the Privacy Act 1988 (Cth) (Privacy Act), in the period between 19 December 2021 and 15 July 2022, the respondent (ACL) engaged in a practice that was an interference with the privacy of one or more individuals because, having acquired the assets of Medlab Pathology Pty Limited (Medlab) on 19 December 2021, ACL did not have in place

The Practice Manager

27

adequate cybersecurity controls, which meant that it did not take reasonable steps to protect the personal information of those individuals that ACL held on certain Medlab servers from unauthorised access, modification or disclosure, in contravention of Australian Privacy Principle 11.1(b) (Personal Information Contraventions)

THE COURT ORDERS THAT:

Contravention of s 26WH(2) – failure to carry out a reasonable and expeditious assessment

(a) $4,200,000 in respect of the Personal Information Contraventions;

2. In contravention of s 13G(a) of the Privacy Act, within 30 days of 2 March 2022, in circumstances where in or around February 2022, the computer systems ACL had acquired from Medlab in December 2021 were the subject of a cyberattack (Medlab Cyberattack), ACL failed to take reasonable steps to ensure it carried out a reasonable and expeditious assessment of whether there were reasonable grounds to believe that the circumstances of the Medlab Cyberattack amounted to an eligible data breach within the meaning of s 26WE of the Privacy Act, in contravention of s 26WH(2) of the Privacy Act (Assessment Contravention).

(b) $800,000 in respect of the Assessment Contravention; and

Contravention of s 26WK(2) – failure to notify of data breach 3. In contravention of section 13G(a) of the Privacy Act, having formed the view by at least 16 June 2022 that there were reasonable grounds to believe that there had been an eligible data breach in the circumstances of the Medlab Cyberattack, ACL failed to prepare and give to the Australian Information Commissioner (Commissioner), as soon as practicable, a statement concerning the Medlab

28

Cyberattack outlining the matters set out in section 26WK(3) of the Privacy Act, in contravention of s 26WK(2) of the Privacy Act (Notification Contravention).

4. ACL is to pay to the Commonwealth of Australia, within 30 days, a civil penalty of $5,800,000, comprised of:

(c) $800,000 in respect of the Notification Contravention.

5. ACL is to pay to the Commissioner, within 30 days, a contribution of $400,000 towards the Commissioner’s costs in the proceeding.”

The judgement in AIC vs ACL is noteworthy as it is the first case of civil penalties being imposed under the Commonwealth Privacy Act 1988.

consequences of serious failures to protect the privacy of those individuals whose healthcare and information they hold.”

2026 FIIG Securities Limited (FIIG) is a “leading Fixed Income specialist for Australian investors and financial advisers. FIIG has grown to service over 6,000 clients and over 1,200 adviser accounts with more than $4.5bn in funds under advice…”11 FIIG’s IT systems were subject to a cyberattack from 19 May 2023, and “approximately 385GB of data, which included personal information of FIIG’s clients, was downloaded from its servers.

Subsequently, screenshots of two documents containing some of that client information were published on the dark web.” 12 In ASIC vs FIIG, in orders made by Federal Court Justice Derrington on 9 February 2026, the Court declared that 13:

1. “Pursuant to s 1317E of the Corporations Act 2001 (Cth) In the OAIC Media Release (Corporations Act), at all times during on 9 October 2025, Privacy Commissioner Carly Kind reinforced the period between 13 March 2019 and 8 June 2023 the defendant this milestone judgement as a “turning point in the enforcement of (FIIG) failed to: privacy law in Australia” 10: (a) have available the technological resources: “This outcome represents an (i) comprising the “Adequate important turning point in the Cybersecurity Measures” (as that enforcement of privacy law in term is defined in the Statement Australia. For the first time, of Agreed Facts and Admissions a regulated entity has been dated 23 January 2026) (Adequate subject to civil penalties under Cybersecurity Measures); and the Privacy Act, in line with the (ii) necessary to comply with its expectations of the public and legal obligations; the powers given to the OAIC (b) have available human resources by parliament. This should serve with the skills, responsibility and as a vivid reminder to entities, capacity necessary to: particularly providers operating (i) put in place and maintain the within Australia’s healthcare Adequate Cybersecurity Measures; system, that there will be

Australian Association of Practice Management

(ii) implement the controls identified and established as part of its risk management system to mitigate the cybersecurity risks it faced;

Corporations Act, at all times during the period of 13 March 2019 to 8 June 2023, by reason of FIIG’s failures to:

(iii) ensure that it complied with its legal obligations;

(a) have in place the Adequate Cybersecurity Measures;

(c) provision sufficient financial resources to enable FIIG to:

(b) have available adequate financial, technological and human resources to provide the services under the Licence; and

(i) have in place the Adequate Cybersecurity Measures;

(ii) put in place the human resources (c) have adequate risk management systems; (either within the organisation or outsourced from a third party) the defendant failed to do all with the skills, responsibility and things necessary to ensure that capacity necessary to: the financial services covered by the Licence were provided 1. have in place the Adequate efficiently, honestly and fairly as Cybersecurity Measures; required under s 912A(1)(a) of 2. implement the controls identified the Corporations Act, and thereby and established as part of its risk contravened s 912A(5A) of the management system to mitigate the Corporations Act. cybersecurity risks it faced; The Court ordered that: 3. ensure that it complied with its Penalty legal obligations; 4. Within 30 days of this order, and thereby failed to have FIIG pay to the Commonwealth a available adequate resources pecuniary penalty of $2.5 million in (including financial, technological respect of FIIG’s contraventions of s and human resources) to provide 912A(5A) of the Corporations Act. the financial services covered by its Australian Financial Services Licence (number 224659) (Licence) as required under s 912A(1)(d) of the Corporations Act, and thereby contravened s 912A(5A) of the Corporations Act.”

2. Pursuant to s 1317E of the Corporations Act, at all times between 13 March 2019 and 8 June 2023, FIIG failed to implement the controls identified in its risk management system to mitigate the cybersecurity risks it faced, and thereby failed to have adequate risk management systems as required under s 912A(1)(h) of the Corporations Act, and thereby contravened s 912A(5A) of the Corporations Act. 3. Pursuant to s 1317E of the

Justice Derrington noted that the cost of having cyber security and risk management in place over the period from March 2019 to June 2023 would have cost approximately $1.2 million, whereas the cyber security remediation cost approx. $1.5m.

Compliance programme

Justice Derrington has ordered that FIIG is required to undertake a compliance programme (Compliance Programme) with the following steps (in summary): ○ engage an expert as agreed between FIIG and ASIC, each party acting reasonably (Independent Expert) and that: ○ …the Independent Expert to

prepare a written report (First Report) which identifies what, if any, further documentation, resources and controls in respect of cyber security and cyber resilience are necessary for FIIG to implement, to reasonably manage risk in respect of cyber security and cyber resilience (Remedial Actions); ○ the Independent Expert to deliver the First Report within 45 Business Days of the engagement of the Independent Expert…; ○ the Independent Expert will provide a copy of the First Report to ASIC within 7 business days of the First Report being delivered to FIIG by the Independent Expert; ○ If Remedial Actions are identified in the First Report, within 15 business days of the First Report being provided to ASIC, FIIG must, in consultation with the Independent Expert and ASIC, agree a timetable for the implementation of the Remedial Actions, including an end date by which all Remedial Actions must be completed (Agreed Date)… ○ FIIG must commence implementing the Remedial Actions no later than 45 days once the Agreed Date has been determined, … , and complete the implementation of the Remedial Actions by the Agreed Date; ○ “Within 90 to 180 days after the Agreed Date, or such other later time as agreed by ASIC in writing, the Independent Expert must deliver a further written report to FIIG which reports on the outcome of the implementation of the Remedial Actions, including whether, and to what extent, the Remedial Actions have been fully and

The Practice Manager

29

appropriately implemented (Final Report); and ○ “FIIG will provide to ASIC, within 10 days of the Final Report or such other date as agreed by ASIC in writing, an attestation from the Chief Executive Officer of FIIG, stating that they have read and understood the First and Final Reports and having made reasonable enquiries, believes the Remedial Actions have been implemented and is satisfied with how the Remedial Actions have been implemented” ○ The engagement of the Independent Expert and all cost will be paid by FIIG, and FIIG will provide all assistance, including all documentation, access to experts, systems and premises, etc., to the Independent Expert. ○ FIIG to provide a copy of any written correspondence between FIIG and the Independent Expert, as requested by ASIC from time to time (other than any documents or information subject to a claim of legal professional privilege) Further, ASIC is to approve “the appointment of the Independent Expert and the engagement terms”.

FIIG also is to acknowledge that “ASIC may from time to time publicly report on the progress of the Compliance Programme (for the avoidance of doubt, ASIC will not publish the First or Final Reports, or any other information where public disclosure may unduly pose a risk or threat to FIIG from a cyber security perspective); and “that the terms of engagement may only be varied with the agreement of ASIC.” Costs - FIIG was also ordered to “pay ASIC $500,000 towards

30

ASIC’s costs of and incidental to the proceeding” within 30 days of the order.

Now, it is important to note Justice Derrington’s observations as to cyber attacks and adequate cyber protections: “It might be observed, at this point, that the mere fact of a successful cyberattack on an entity’s information technology systems does not necessarily indicate that the entity had failed to meet the statutory obligations imposed upon it concerning the protection of its information. It is notorious that certain countries hostile to Australia support the conduct of cyber attacks upon Australian companies and, necessarily, fund those malefactors to a large degree.

It would be all but impossible to prevent every cyber attack.

However, ASIC’s very legitimate concern does not seek to impose an unattainable standard of information protection. Rather, ASIC is concerned that entities which are subject to obligations under the Act have adequate cyber protection systems in place.”

In the ASIC Media Release on 9 February 2026, ASIC Deputy Chair Sarah Court said, ‘Cyber-attacks and data breaches are escalating in both scale and sophistication, and inadequate controls put clients and companies at real risk.

‘ASIC expects financial services licensees to be on the front foot every day to protect their clients.

FIIG wasn’t – and they put thousands of clients at risk.

‘In this case, the consequences far exceeded what it would have cost FIIG to implement adequate controls in the first place.

Australian Association of Practice Management

‘This is the first time the Federal Court has imposed civil penalties for cyber security failures under the general AFS licensee obligations, setting a clear licence-to-operate expectation for robust cyber resilience.

‘Clients entrust licensees with sensitive and confidential information, and that trust carries clear responsibilities.

FIIG’s cyber security failures between 13 March 2019 to 8 June 2023 included examples where it did not: ○ allocate the necessary financial resources to have suitably qualified and experienced people available, or implement adequate technological resources to manage cyber security ○ implement adequate cyber security measures, including multi-factor authentication for remote access users, strong passwords and access controls for privileged accounts, appropriate configuration of firewalls and security software, regular penetration testing and vulnerability scanning ○ have a structured plan to ensure key software systems were being updated to address security vulnerabilities ○ have qualified IT personnel monitoring threat alerts to identify and respond to cyberattacks ○ provide mandatory cyber security awareness training to staff, and ○ have an appropriate cyber incident response plan that was tested at least annually.

‘Entities that fail to maintain

proper cyber security controls risk regulatory action by ASIC and exposure to malicious exploitation,’ the Deputy Chair said.

ASIC expects AFS licensees to prioritise cyber-resilience and invest in people, systems and governance which are fit-forpurpose for entity size and the sensitivity of client information held.” 14 Things have changed…

Organisations that hold sensitive PII and PHI data are on notice that they must heed the “Cyber Risks: Be Prepared” advice from ASIC back in 2022 15, or to risk being held accountable for cyber security and risk management failures by the regulators and the Courts.

The regulators are enforcing the laws relating to cyber security and privacy obligations, and are seeking significant penalties from the Courts. Compliance is not optional. There are more cyber security and risk management cases before the courts…

Healthcare providers and practice managers must take “active measures” and reasonable steps” to protect patient data, or risk being held accountable before the Courts if these “adequate cyber security measures” highlighted by the three cases cited above are not in place, and are not managed appropriately.

Be cyber safe.

More to come on cyber security assessments for primary healthcare providers next issue…

References 1 OAIC, (2026)., retrieved from https:// www.oaic.gov.au/privacy/australianprivacy-principles 2 ASIC, (2026)., retrieved from https:// www.asic.gov.au/about-asic/what-we-do/ our-role/ 3 OAIC, (2025)., retrieved from https:// www.oaic.gov.au/about-the-OAIC/whatwe-do 4 OAIC, (2025)., retrieved from https:// www.oaic.gov.au/news/media-centre/ australian-clinical-labs-ordered-to-paypenalties-in-relation-to-medlab-pathologydata-breach-in-first-for-privacy-act 5 ASIC, (2022)., retrieved from https:// download.asic.gov.au/media/zhodijpp/22104mr-2022-fca-496.pdf 6 ASIC, (2022)., retrieved from https:// www.asic.gov.au/about-asic/news-centre/ find-a-media-release/2022-releases/22104mr-court-finds-ri-advice-failed-toadequately-manage-cybersecurity-risks/ 7 ACL, (2026)., retrieved from https://www. clinicallabs.com.au/company-profile 8 Federal Court of Australia, (2025)., retrieved from https://www.judgments. fedcourt.gov.au/judgments/Judgments/fca/ single/2025/2025fca1224 9 ibid 10 OAIC, (2025)., retrieved from https:// www.oaic.gov.au/news/media-centre/ australian-clinical-labs-ordered-to-paypenalties-in-relation-to-medlab-pathologydata-breach-in-first-for-privacy-act 11 FIIG, (2026)., retrieved from https:// www.fiig.com.au/about 12 ASIC, (2026)., retrieved from https:// download.asic.gov.au/media/o02h30dd/26021mr-asic-v-fiig-securities-limitedjudgment-13-feb-2026.pdf 13 ibid 14 ASIC, (2026)., retrieved from https:// www.asic.gov.au/about-asic/news-centre/ find-a-media-release/2026-releases/26021mr-asic-action-sees-fiig-securitiesordered-to-pay-2-5-million-over-cybersecurity-failures/ 15 ASIC, (2022)., retrieved from https:// www.asic.gov.au/about-asic/news-centre/ articles/cyber-risk-be-prepared/

The Practice Manager

31

Leading IT Services for Medical Practices Calls to the DMS helpdesk are answered literally within seconds, most issues are resolved within minutes.

Guaranteed Level 2 or Level 3 technicians with extensive experience in Australian medical software problem resolution.

Extensive experience and expertise in Australian medical software ecosystems.

87% of helpdesk calls resolved on the same day.

81% of helpdesk calls resolved on the first call.

Managed Cyber Security expertise. Security first approach with Cyber Security qualified staff.

Proactive Managed IT that is fully customised for Australian medical clinics, with high attention to detail.

DMS Private Cloud located in Melbourne and Sydney at leading Tier 4 data centres with latest high performance, and high capacity host servers.

“Beyond impressive!

DMS IT are everything they claim to be and more...”

Hayley Hughes, Practice Manager Tandem Health Labrador Medical Centre

Contact us today

1300 865 977

dms-it.com.au

New AI Receptionist

Meet Helen

AI powered receptionist support for GP practices 24/7

63%

140

Routine calls fully handled

by Helen*

Two hours of daily call time taken off reception*

min per day

4.5

out of 5

Strong patient satisfaction with AI call support*

The AI Reception is saving our reception team time and increasing bookings because fewer calls are missed. It has made smoother for both staff and patients.

-Grace Medical Care, NSW

Helen is available for GPs. See her in action. *Results vary by practice and duration of Helen usage.

 08 6205 3113

 sales@healthengine.com.au

 practices.healthengine.com.au/helen

MAGENTUS

Why disconnected systems cost more than you think Michael Strachan Head of Strategic Partnerships Magentus

It’s 9:15 on a Monday morning.

Your phone is already ringing with patients asking whether their imaging results have arrived. Reception is fielding calls from a GP’s practice chasing a specialist report from last week. You’re manually re-entering patient details into another system because nothing connects to anything else.

test means lost revenue and wasted appointment capacity.

What changes with better connections

Practice managers already coordinate complex information flows between referring GPs, diagnostic providers, hospitals, allied health services, and patients. Without systems that properly connect, you’re doing manually what technology should handle: orchestrating information This is the daily reality for practice exchange, juggling multiple managers. While healthcare leaders logins, troubleshooting when debate digital health policy and things fall through the cracks. clinicians try to focus on patient Better connected systems outcomes, you’re left bridging the give you visibility into referral gaps between systems that won’t talk to each other. The recent AMA patterns. You can forecast capacity needs more accurately.

Digital Interoperability Report You have actual data to make details what you already know – decisions about service expansion systems failing to connect remain or resource allocation. You move one of the biggest frustrations in from constantly firefighting to better healthcare. planning ahead.

What fragmentation actually costs The practical benefits Conversation around Patient safety drives many interoperability usually centre on interoperability discussions, clinical benefits: safer prescribing, and rightly so. But there’s also fewer duplicate tests, better a business case that specialist continuity of care. These of practice managers are well course matter, but there are other positioned to make. issues that land squarely with you.

Less administrative burden: Pathology and radiology results Every time your team manually that flow automatically into your transfers data between systems, practice management system you’re consuming staff time mean staff aren’t spending hours and risking transcription errors. downloading, saving, and manually Every phone call chasing missing linking reports. That time gets information is administrative redirected to patient interaction, overhead. Every patient who appointment management, or cancels at the last minute claims processing. because they haven’t yet managed to go for that pathology

34

Australian Association of Practice Management

Better patient satisfaction: Patients expect healthcare to work as smoothly as their banking or retail experiences. Online booking, automated reminders, digital access to results, and knowing their specialists have complete information from their GP all matter.

Improved cash flow: Smoother information exchange reduces the administrative delays that slow billing. Complete, accessible documentation means claims are submitted faster and rejected less often.

Lower risk: Proper digital audit trails and less reliance on manual processes reduce exposure to errors. Delayed or lost information between systems creates liability exposure for both the practice and the specialist.

What you can do now The platforms you choose today shape your operational efficiency for years ahead. When evaluating practice management systems or considering upgrades, make connectivity a primary selection criterion. Ask vendors specific questions: ○ Which systems does your platform integrate with now? ○ What does implementation support look like? ○ Can you show us data flowing between systems, not just describe capabilities?

Your expertise matters Practice Managers understand workflow bottlenecks better than most IT vendors. You know which connections would deliver the most value because you’re dealing with the gaps every day.

That knowledge counts. Whether you’re participating in forums, giving feedback to software vendors, or discussing system requirements with the specialists in your practice, your perspective shapes what gets built. Practices that will thrive as healthcare becomes more connected are those where managers can treat connectivity as a core requirement.

Moving forward Better connectivity won’t arrive overnight, but momentum is building. As mandated standards emerge and vendors respond to market pressure, the practices best positioned to benefit will be those that have already prioritised connected systems.

Start by assessing your current state. Where does information flow smoothly, and where does it break down? Where do your team members spend time on manual workarounds? Which connections, if solved, would deliver the greatest improvement?

Connected systems matter because they let practices work more efficiently. Staff can focus ○ Where does FHIR (Fast on what counts. Patients receive Healthcare Interoperability smoother care. Practice managers Resources) fit into your roadmap can proactively plan rather than and how are you reducing friction constantly react to problems. with other parts of the system I With healthcare moving toward need? greater connectivity, now is the perfect opportunity to help shape that change in ways that serve your practice, your team, and your patients.

The Practice Manager

35

A APM

Elevate, Connect and Inspire

Why the 2026 AAPM National Conference in Brisbane is Unmissable!

In the rapidly evolving landscape of Australian healthcare, the role of a Practice Manager has never been more critical—or more complex. From navigating digital health transformations and compliance updates to managing diverse teams and ensuring financial sustainability, the demands are immense. This October 2026, the Australian Association of Practice Management (AAPM) invites you to pause, reflect, and recharge at the AAPM National Conference, held at the spectacular Brisbane Convention and Exhibition Centre (BCEC).

For seasoned veterans and emerging leaders alike, the 2026 conference promises to be a cornerstone event. It is not merely a series of sessions; it is an investment in your career, your practice, and your sanity.

Here are four reasons why you can’t afford to miss it.

Unparalleled Professional Development The core of the AAPM conference is its commitment to high-calibre education. The 2026 program has been curated to address the “now” and the “next” of healthcare management. Attendees can expect a robust program with keynote presentations, interactive workshops, and panel discussions led by industry experts.

36

Whether you are managing a small GP clinic or a large multi-disciplinary practice the learning streams are designed to offer tangible value. Topics are expected to cover the most pressing issues facing our sector, including the latest updates on Medicare compliance, strategies for optimising practice efficiency through AI and technology, and essential updates on employment law. This is your opportunity to gain AAPM Continuing Professional Development (CPD) points while acquiring practical tools that you can implement the moment you return to your desk.

The Power of Connection While the sessions provide the knowledge, the “hallway track” provides the wisdom. One of the greatest benefits of the AAPM National Conference is the networking. Practice Management can often feel like a solitary profession, but in Brisbane, you will be surrounded by hundreds of peers who understand exactly what your day looks like.

The conference facilitates connection through social networking events which include the First Timers Dinner supported by Best Practice, Networking Breakfast supported

by Healthengine, Cubiko Cocktails, Happy Hour drinks, the exhibition area and casual breaks. End the conference with the Gala Dinner, where we celebrate a year of hard work and achievement. These interactions allow you to benchmark your practice against others, share

Australian Association of Practice Management

solutions to common problems, and build a support network that lasts long after the conference closes. Connecting with leading suppliers in the exhibition area also ensures you are up to date with the latest products and services that can streamline your operations.

Destination Brisbane There is no better backdrop for professional growth than Brisbane in October. The Brisbane Convention and Exhibition Centre is centrally located in the South Bank precinct, offering easy access to worqld-class dining, culture, and the stunning Brisbane River. The warm, sub-tropical spring weather provides the perfect atmosphere to clear your mind and focus on your professional goals.

Invest in Your Future Attending the AAPM National Conference in Brisbane is more than just a trip away; it is a strategic decision to elevate your professional standing. You will leave with a notebook full of ideas, a pocket full of business cards, and a renewed passion for the vital role you play in Australia’s healthcare system.

Mark your calendars for October 2026 and prepare to be inspired.

For more information and to register your interest, visit www. aapm.org.au

The Practice Manager

37

Healthcare telecommunication specialists

Powering smarter healthcare

Discover smarter connectivity for your practice with purpose-built phone systems, seamlessly integrated with practice management software to improve staff efficiency and patient care.

1800 800 723 | switchtelecom.com.au

Learn more

BEST PR ACTICE SOFTWARE

What the Digital Health?

Paul Piltz Best Practice Software

It starts with a simple request at the tearoom door: a GP has discovered a “game-changing” AI scribe, or a vendor is demonstrating a sleek new patient triage app.

As a Practice Manager, your first instinct may not be about the technology itself, but what it means in terms of impact. In a healthcare environment where digital transformation is accelerating, the regulatory landscape can feel complex. With updated guidance for AI scribes and the Australian Digital Health Agency preparing practices for the 2026 “Share by Default” changes, expectations are evolving quickly.

But here is the good news: compliance is not about mastering code or becoming an IT expert. It is about asking smart questions, setting clear processes, and maintaining strong governance.

Think of it as modern digital housekeeping; structured, proactive, and entirely manageable.

You are not just overseeing practice network security or setting password protocols. You are strengthening clinical safety and safeguarding data integrity in a rapidly advancing digital landscape.

That’s an empowering position!

40

Australian Association of Practice Management

Is it a Toy or a Tool?

One of the most practical questions for a Practice Manager is determining when software crosses the line from convenience tool to regulated medical device. If a digital product goes beyond simple transcription or document generation and is used to diagnose, prevent, monitor, or treat disease, even in a suggestive capacity, it’s likely to fall within the TGA’s medical device software classification.

This is where your due diligence shines. Before introducing a tool that claims to “identify” or “predict” patient risks, ensure it is: ○ Fit for purpose ○ Clinically reviewed before it approaches live data ○ Supported by clear accountability and oversight policies When oversight is built in, risk remains controlled. The key is not avoiding innovation, it is choosing the right product and implementing it thoughtfully.

With appropriately reviewed mechanisms and documented governance, your practice remains confidently in control.

Dealing with ChatGPT Health and the 2026 Countdown

Sharing by Default

AI-generated health information is becoming part of everyday consultations. Initiatives such as OpenAI’s ChatGPT Health aim to provide increasingly personalised health insights, potentially integrating with medical records in the future.

From this date, pathology and diagnostic imaging reports will be shared to My Health Record by default. Some providers have already begun sharing common pathology results since October 2025.

Have you had a Patient turn up with AI-generated diagnoses or treatment suggestions yet? With clear internal protocols for these new scenarios, your team can confidently: ○ Proactively manage patient engagement ○ Re-centre clinical decisionmaking with the GP ○ Reinforce evidence-based care AI may inform conversations, but clinical judgment remains firmly with the practitioner.

Supporting your team with evidenced guidance ensures these interactions strengthen, rather than strain, the GP-patient relationship.

Circle the date: 1 July 2026.

Importantly: ○ Patients who opted out of My Health Record in 2019 remain outside the system. ○ Patients can still delete their record or adjust access controls at any time. ○ Sensitive results can be withheld from sharing upon patient request.

This reform enhances continuity of care and national data integration. With clear communication processes in place, practices can work with patients on Sharing by Default smoothly and confidently.

The Final Word: Becoming the ‘Digital Captain’ With acronyms like MHR, AI, ARTG and RACGP in constant circulation, it is easy to feel that digital healthcare is complex. In reality, your role is not to be an IT technician, it is to be a strategic leader. As a Practice Manager, you are the Digital Captain. You decide what comes on board.

You ensure every system is fit for purpose. You chart the course for compliance, resilience and growth. Strong governance is not about avoiding penalties. It is about building a practice that is secure, adaptable and futureready. By implementing robust security policies and conducting structured vendor assessments, you transform digital uncertainty into competitive advantage.

Innovation does not replace oversight; it thrives because of it.

If aspects of the digital landscape still feel unclear, you are not alone and you do not need to navigate it in isolation. Join Best Practice at the AAPM Educare series, running across major capital cities. It is an opportunity to clarify emerging requirements, ask practical questions, and connect with peers facing the same transitions.

The digital shift is here. With the right preparation, your practice can lead it with confidence.

The Practice Manager

41

TELSTR A HEALTH

From vision to vigilance: building a secure digital future for health care Ongoing large-scale data breaches and incidents make it clear that health care continues to be one of the most exposed sectors, responsible for 18% of notifiable incidents in Australia.

Will Sharpe Chief Information Security Officer Telstra Health

Each incident erodes public trust because the public expects their most intimate and sensitive information to be safeguarded without exception. When that trust is broken, confidence in digital healthcare services drops, disclosure becomes less honest and the willingness to adopt innovative technologies declines.

Without trust, neither innovation nor quality patient care can progress.

Digital health adoption, from the national electronic health record system to telehealth, offers clear benefits, yet Australians continue to scrutinise how their information is handled.

Their willingness to share data depends on strong and visible safeguards, clear consent processes and confidence that governance keeps pace with the technology. Strengthening these foundations is essential as the sector shifts towards predictive and preventative models of care that depend on timely, accurate and responsibly managed data.

ChatGPT-style health applications highlight a doubleedged sword of AI in health care. They can support clinical decision-making and improve efficiency, but in the absence of strong governance, clinicians and

42

Australian Association of Practice Management

patients have every reason to be sceptical of their safety and reliability.

Secure-by-design principles and strong consent frameworks must be mandatory if we expect AI to enhance care without eroding trust. For technology leaders, embedding security into every platform and workflow from the outset is non-negotiable.

This means early collaboration between clinicians, risk teams and technologists, alongside clear guardrails for emerging technologies. Done well, security becomes an enabler, reducing remediation costs while driving safer, more efficient care.

Interoperability is equally vital.

Open standards and APIs allow data to move seamlessly across systems while maintaining compliance. Achieving secure interoperability is not just technical, it requires collaboration across providers, technology partners and regulators to ensure that shared data remains protected end-to-end. Only then can we build connected ecosystems that clinicians can rely on, and patients can trust.

The path forward for secure and safe care has three core components: ○ Embed security and privacy into every digital innovation. ○ Adopt risk-based governance that prioritises patient safety. ○ Develop consent frameworks that empower patients.

Progress will be measured not

by platforms deployed, but by patient experience: fewer retold stories, timely access to care, and confidence that their data, and health, are treated with integrity.

The Practice Manager

43

MEDICAL PR ACTICE JOBS

Market update: From recovery to realignment As we settle into the first quarter of 2026, the Australian healthcare recruitment landscape is defined by a distinct shift from “recovery” to “realignment.” The vacancy rates and desperation hiring that characterised the immediate post-COVID years (2023–2025) have stabilised, but the market remains exceedingly tight for quality talent. We have moved past the acute crisis phase into a new normal—one that is less volatile but perhaps, more demanding in its expectations of employers.

We have analysed the current recruitment trends facing private practices, breaking down the drivers of candidate behaviour, different challenges for different roles and provided practical actionable steps that you can implement in your practice for success in the year ahead.

The National Landscape: A Return to Permanence The most significant trend of early 2026 is the move towards permanent hiring.

The “locum carousel” that dominated the last three years is finally slowing down. For a long period, candidates could command premium daily rates as contractors, moving between practices with little incentive to settle. That dynamic has shifted – partially driven by the cost of living pressures felt by

44

Australians.

Private practices are prioritising workforce stability, recognising that the true cost of turnover— measured in lost productivity, disrupted patient care, and damaged team culture—far outweighs the investment in a permanent salary. Candidates are looking for security and predictability in their employment.

The Migration Lag: Why the Valve Hasn’t Fully Opened While it has been years since COVID officially ended, the effects of staffing shortages are still being felt by private practices. It was thought that the reopening of international boarders would provide a solution to the staffing shortages in healthcare. In reality, the valve is only half open - there is only a trickle of talent entering the market.

The bottleneck of international talent is administrative in nature; processing time for credential recognition (AHPRA) and visa approvals have not yet recovered to pre-pandemic efficiency. The delay has predominantly affected allied health (physiotherapists, podiatrists) and specialised nursing roles where Australian graduate/post-graduate numbers are insufficient to meet demand.

This is putting pressure on practice nurses who, frequently, have combined nursing/ administrative duties.

The good news is that the pipeline of international talent

Australian Association of Practice Management

is healthy. We expect the international supply of talent to normalise in the back half of the year. While private practices still must compete aggressively for local talent, this is short term.

There are green shoots on the horizon!

The Wage Spiral and the “Public Sector Ripple” The most active challenge for private practice heading into 2026 is salary. We cannot discuss salary trends in private practice without addressing the public sector and the recent wage increases.

The Victorian Nursing Enterprise Bargaining Agreement (EBA) have set a new standard for remuneration expectations across the healthcare sector nationally.

Nurses in the public sector are set to receive a 28% increase in salary over the next four years.

Naturally, your private practice nurses are looking at their colleagues in the public sector and wondering about their own remuneration. The ripple effect of this increase extends to those who work closely with nurses, your Practice Managers and Medical Secretaries. They are highly aware of the shifting pay scales and question their own pay rates.

Irrespective of the role you are recruiting for, candidates are actively comparing private practice offers against roles in the public sector. For most private practices, offering outdated rates in 2026 you will find yourselves

attracting either under-qualified candidates or few appropriately qualified candidates.

Role-Specific Breakdown Practice Managers The role of the Practice Manager has evolved significantly. We are seeing a “flight to quality” where experienced PMs are leaving smaller, under-resourced more risky practices for larger group practices or corporate roles that offer better support structures and certainty. The burnout legacy of COVID is still real; PMs are no longer willing to be the “Chief Everything Officer” covering reception, IT, HR, and cleaning without adequate support. Draw these candidates in through the support team you can offer them.

Medical Secretaries and Admin This segment is seeing the highest demand for flexibility.

The traditional 9-to-5, Mondayto-Friday model is becoming a barrier to hiring. Talented administrative staff are seeking roles that offer 9-day fortnights, school-hour shifts, or hybrid work options (e.g., work-from-home days for billing/typing). Practices that are embracing flexibility and innovation are more successful in retaining their talent.

Nurses For Practice Nurses, the competition is fierce. The “Clinician Value Proposition” has shifted from purely clinical focus to lifestyle and autonomy. Private practice cannot always compete with hospital wages, but it can compete on work-life balance and regular hours (no night shifts).

Practices successfully recruiting clinical nurses have pivoted their “Total Value Proposition” to highlight these lifestyle benefits

over the raw salary figure.

3. Conduct “Stay Interviews”

Practical Priorities for Private Practice

Most private practices rely solely on “exit interviews” to find out why staff leave. By then, it is too late. Implement “stay interviews”—informal but structured chats with your key staff to ask: “What keeps you working here?” and “If you were to leave, what would be the reason?”. This simple proactive step can reveal friction points (like roster rigidity, difficult personalities, or software frustrations) that you can fix before they become resignation letters. The best way to recruit is to retain!

For practice owners and managers, we are seeing that practices being cautious and delaying recruitment are suffering. Success in 2026 requires a proactive strategy.

Here are four practical, highimpact steps you can take immediately: 1. Audit Your “Total Value Proposition” You may not be able to match the public sector dollar-fordollar on base salary, but you can compete on the “Total Value” package. Candidates weigh the whole offer: salary + flexibility + culture + development.

Conduct an honest audit: Do you allow flexibility? Do you fund professional development? Do you offer a clear pathway for progression? Is your technology modern, or will a new hire be frustrated by archaic systems?

Marketing these non-monetary benefits in your job ads is critical to attracting talent that values lifestyle over pure salary.

4. Build Your Own Talent

With experienced talent in short supply, consider hiring for attitude and aptitude rather than just years of experience. The pool of “perfect” candidates (e.g., 5+ years experience, Genie software expert) is dry. Instead, look for smart, organized candidates from hospitality, retail management, or corporate admin. These industries train excellent customer service and multitasking skills. A candidate with the right attitude can be trained on your software 2. The “Two-Week Rule” for Hiring in two weeks; a candidate with the wrong attitude but the right Speed is your greatest skills can damage your culture for asymmetric advantage over large years. hospitals and the public sector; their recruitment process can take The Bottom Line: The outlook up to 3–4 months. You can do it in for the rest of 2026 is cautiously two weeks. A qualified candidate optimistic. Practices that are in the current market will have proactive in their retention; either multiple interviews within days financial or non-financial incentives, of applying. If your process drags and recruitment are on the front on, you will lose them. Streamline foot. These private practices will your process: review CVs daily, not just survive the tight market, block out interview times in they will define the new standard of advance, and be empowered to employment in private healthcare. make an offer immediately if you find the right person.

The Practice Manager

45

Australian Association of Practice Management Ltd (AAPM) Suite 209, Level 2, 517 Flinders Lane Melbourne Victoria 3000 T 1800 196 000 E nationaloffice@aapm.org.au W www.aapm.org.au facebook.com/AAPMAustralia @AAPM_National linkedin.com/company/aapm @aapm1979

The content of articles and advertisements contained in the Practice Manager Journal solely reflect the personal opinions of the authors or contributors and does not necessarily represent the official position of AAPM. No part of this publication may be reproduced, copied or duplicated without written consent of AAPM.