Healthcare Privacy Risk Scorecard

A 10-minute self-assessment for Australian healthcare providers and practices.

Health information is treated as sensitive information under the Privacy Act, carrying stricter handling obligations than most other personal information. The healthcare sector has consistently reported the highest number of data breaches to the OAIC under the Notifiable Data Breaches scheme, and penalties for serious or repeated interferences with privacy reach $50 million. This scorecard helps you identify your exposure across governance, patient consent, clinical data handling, marketing and security in 10 minutes.

0 of 30 answeredScore: 0/60

Governance and accountability

Questions 1 to 6 of 30

1A designated privacy officer or senior staff member is formally responsible for privacy compliance.

2Privacy risk is reported to practice owners, directors or partners at least annually.

3There is a documented privacy management plan that addresses the handling of health information as sensitive information.

4Staff receive privacy training at least once every 12 months, including on handling sensitive health information.

5Privacy obligations are included in onboarding for new clinical and administrative staff.

6There is a documented data breach response procedure aligned to the Notifiable Data Breaches scheme.

This assessment provides general information only and does not constitute legal advice.

Want this fixed rather than just listed?

Savira handles the consent side of this for you - a banner that blocks tags until people agree, a record of every consent so you can prove it, and an evidence pack you can hand to anyone who asks. Free plan, about 15 minutes to set up.