Australia RACGP Standards for After-hours and Medical Deputising Services (5th edition) C6.4: Information security: a team member is responsible for electronic systems and computer security; personal health information is never left where the public could see it; clinical software is reached only through unique individual passwords matched to each person's authorisation; and the service has a business continuity and information recovery plan, procedures for storing, retaining and destroying records, and policies on email and on social media

What does C6.4 require?

Mobile devices and call centres multiply the ways information can leak. The service names a person responsible for computer and information security, supported by an IT provider as needed. Screens, printouts and devices are kept out of public view in clinics, cars and homes. Every user has an individual login, no shared accounts, with access set to their role and removed when they leave; mobile devices are encrypted and can be wiped remotely. Systems are backed up and backups tested, and a plan for business continuity and for recovering information sets out how the service would restore records and keep operating after a failure or cyber attack. Written procedures cover how long records are retained, how they are stored and how they are destroyed. The service has a policy on using email, covering encryption and consent, and a policy on social media covering what staff may post about the service and patients.