Australia RACGP Standards for General Practices (5th edition) C6.4: Information security: a team member is responsible for electronic systems and computer security; personal health information is never left where the public could see it; clinical software is reached only through unique individual passwords matched to each person's authorisation; and the practice has a business continuity and information recovery plan, procedures for storing, retaining and destroying records, and policies on email and on social media

What does C6.4 require?

Electronic records bring new ways to lose information. The practice names a person responsible for computer and information security, who may draw on an external IT provider. Screens, printouts and files are kept out of public view at reception and in consulting rooms. Every user has an individual login with a password, no shared accounts, and access rights set to their role; access is removed when people leave. Systems are backed up and the backups tested, and a plan for business continuity and for recovering information sets out how the practice would restore records and keep operating after a failure or cyber attack. Written procedures cover how long records are retained, how they are stored and how they are destroyed securely. The practice has a policy on using email, covering encryption, consent and what may be sent, and a policy on social media covering what staff may post about the practice and patients.