Skip to main content
PraxisCore
Sign in

Security & compliance

Built to a standard you can hand to a practice manager and their insurer.

In-app tracking is necessary but never sufficient. Everything below is tracked as live status inside the console — with an owner, a state and a review date.

Legal baseline

The regulatory floor.

Privacy Act 1988 (Cth) & the APPs
Health information is sensitive information under the Act, held to a higher bar than ordinary personal information — APP 3, APP 6 and APP 11 in particular.
Notifiable Data Breaches scheme
Mandatory OAIC and individual notification for eligible breaches, with the 30-day clock run as a first-class workflow rather than a PDF in a drawer.
My Health Records Act 2012
Applies the moment the platform connects to My Health Record. Not in scope until it does.
State & territory health records law
Retention periods vary by state; the retention engine enforces them rather than relying on someone remembering.

Technical baseline

ACSC Essential Eight.

Tracked as eight discrete controls, each with a maturity state and an accountable owner.

  • E8·01

    Application control

  • E8·02

    Patch applications

  • E8·03

    Configure Office macro settings

  • E8·04

    User application hardening

  • E8·05

    Restrict administrative privileges

  • E8·06

    Patch operating systems

  • E8·07

    Multi-factor authentication

  • E8·08

    Regular backups

Architecture

Decisions that are painful to retrofit.

Australian data residency
Production data and backups held in Australian regions.
Encryption everywhere
TLS 1.2+ in transit, encryption at rest including backups.
Row-level security by practice
Isolation enforced at the database keyed to practice ID and role — never by UI filtering.
Immutable audit logging
Append-only from day one. Updates and deletes are blocked at the database, for admins too.
Server-side model calls only
Every AI call runs server-side so it can be logged, rate-limited and kept out of the browser.
Sub-processor review
Formal third-party risk review for each integration: PMS, claiming gateway, SMS provider, model provider.

AI trust & safety

What the model is never allowed to do.

A hard-coded boundary, enforced in product and reviewed as a compliance control — not a guideline.

  • ✕Release patient information to any external party
  • ✕Cancel, move or create a clinical appointment without confirmation
  • ✕Submit or resubmit a Medicare claim
  • ✕Send any patient-facing message that has not been read by a person
  • ✕Rank, flag or prioritise patients by clinical risk or urgency

External trust artefacts

Proof that lives outside the product.

Independent penetration test
Budgeted before the first practice goes live with patient-adjacent data.
Plain-English DPA
A data processing agreement a practice manager can actually read.
ISO 27001 / SOC 2 path
A public roadmap in year one; certification as the book of practices grows.
Insurance
Professional indemnity and cyber liability that explicitly covers errors arising from automation.