Cyber Security for Australian Aged Care and Healthcare Providers in 2026

Australian aged care and healthcare providers are operating in one of the most demanding cyber security environments of any sector in 2026. A combination of sensitive patient data, legacy IT infrastructure, and a rapidly evolving threat landscape has made these organisations prime targets for ransomware, data theft, and supply chain attacks. At the same time, a sweeping new regulatory framework — anchored by the Aged Care Act 2024, the Privacy Act 1988, and the ASD's Essential Eight — has made cyber security a board-level governance obligation, not merely an IT concern.

Understanding the Regulatory Landscape for Aged Care and Healthcare Cyber Security

The Aged Care Act 2024, which came into force in November 2025, fundamentally restructured accountability for aged care providers. Cyber security is now explicitly embedded within the Quality Standards, meaning governing bodies are directly accountable for cyber risk management — including oversight of third-party vendors and supply chains.

Non-compliance carries severe consequences. Providers found to have failed their cyber security obligations face potential criminal penalties of up to two years imprisonment, substantial financial fines, and the risk of losing their provider registration entirely.

Healthcare providers connected to the national My Health Record system face an additional layer of obligation under the My Health Records Act 2012. Systems must meet a Security Conformance Profile based on the ASD's Information Security Manual (ISM), and any actual or potential breach must be notified to the Australian Digital Health Agency (ADHA) as soon as practicable.

Key Cyber Security Obligations in 2026

Aged care and healthcare organisations must navigate several overlapping regulatory obligations simultaneously. Understanding each framework is essential before engaging a cyber consultant to design your compliance program.

Privacy Act 1988 and the Notifiable Data Breaches Scheme

All aged care and healthcare providers handling personal information are subject to the Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme. An eligible data breach — where personal information is accessed, disclosed, or lost in circumstances likely to result in serious harm — must be reported to the Office of the Australian Information Commissioner (OAIC) and affected individuals.

Since 10 June 2025, individuals can also bring civil claims against organisations for serious, intentional, or reckless invasions of privacy under the new statutory tort. This significantly raises the stakes for any data breach involving patient or resident information.

Automated Decision-Making Transparency (December 2026)

By 10 December 2026, organisations using automated systems that influence decisions affecting individuals — such as care management algorithms or HR scheduling tools — must disclose this use. Aged care providers deploying AI-assisted care planning or rostering systems need to review their disclosure obligations now to avoid non-compliance at the deadline.

State-Level Health Records Legislation

In addition to federal obligations, providers in New South Wales and Victoria must comply with state-specific health records legislation. A cyber consultant with experience in the health sector will understand how these state laws interact with federal requirements and can help you build a unified compliance framework.

The ASD Essential Eight: The Technical Baseline for the Sector

The Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC) identify health and aged care as high-priority sectors for protective guidance. The Essential Eight maturity model is the recognised technical baseline, and providers are increasingly expected to achieve Maturity Level 2 or 3.

Maturity Level 0 or 1 is no longer considered acceptable for organisations within government, defence, or critical infrastructure supply chains — and the same expectation is rapidly extending to health and aged care providers that handle sensitive data at scale.

Priority Controls for Aged Care and Healthcare

• Phishing-resistant multi-factor authentication (MFA) — Hardware-based authentication, FIDO2/WebAuthn, and passkeys are now the standard. SMS-based MFA is considered insufficient for high-risk environments.
• Application control — Preventing unauthorised software from executing on clinical and administrative systems reduces the risk of ransomware and malware deployment.
• Patch management — Critical systems must be patched within 48 hours of identifying actively exploited vulnerabilities. Legacy medical devices that cannot be patched require network segmentation.
• Restrict administrative privileges — Limiting who can install software and access sensitive systems reduces the blast radius of any compromise.
• Regular, tested, offline backups — Immutable backups stored offline are the last line of defence against ransomware. Backups must be tested regularly to confirm they can be restored.
• User application hardening — Disabling macros, blocking web advertisements, and hardening browser settings reduces the attack surface for phishing and drive-by downloads.

Common Cyber Security Mistakes in Aged Care and Healthcare

Despite the regulatory pressure, many providers continue to make avoidable mistakes that leave them exposed. A qualified cyber consultant will identify these gaps during an initial assessment.

• Treating cyber security as an IT problem, not a governance issue — The Aged Care Act 2024 places accountability squarely on governing bodies. Boards that delegate cyber security entirely to IT staff without oversight are non-compliant.
• Failing to assess third-party vendor risk — Many breaches in the health sector originate through compromised vendors, software providers, or managed service partners. Providers must assess and contractually require cyber security standards from all third parties with access to their systems or data.
• Ignoring legacy medical devices — Older clinical devices often run outdated operating systems that cannot be patched. Without network segmentation, these devices create pathways for attackers to move laterally across the organisation.
• Inadequate staff training — Phishing remains the most common initial attack vector. Regular, scenario-based training that reflects real threats facing the health sector is essential.
• No tested incident response plan — Many providers have a cyber incident response plan on paper but have never tested it. A plan that has not been exercised will fail under the pressure of a real incident.

Australian Regulatory Context: Who Oversees Compliance

Aged care and healthcare providers must understand which regulators have oversight of their cyber security obligations and what each expects.

• Aged Care Quality and Safety Commission (ACQSC) — Oversees compliance with the Aged Care Act 2024 Quality Standards, including cyber security governance obligations for registered providers.
• Office of the Australian Information Commissioner (OAIC) — Regulates compliance with the Privacy Act 1988 and the NDB scheme. The OAIC has the power to investigate data breaches and impose civil penalties.
• Australian Digital Health Agency (ADHA) — Oversees My Health Record obligations, including breach notification and the Security Conformance Profile requirement.
• Australian Signals Directorate (ASD) / ACSC — Provides the Essential Eight framework and sector-specific guidance. While the ASD does not directly regulate aged care providers, its frameworks are referenced by other regulators and form the basis of compliance expectations.
• State health departments — In NSW and Victoria, state health records legislation creates additional obligations that must be managed alongside federal requirements.

Questions to Ask When Engaging a Cyber Consultant for Aged Care or Healthcare

Choosing the right cyber consultant is critical. Not all consultants have the sector-specific knowledge required to navigate the intersection of aged care regulation, health data obligations, and technical cyber security frameworks.

1. Do you have specific experience working with aged care or healthcare providers in Australia?
2. Are you familiar with the Aged Care Act 2024 Quality Standards and how cyber security is embedded within them?
3. Can you conduct an Essential Eight maturity assessment and provide a prioritised remediation roadmap?
4. How do you approach third-party vendor risk assessments, including medical device suppliers and software vendors?
5. Can you help us develop and test a cyber incident response plan that meets OAIC and ADHA notification requirements?
6. Do you understand the interaction between the Privacy Act 1988, the My Health Records Act 2012, and state health records legislation?
7. What ongoing monitoring and reporting do you provide to support board-level governance obligations?

How MyMoney® Can Help

Finding a cyber consultant with genuine expertise in aged care and healthcare cyber security is not straightforward. The regulatory environment is complex, the stakes are high, and the wrong advice can leave your organisation exposed to both regulatory action and reputational damage.

MyMoney® connects aged care and healthcare providers with qualified, experienced cyber consultants who understand the full regulatory landscape — from the Aged Care Act 2024 and the Privacy Act through to the ASD Essential Eight and My Health Record obligations.

Post a Brief to describe your organisation's cyber security needs and receive tailored proposals from vetted cyber consultants. Or Browse Cyber Consultants on the MyMoney® Marketplace to find professionals with the sector-specific experience your organisation requires.