Healthcare has been the most reported sector for data breaches in Australia for several years running. The OAIC received 1,113 data breach notifications in 2024, a 25 percent increase from 2023 and a record since the Notifiable Data Breaches scheme began. In the first half of 2025 alone, 532 notifications were filed. In both periods, healthcare generated more breach reports than any other industry, accounting for 18 percent of all notifications. The data healthcare businesses hold: clinical records, Medicare information, patient identifiers, pathology results, mental health notes. This data is among the most sensitive personal information that exists, and cybercriminals know it.

This article covers why cyber insurance in healthcare matters more than in most sectors, what Australian health businesses need to know about their regulatory obligations, what cyber insurance may include cover for, and what specific considerations apply to eHealth SaaS and health tech companies.

Why Healthcare Is One of the Highest-Risk Sectors for Cyber Attacks in Australia

Healthcare data has a higher black-market value than almost any other category of personal information. Credit card details sell for a dollar or two on dark web marketplaces and are quickly cancelled. A full patient health record with identifiers, Medicare numbers, diagnostic history, and contact information is worth significantly more and cannot be changed or cancelled. This makes healthcare businesses a persistently attractive target.

The most common threats facing Australian healthcare businesses

Ransomware. Attackers encrypt clinical systems, patient records, or billing platforms and demand payment to restore access. For a medical practice or hospital, losing access to patient records is not just a business disruption. It can directly affect patient care and safety. Ransomware attacks on healthcare facilities have delayed surgeries, diverted ambulances, and forced practitioners back to paper records.

Data breaches. Unauthorised access to patient records, Medicare data, and personal health information. These may be caused by external attacks, stolen credentials, misconfigured systems, or third-party vendor compromises. Under Australia's Notifiable Data Breaches scheme, health businesses covered by the Privacy Act are required to notify the OAIC and affected individuals when a breach is likely to cause serious harm.

Phishing and social engineering. Healthcare workers are high-value targets for phishing because their email credentials grant access to clinical systems, prescribing platforms, and patient data. Staff clicking a malicious link or responding to a spoofed email is the single most common entry point for cyber attacks in the health sector.

Third-party and supply chain breaches. Healthcare businesses rely on networks of vendors, software providers, billing systems, and referral platforms. A breach at any point in that network can expose your patients' data. Third-party vendor breaches are increasingly common and frequently not covered under policies that only address direct attacks.

The cost of a healthcare data breach in Australia

IBM's 2024 Cost of a Data Breach Report calculated the average cost of a data breach in Australia at 4.26 million AUD. Healthcare and financial services consistently rank among the most expensive sectors due to the sensitivity of the data, mandatory regulatory obligations, and the extended period over which costs accrue. Notification costs, legal fees, forensic investigation, regulatory response, and patient trust erosion continue to generate expense for 18 to 24 months after an incident.

The Medibank breach: what it showed the sector

In October 2022, Medibank Private had the personal information of 9.7 million Australians exposed in a cyber attack. The breach included highly sensitive health claims data. The OAIC found that Medibank had not taken reasonable steps to protect the information it held. The incident triggered regulatory action, class action proceedings, and scrutiny of the entire health sector's cyber posture. For any health business, it demonstrated that a data breach is not just an IT event. It is a regulatory, legal, and reputational event simultaneously.

The Regulatory Reality for Australian Healthcare Businesses

Healthcare businesses in Australia operate under a more demanding cyber regulatory environment than most other sectors. The obligations are not theoretical. They carry real financial and legal consequences.

Australian Privacy Act 1988 and the Notifiable Data Breaches scheme

Health service providers are covered by the Privacy Act regardless of size. This is unlike most other sectors where the $3 million turnover threshold applies. A sole-practitioner GP, a physiotherapy clinic with two therapists, and a large private hospital are all covered. When a data breach is likely to result in serious harm to any individual whose data is involved, notification to the OAIC and affected individuals is mandatory. Failure to notify attracts significant penalties.

Privacy and Other Legislation Amendment Act 2024: What Changed

The Privacy and Other Legislation Amendment Act 2024 (POLA Act) received Royal Assent on 10 December 2024 and introduced the most significant changes to Australian privacy law in decades. Several provisions are directly relevant to healthcare businesses in 2025 and 2026.

From 10 June 2025, a statutory tort for serious invasions of privacy came into effect. Individuals can now sue organisations directly for serious privacy breaches without relying solely on the OAIC complaints process. For healthcare businesses, this means a data breach exposing sensitive patient information can now trigger both regulatory action and direct civil litigation simultaneously. Maximum penalties for serious breaches increased to AUD 50 million.

From 29 May 2025, organisations with annual turnover above  million are required to report ransomware payments to the Australian Signals Directorate under the Cyber Security Act 2024. If a healthcare organisation pays a cyber extortion demand, that payment must now be reported to government within 72 hours. Failure to report is a civil offence.

From 11 December 2026, organisations that use automated processes to make decisions affecting individuals must disclose this in their privacy policy. For healthcare businesses using AI for any patient-related decisions, including scheduling, triage, or clinical support tools, this is a new compliance obligation. Businesses using AI systems that significantly affect patients need to begin preparing their disclosure obligations now.

My Health Records Act 2012

The My Health Records system holds data for more than 23 million Australians. Healthcare providers and organisations that access or contribute to My Health Records have specific obligations under the My Health Records Act. A breach involving My Health Record data triggers notification obligations beyond the general NDB scheme and may attract specific regulatory investigation by the Australian Digital Health Agency as well as the OAIC. eHealth SaaS companies and health tech platforms that integrate with My Health Records have additional compliance obligations.

Healthcare Identifiers Act 2010

Healthcare Identifiers (the Individual Healthcare Identifier (IHI), Healthcare Provider Identifier Individual (HPI-I), and Healthcare Provider Identifier Organisation (HPI-O)) are regulated under the HI Act. Organisations that access the HI Service for electronic claiming and referral must maintain specific security standards and are subject to compliance audits. A breach involving healthcare identifier data has specific regulatory implications.

OAIC Compliance Sweep 2026

In January 2026, the OAIC launched its inaugural privacy compliance sweep, reviewing approximately 60 entities across six sectors. Healthcare providers were among those included. Entities found with non-compliant privacy policies face compliance notices, infringement notices, and penalties of up to 6,000 per contravention. The compliance sweep signals that the OAIC is moving toward active enforcement rather than waiting for breach notifications to identify non-compliance.

ACSC Essential Eight

The Australian Cyber Security Centre's Essential Eight is a set of baseline mitigation strategies that the federal government recommends all Australian organisations implement. For healthcare businesses, the Essential Eight is increasingly referenced by health sector insurers when assessing risk and setting premiums. Businesses that can demonstrate Essential Eight implementation, particularly multi-factor authentication, application patching, and regular backups, are typically assessed more favourably. Businesses that cannot demonstrate basic controls face higher premiums and potentially restricted coverage at claim time.

Related: Cyber Insurance Claims in Australia: What Happens When Things Go Wrong?

Cyber Insurance in Healthcare: What It May Include Cover For

Subject to the terms, conditions, and exclusions of the specific policy, cyber insurance for healthcare businesses may include cover for the following categories of loss and expense.

Incident response and forensic investigation

When a breach occurs, containing it and determining its scope requires specialist cybersecurity expertise. The costs of forensic investigators, incident response teams, and legal advisers to manage the immediate response may be significant. Many cyber insurance policies include access to pre-approved incident response providers and may cover their fees, subject to policy terms.

Patient and stakeholder notification costs

Notifying affected patients, staff, and stakeholders after a notifiable data breach involves direct costs: postage, administration, call centre support for affected individuals, and credit monitoring services. For a breach affecting thousands of patient records, these costs add up quickly and may be covered under a cyber insurance policy subject to its terms.

Regulatory investigation costs

An OAIC investigation following a notifiable data breach involves legal costs, document production, and in some cases representation before regulatory bodies. Some cyber insurance policies may include cover for the costs of responding to regulatory investigations, subject to the policy terms and applicable law.

Business interruption losses

If a ransomware attack or system outage prevents a medical practice or health service from operating, the lost revenue during the downtime may be covered under the business interruption provisions of a cyber policy. For a busy GP practice or allied health clinic, even a few days of downtime represents significant revenue loss.

Data recovery and system restoration

Recovering encrypted or deleted clinical data and restoring systems to operational status after a cyber attack involves both technical costs and time. Data recovery and system restoration expenses may be included in cyber insurance coverage, subject to policy terms.

Third-party liability

Patients or other affected parties may take legal action against a health business following a data breach. Third-party liability coverage may respond to claims made against the business for losses suffered by individuals whose data was compromised, subject to policy terms.

Reputation management

A data breach in a healthcare context is not only a regulatory event. It is a reputational one. Patients whose health records are exposed make decisions about where they receive care. Some cyber insurance policies include cover for public relations and crisis communications support to manage the reputational impact of a breach.

Policy limits matter in healthcare

Healthcare businesses hold data on large volumes of people. A single breach can affect thousands or tens of thousands of patient records, each triggering notification obligations and potential third-party claims. The cover limit needs to reflect the realistic scale of a potential breach, not just the size of the business. A small medical practice with 3,000 patient records can face notification costs for all 3,000 if those records are compromised.

Who in Healthcare Needs Cyber Insurance in Australia?

Cyber insurance in healthcare is relevant across the full spectrum of health businesses, not just large hospitals and corporate health groups.

• Medical practices and GP clinics: Every practice holding electronic patient records, prescribing through software, or claiming electronically through Medicare holds sensitive data that creates cyber exposure.
• Allied health practitioners: Physiotherapists, psychologists, occupational therapists, podiatrists, and other allied health practitioners hold clinical notes and personal health information. As AHPRA-registered practitioners, they are covered by the Privacy Act regardless of practice size.
• Private hospitals and day surgeries: The scale of data held and the operational criticality of clinical systems makes cyber risk and cyber insurance particularly important for private hospital operators.
• Pathology and radiology providers: These businesses hold large volumes of diagnostic data and often integrate with multiple referring practices and hospital systems, creating complex third-party data exposure.
• Telehealth platforms: Telehealth businesses collect and store patient consultation records, personal health information, and payment data. Platforms operating at scale hold data for large patient populations.

eHealth SaaS and Health Technology Companies: Additional Considerations

eHealth SaaS companies and health technology platforms face the cyber risks that all software businesses face: ransomware, data breaches, business interruption, plus a set of risks specific to operating in a regulated healthcare context.

Platform liability

If an eHealth platform goes offline and clinicians relying on it cannot access patient records, prescribing history, or referral information, the downstream clinical impact creates a liability exposure that standard cyber insurance may not fully address. Professional indemnity insurance is worth considering alongside cyber insurance for any health tech platform whose outputs or availability clinical decisions depend on.

My Health Records and HI Service integrations

eHealth SaaS platforms that integrate with My Health Records, the HI Service, or other government health systems have specific compliance obligations and face heightened scrutiny in the event of a breach. These integrations also create data access pathways that extend the attack surface and create potential for more significant breaches than a standalone system.

Third-party data processor obligations

Health tech companies that process patient data on behalf of health service providers are considered data processors under the Privacy Act framework. When a breach occurs at the SaaS level and patient data from multiple healthcare clients is exposed, the regulatory and legal consequences involve both the SaaS company and its healthcare clients. The contractual and liability implications of this are worth addressing in both the insurance and the client contracts.

The cyber and professional indemnity combination

For most eHealth SaaS businesses, the insurance question is not just which cyber policy to hold. It is whether professional indemnity insurance is also needed. Cyber insurance may respond to data breach events and system failures. Professional indemnity insurance may respond to claims that the platform's outputs or failures caused a client financial loss. Many health tech companies need both, with the interaction between the two policies assessed carefully to avoid gaps.

Building Cyber Resilience in a Healthcare Business

Cyber insurance is one component of a healthcare business's response to cyber risk. The controls a business has in place before an incident affects both the likelihood of a breach and the outcome of any insurance claim. Insurers assess these controls when underwriting healthcare businesses.

Implement the ACSC Essential Eight. Particularly multi-factor authentication across all systems, regular application patching, and tested, offline backups. These three controls alone significantly reduce the most common breach vectors.

Train staff regularly on phishing. Phishing is the most common entry point for healthcare cyber attacks. Regular, realistic training that simulates actual phishing attempts is more effective than annual policy acknowledgements.

Assess your vendors and third parties. Ask the software providers, billing systems, and cloud services your business uses what their security standards are. Third-party breach exposure is a known and growing risk in the health sector.

Have a documented incident response plan. Specific to healthcare: know your NDB notification obligations, know who contacts the OAIC, and know which systems are prioritised for restoration. A plan produced before an incident performs significantly better than one assembled during one.

About upcover

upcover is a digital-first insurance broker helping Australian healthcare businesses and health technology companies arrange the right insurance. upcover arranges cyber insurance, professional indemnity insurance, and allied health professional insurance for health businesses across Australia, with access to 80+ insurance partners.

• 70,000+ businesses covered across Australia.
• 4.9/5 customer rating.
• Instant Certificate of Currency on policy confirmation.
• Cover for sole practitioner health businesses through to health tech platforms.

upcover is a Corporate Authorised Representative (CAR 1299211) of Experience Insurance Services Pty Ltd ABN 41 657 596 506, AFSL 539078.

Frequently Asked Questions

Do healthcare businesses in Australia need cyber insurance?

Yes. All health service providers are covered by the Privacy Act regardless of size or turnover, meaning NDB scheme obligations apply from day one. Healthcare is consistently Australia's most breached sector. Cyber insurance may help cover breach response costs, regulatory obligations, and third-party claims, subject to policy terms.

What does cyber insurance in healthcare cover?

Subject to policy terms, cyber insurance in healthcare may include cover for incident response costs, patient notification expenses, regulatory investigation costs, business interruption losses, data recovery, and third-party liability claims. Cover limits and exclusions vary between policies. Always read the PDS before purchasing.

Does a small medical practice need cyber insurance?

Yes. All health service providers are covered by the Privacy Act regardless of size, so NDB notification obligations apply even to sole-practitioner clinics. A breach affecting 500 patient records triggers the same notification requirements as one affecting 5,000. Cyber insurance may help cover those costs, subject to policy terms.

What is a notifiable data breach in healthcare?

A notifiable data breach occurs when personal information is exposed in a way likely to cause serious harm. In healthcare, this includes clinical records, mental health information, and Medicare data. When triggered, the business must notify both the OAIC and affected individuals. Healthcare is among the most commonly investigated sectors.

What cyber insurance do eHealth SaaS companies need?

Most eHealth SaaS companies need both cyber insurance and professional indemnity insurance. Cyber responds to data breaches and system failures. Professional indemnity responds to claims that a platform error or outage caused a client financial loss. upcover arranges both for health technology businesses across Australia, subject to policy terms.

How does a health data breach insurance claim work?

Contain the incident, then contact your insurer immediately. Late notification can complicate or delay the claim. The insurer appoints forensic specialists, assesses the impact, and processes the claim against your policy terms. Complete documentation and a pre-existing incident response plan significantly speed up the process.

_{The information in this article is general in nature and provided for informational purposes only. It does not constitute legal, financial, or insurance advice. The insurance information has been prepared without taking into account your individual needs, objectives or financial situation. It should not be relied upon as personal advice. Coverage descriptions in this article are general indicators only. All insurance products arranged through upcover are subject to the terms, conditions, limits and exclusions contained in the relevant policy wording and Product Disclosure Statement. Coverage for any specific incident depends on the terms of the individual policy. Before deciding whether a particular insurance product is right for you, please read the relevant PDS and consider your personal circumstances. upcover Pty Ltd ABN 17 628 197 437 is a Corporate Authorised Representative (CAR 1299211) of Experience Insurance Services Pty Ltd ABN 41 657 596 506, AFSL 539078. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}