Key takeaways

  • Remote access is a frequent target for attackers, so it must be protected with multi-factor authentication.
  • Patient data should stay on practice systems, not be saved to home computers.
  • Use practice-managed devices where possible, kept patched and encrypted.

Standards update: the RACGP released the 6th edition of the Standards for general practices on 26 August 2026. Practices continue to be assessed against the 5th edition until transition arrangements are published, so references here are to the 5th edition. Many requirements carry over to the 6th edition, but they have been reorganised.

Seven habits for remote clinical work

  1. Always use multi-factor authentication for remote desktop, VPN and cloud clinical software.
  2. Use a practice-managed laptop, encrypted and kept up to date, rather than a shared family computer.
  3. Don't save patient files locally. Work inside the practice system so nothing is left on the device.
  4. Never expose remote desktop directly to the internet. Use a secured gateway or VPN set up by your IT provider.
  5. Lock the screen and keep it private from others in the house.
  6. Use a secure network. Avoid public Wi-Fi without the practice VPN.
  7. Report lost devices immediately so access can be revoked.

What the practice should set up

  • A secured remote access gateway or VPN with MFA
  • Device encryption and remote wipe on laptops
  • Individual accounts for every clinician
  • Access logs and alerts for unusual sign-ins
  • A simple written remote work policy

Common questions

Can doctors access clinical software from home?

Yes, with the right controls: a secured remote access method, multi-factor authentication, practice-managed devices, and patient data kept on practice systems.

Is a personal computer okay for remote access?

It is riskier, because the practice can't ensure it is patched, encrypted and free of malware. A practice-managed device is the safer option.

Reviewed by Graham Graieg and Dane, Triad Networking Services. Graham and Dane look after IT, phones and security for Triad's medical and business clients across South East Queensland. Meet the team.

Sources

  1. RACGP, Information security in general practice (PDF)
  2. Australian Signals Directorate, Australian Cyber Security Centre (cyber.gov.au)
  3. EMPHN, RACGP releases Standards for general practices, 6th edition (8 September 2026)
  4. QPA, Preparing for the 6th edition (16 September 2026)

General information only, current as of 6 October 2026. It isn't legal or compliance advice for your specific situation.