Health service providers reported more data breaches than any other sector in the first half of 2026: 149 of the 667 notifications the Office of the Australian Information Commissioner received, including 72 caused by malicious or criminal attacks and 62 caused by human error (OAIC). In ASD's 2025-26 reporting year, health care and social assistance was the most frequently reporting sector outside government, with 7% of incidents (ASD).
The Privacy Act applies to every organisation that provides a health service and holds health information, whatever its size or turnover (OAIC). A small practice has the same obligations to protect patient records as a hospital group.
Read what ASD's 2025-26 findings mean for smaller organisations, and make sure your practice has a tested cyber incident response plan.
Sources: OAIC Notifiable Data Breaches statistics, January to June 2026; ASD Annual Cyber Threat Report 2025-26.