Skip to content
Contact Us Now

Microsoft 365 for Healthcare Providers

Most Australian practices run Microsoft 365 for email, documents, Teams and sign-in alongside a practice management system such as Best Practice, Cliniko or Halaxy that holds the clinical record. Microsolve designs, secures and manages Microsoft 365 for GPs, specialists and allied health providers so health information moves safely between the two.

The hard part is rarely configuring either system. It is deciding which information belongs where, and then making sure the gaps in between, such as the shared inbox, the reception PC and the Teams chat, are not where patient information quietly ends up.

Why the line between systems matters

The Privacy Act covers every organisation that provides a health service and holds health information, regardless of turnover.
Under APP 11, you must take reasonable steps to protect that information from misuse, loss and unauthorised access, and destroy or de-identify it when it is no longer needed.

Health service providers are also the sector that reports the most data breaches to the OAIC: 18% of notifications in the first half of 2025.

Most practices have a well-protected clinical system. The exposure usually sits in Microsoft 365: referrals in an unowned shared mailbox, reports saved to a desktop, patient detail in a Teams chat, a former staff member's mailbox that still holds years of correspondence. None of that is a practice management system problem, and none of it is fixed by a better practice management system.

Following a patient's information

The workable rule is that your practice management system holds the clinical record, and Microsoft 365 holds everything the practice needs in order to receive, deliver, discuss and evidence that care. The table follows a patient's information through the practice and shows where each system takes over.

Following a patient's information: what each system should hold, and where it usually goes wrong.
Stage Practice management system Microsoft 365 Where it goes wrong
Referral in Referral recorded against the patient Referrals arriving by email or fax-to-email in a shared inbox A shared mailbox with no named owner, where referrals sit unopened
Booking and intake Appointment, demographics, consent, intake forms Booking confirmations, forms sent by email, phone and Teams calls Intake forms saved to a reception PC's Downloads folder
Consultation Clinical notes, assessments, treatment plans Telehealth via Teams, clinician sign-in, the device itself Telehealth links sent from personal accounts, or shared logins on consult-room PCs
Reports and letters out The finished report or letter, filed to the record Drafting in Word, sending by email or secure messaging Reports emailed unencrypted, or drafts left in OneDrive after sign-off
Team collaboration The authoritative clinical record Case discussion in Teams, policies and procedures in SharePoint Clinical detail in Teams chats that never reaches the record
Retention and disposal The clinical record for the retention period Correspondence archive, practice records, offboarded staff mailboxes Mailboxes deleted when staff leave, taking patient correspondence with them

Every row in the last column is a Microsoft 365 configuration or process problem, and each one has a fix that does not slow clinicians down. The guides below take each one in turn.

Five decisions that shape a healthcare Microsoft 365 environment

The plan you license

The plan decides which protections you can switch on at all. Device management, Conditional Access and information protection are not in the entry-level plans, and practices often find this out after a lost laptop rather than before. Which Microsoft 365 plan is right for your practice compares the options for clinics of different sizes.

How Teams and SharePoint are structured

Without a deliberate structure, Teams turns into a mix of chats, channels and files where nobody can say who has access to what. A practice-shaped structure separates clinical team discussion, administration, policies and governance, with access set by role. See structuring Teams and SharePoint for a practice.

How clinicians work away from the practice

Telehealth, home visits, outreach clinics and after-hours access all move health information outside the building. The controls that matter are who can sign in, from which devices, and whether patient information can be saved locally. See telehealth and secure remote access, and our article on closing the shared-device security gap for reception and consult-room computers.

Which obligations apply to you

Every practice is covered by the Privacy Act. Registered NDIS providers and practices in different states pick up further requirements for consent, information management, incident handling and retention. NDIS and Privacy Act requirements in Microsoft 365 maps those obligations to the settings that support them.

How you work with other practitioners

Multidisciplinary care means sharing information with GPs, specialists, other allied health providers and NDIS support coordinators. Guest access in Teams, shared channels and secure email can do that safely, or can leave patient information shared with people nobody remembers inviting. See collaboration across allied health teams.

Problems we solve

No matching solutions found.

Email: the channel that needs the most care

Email is where most health information leaves the practice, and the RACGP's guidance on using email in general practice is clear that unencrypted email carries real risks: wrong recipients, lost devices, forwarding and interception. Its lower-risk practices include recording patient consent and sending health information encrypted or by secure messaging. Accreditation follows the same line: the RACGP Standards 6th edition require digital communications that protect the privacy of patients.

In practice that means an email policy staff can follow, Microsoft 365 message encryption or secure messaging for clinical correspondence, SPF, DKIM and DMARC so your practice's domain cannot be spoofed to patients, and an immutable email archive so correspondence survives staff turnover and can be produced if a complaint or claim arrives years later.

Retention: keeping what you must, and no more

Retention pulls in two directions. In NSW, private health service providers must keep health information for 7 years from the last service for adults, and until age 25 for information collected while the patient was under 18.

APP 11 then requires you to destroy or de-identify personal information once you no longer need it. Your practice management system usually handles the clinical record; Microsoft 365 needs its own approach for correspondence, so that offboarding a staff member does not delete records you are required to keep.

See how we help Practices like yours

How Microsolve helps healthcare providers

We set up and run Microsoft 365 for GPs, medical specialists, allied health and NDIS providers: licensing, identity and multi-factor authentication, Intune device management, email security and archiving, Teams and SharePoint structure, and the integrations between Microsoft 365 and your practice system. It sits within our wider Microsoft modern workplace service and our healthcare IT services.

Where a practice needs to prove its security to insurers, funders or partners, SMB1001 certification and Essential Eight assessment turn the configuration into evidence. Where the bigger question is direction rather than configuration, a vCIO engagement sets the roadmap first.

Further reading: running a secure modern workplace in Australian healthcare, modern authentication for Australian healthcare and building a healthcare cyber incident response plan.

Frequently asked questions

Can Microsoft 365 replace our practice management system?

No.

Your practice management or clinical system, such as Best Practice, MedicalDirector, Cliniko, Halaxy, Coreplus or Nookal, is built for appointments, billing, clinical notes and the patient record.

Microsoft 365 is the layer around it: email, documents, Teams, sign-in and device security.

The aim is to make the two work together, not to move the clinical record into SharePoint.

Is it okay to email patient information from Microsoft 365?

It can be, if the risks are managed.

The RACGP warns that unencrypted email creates privacy and security risks, and its lower-risk practices include recording patient consent and sending health information encrypted or through secure messaging.

In Microsoft 365 that usually means message encryption, sensitivity labels and secure messaging for clinical correspondence, with email archiving so there is a record of what was sent.

Does the Privacy Act apply to a small practice?

Yes.

The Privacy Act covers every organisation that provides a health service and holds health information, whether or not it is a small business, so a sole practitioner has the same obligation to take reasonable steps to protect health information as a large clinic.

NDIS providers can have further obligations; our guide to NDIS and Privacy Act requirements covers both.

Which Microsoft 365 plan does a practice need?

Most practices that handle health information on laptops, tablets or shared reception computers are best served by Microsoft 365 Business Premium, because it adds device management, Conditional Access, Defender for Business and information protection to the email and apps in the lower plans. Business plans are limited to 300 users.

Our guide to choosing a Microsoft 365 plan walks through the trade-offs.

Where is our Microsoft 365 data stored?

You can check rather than assume.

A global administrator can see the data location for Exchange, SharePoint and Teams in the Microsoft 365 admin centre, under Settings, Org settings, Organisation profile, Data location.

We confirm it as part of every healthcare onboarding, along with where your practice management system and backups are hosted.

How long do we need to keep patient records and correspondence?

It depends on your state.

In NSW, private health service providers must keep health information for 7 years from the last service for adults, and until the patient turns 25 if it was collected while they were under 18.

Clinical records usually live in your practice system, but correspondence in Microsoft 365 needs a retention approach too, especially when staff leave and their mailboxes are removed.

How should shared reception and consult-room computers be set up?

Each person should sign in as themselves, even on a shared computer, so access is logged and can be removed when they leave.

Shared generic logins are one of the most common findings in practice reviews. Options include fast user switching with multi-factor authentication, shared-device policies in Intune, or locked-down thin clients that hold no patient data locally.

Start with where your patient information actually goes

If you are not sure where referrals, reports and patient correspondence end up in Microsoft 365, that is the conversation to have before any configuration work. Call 1300 792 492, book a cyber risk review, or see how to start working with Microsolve.