MediRecords Data Security & Storage

Keeping practice and patient data safe is core to how MediRecords is built and run. This article summarises the key certifications, infrastructure safeguards, and contractual commitments that protect your data, drawn from our formal security and compliance documentation and our Terms and Conditions. It also outlines where responsibility sits with your practice, since keeping health information secure is a shared effort between MediRecords and the practices we support.

Contents:

1. Certifications and Standards
2. Data Hosting and Residency
3. Encryption
4. Incident Response and Data Retention
5. Your Practice's Responsibility
6. Your Data: Vendors, Payments, and Deletion

Certifications and Standards

MediRecords holds ISO 27001:2022 certification for our Information Security Management System (ISMS), covering the MediRecords application suite. ISO 27001 is an internationally recognised standard for managing information security risk, and our certification is independently, externally audited.

Data Hosting and Residency

All MediRecords data is hosted within Australia, using Amazon Web Services (AWS) infrastructure in the Sydney region, across three Availability Zones for resilience and redundancy.

Encryption

Data is encrypted both in transit and at rest:

• In transit: TLS 1.2 or higher is enforced across our AWS services, including load balancers, databases, search, and messaging infrastructure, protecting data as it moves between your practice and MediRecords.
• At rest: Stored data is encrypted at rest using AWS Key Management Service (KMS).

Incident Response and Data Retention

MediRecords maintains a formal Data Breach Incident Response process, aligned with the Office of the Australian Information Commissioner's (OAIC) Notifiable Data Breaches scheme requirements.

We also maintain a formal Data Retention Policy, reviewed annually, which governs how long different types of data are retained and how they are securely disposed of.

Your Practice's Responsibility

Keeping health information secure is a shared responsibility. MediRecords secures the platform, infrastructure, and data in the ways described above, but your practice is responsible for how your staff access and use MediRecords, and for meeting your own obligations as a health service provider under Australian privacy law.

Account and Access Security

Your practice is responsible for:

• Setting appropriate passwords and authentication for your staff, and ensuring login accounts are never shared between users.
• Restricting access and permissions so staff can only see and do what is required for their role.
• Promptly removing or disabling access for staff who leave the practice or change roles.
• Securing the computers, networks, and devices your staff use to access MediRecords, including keeping them updated and protected against malware.

If a Data Breach Occurs

Under the OAIC's Notifiable Data Breaches scheme, a practice and MediRecords can both be considered to hold the same health information: MediRecords stores it and can access it, while your practice retains control over how it is used. This means both parties have responsibilities if a breach occurs.

Where a breach involves your practice, for example a staff member's login being compromised, your practice is responsible for:

• Resetting passwords and confirming multi-factor authentication for any affected staff, and reviewing devices or accounts for signs of compromise.
• Assessing the risk to patient safety and communicating with affected patients. The OAIC generally expects whichever party has the closest relationship with affected individuals, usually your practice, to lead this communication, with MediRecords supporting you throughout.
• Notifying the OAIC, My Health Record, or your relevant state or territory privacy regulator, where the breach resulted from your practice's own systems, staff, or credentials.
• Meeting any additional reporting requirements under the health records legislation that applies in your state or territory.

Managing and Retaining Health Records

Separately from platform security, your practice remains responsible for how health information is collected, used, disclosed, retained, and eventually destroyed or de-identified, in line with the Australian Privacy Principles and any state or territory health records legislation that applies to you.

Your Data: Vendors, Payments, and Deletion

• Third-party vendors we engage to help deliver, operate, and secure the Services are listed on our status page.
• Card payments are processed by our PCI-compliant payment partners, eWAY and Stripe. MediRecords never has access to your complete card number; all transaction data is encrypted and securely stored within eWAY and Stripe's own bank-grade data centres.
• If your agreement with us ends, your data remains available for export for 30 days, after which it is securely deleted from our systems, unless we are legally required to retain it.

For how we handle personal information specifically, see our Privacy Policy, which operates alongside the Privacy Act 1988 (Cth).

Further Reading

• MediRecords Privacy Policy
• MediRecords Status Page
• OAIC: Guide to Health Privacy, Chapter 3, Using or Disclosing Health Information
• RACGP: Information Management for GPs, Medical Records
• IPC NSW: Retention and Storage of Health Information (NSW Private Health Service Providers)