Skip to content

Cyber Security and Data Governance

User access

All data is access controlled through user accounts. Each account is associated with specific security groups which prevent or allow access to certain data and functionality.

Microsoft

PHN Exchange users may decide to use their Microsoft account for restricted site access. This allows users to manage their password and authentication through Microsoft, bypassing any requirements to create a separate password for the PHN Exchange.

Single session

A user can only be logged into the PHN Exchange from one location at a time. When a user logs into the PHN Exchange from a new location, all previous sessions will be terminated.

Data storage

  • Data is de-identified at it's source.
  • Data is de-identified and extracted only if there are 5+ sets for a measure for a statistical area.
  • Data is transmitted through secure connections to the database under the custodianship of the PHN. As an example, PHN Exchange manages aggregated de-identified general practice data in the Microsoft Azure environment and complies with Australian privacy principles.
  • Access to the database is permissioned and only available to two PHN Exchange systems developers. Login from a locations other than the physical offices of PHN Exchange requires multi factor authentication.
  • Reporting back to the practice is automatically managed through the PHN Exchange.
  • Practice data within the GP Data Report for a practice is only available to that practice through secure login on the web platform.
  • PHN Exchange Aggregate figures are used to provide benchmarking for the practice.
  • Murray PHN completed an independent Data Governance and Cyber Security review and has engaged a specialist to undertake penetration testing and analysis on an annual basis. From that review, the PHN has generated policies and guidelines for data management that includes actions in the event of a suspected data breach.

Data Agreements

The privacy and data protection requirements exist in contractual arrangements, PHN and Department of Health policies, and in the Privacy Act 1988.

  • Practices submitting data to their PHN should agree to terms and conditions of the data’s storage and security and to how the data may be used by the PHN.
  • PHN staff need to sign Codes of Conduct and Privacy agreements on commencement of employment.
  • Each PHN complies with the Departmental PIP QI data governance documented by the Department.
  • Each PHN complies with the Departmental PIP QI data agreements.
  • Each PHN should have their own data sharing and user agreement with each of their practices.
  • Each PHN should use End User License Agreements between the practice, the extraction software vendor and the PHN.