The Most Common Privacy and Security Issues We Find on Australian Health Practice Websites

After running hundreds of scans of Australian health practice websites, these are the issues we find most often.

1. Enquiry forms that put patient information at risk

In our scans, over 90% of health practice enquiry forms showed at least one significant privacy or security risk for the health information submitted through them. While most practices use purpose-built Practice Management Systems for existing patients - we find that the very first step, the website contact or enquiry form, is often overlooked.

Many practices don’t realise that the enquiry stage deserves the same care as any other health information. People enquiring typically enter their name, contact details and a description of their health concern. Under the Privacy Act, information about a person’s health is classed as “sensitive information” and carries stricter obligations. Unlike many small businesses, health service providers are generally covered by the Act regardless of turnover. Even when a form asks people not to include health details, we find they almost always do. It’s also useful for the practitioner to have some context before responding.

General-purpose contact forms, including those commonly used on Wix, Squarespace and WordPress sites, weren’t designed with health information in mind. Depending on the setup, we often find that:

• enquiries are stored on overseas servers
• stored enquiries aren’t encrypted in a way that limits access to the practice
• enquiries can be viewed by hosting providers, web agencies or anyone else with access to the website or hosting platform
• the full enquiry is emailed to the practice, which makes the inbox another potential point of exposure

The safer approach is a form processor built for health information. Look for one that:

• encrypts enquiries where they’re stored
• keeps data in Australia
• limits access to staff the practice authorises
• keeps patient details out of notification emails

There are privacy-first form solutions available to switch to, such as SafeSubmit and other similar form tools.

2. Website platforms that aren’t kept secure

WordPress is the platform we most often see linked to security issues. It’s an open-source ecosystem, and most sites rely on a number of third-party plugins, each of which needs regular updates. Any plugin that falls behind can leave a security hole.

When practices have given us access to their WordPress sites, we’ve commonly found 20 or more third-party plugins installed. Over 80% of those sites were running outdated software with publicly known security vulnerabilities.

This makes the enquiry form problem worse. If a site stores form submissions within WordPress and the site is compromised, those stored enquiries can be exposed along with it.

3. Privacy policies that don’t provide adequate coverage

Most health practice websites have a privacy policy, but many are based on generic templates that don’t reflect how a health practice actually collects and handles information. Australian Privacy Principle 1 requires a privacy policy to explain things like:

• what personal and health information is collected, and why
• how that information is held and protected
• whether any of it is likely to be disclosed overseas
• how patients can access or correct their information
• how to make a privacy complaint

The gaps we see most often are:

• policies written for retail or general businesses
• policies that don’t mention health information at all
• no mention of overseas storage, even when the website hosting, form tool or email provider is based offshore
• no complaints process

We also often find policies that are hard to locate or aren’t linked from the forms where information is collected, and some sites have no privacy policy at all. A policy also needs to reflect what actually happens. If it says data is stored in Australia but the form tool stores it overseas, the policy could be inaccurate or misleading.

4. Content that may not meet AHPRA advertising requirements

For practitioners regulated by AHPRA, we often find website content that may not meet the advertising requirements of the Health Practitioner Regulation National Law. The most common examples are:

• testimonials about clinical care, including review widgets embedded on the practice’s own site
• claims that could create unreasonable expectations about treatment outcomes
• discounts, gifts or free offers advertised without terms and conditions
• wording that creates urgency or scarcity, such as “limited spots, book now”
• before-and-after images
• protected titles such as “specialist” used without the matching registration

These are usually straightforward to fix. Most come down to a few wording changes or removing a widget.