New cybersecurity requirements are coming for New Zealand GP practices. Here's what you need to know and how to prepare.
Running a GP practice comes with a lot of responsibility. And between caring for patients, managing staff and keeping everything running smoothly, cybersecurity might not be at the top of your list.
Unfortunately, cybercriminals don't take appointments.
Health New Zealand | Te Whatu Ora has outlined updated cybersecurity requirements to strengthen security and protect patient information.
With the April 2027 deadline approaching, now is the time to make sure your practice is prepared.
What's changing for GP practices?
Under the 2026/27 PHO Services Agreement, GP practices are expected to meet Cyber Security Capability Maturity Model (CS-CMM) Level 2 requirements.
Quite a mouthful, isn't it?
Basically, it means having appropriate security measures in place to protect patient information, manage cybersecurity risks and demonstrate that your practice is taking security seriously.
These requirements sit alongside existing privacy and health information security obligations.
What does CS-CMM Level 2 mean for your practice?
It's about more than antivirus software and strong passwords.
Practices need to understand their cybersecurity risks, put appropriate protections in place and know how to respond when something goes wrong.
Here are a few questions worth asking:
Who can access your patient information, and should they have that access?
Is multi-factor authentication enabled where required?
Are your systems and software regularly updated?
Do you have reliable backups and a recovery plan?
Would your staff recognise a suspicious email or know how to report a security incident?
Can your IT providers demonstrate how they're protecting your data?
Not sure about some of those answers? That's a good place to start.
The new cybersecurity checklist
Health NZ has developed a cybersecurity checklist to help GP practices assess their current security and identify areas for improvement.
It's a useful starting point, but identifying a security gap and fixing it are two different things.
You might discover unnecessary staff access permissions, missing security controls or systems that need updating.
Knowing what needs attention is the first step. Having the right expertise to address it makes the process much easier.
Doesn't our IT provider already handle this?
Possibly, but having an IT provider doesn't automatically mean your practice meets the new requirements.
Your systems might be running perfectly well while still having security gaps. After all, a computer that switches on every morning isn't necessarily a secure computer.
It's worth checking that your existing IT arrangements cover the requirements and that your technology providers can demonstrate how they protect patient information.
Is funding available?
Yes. Health NZ has allocated $1,000 per general practice to PHOs for distribution to help practices meet the cybersecurity requirements for 2026/27.
Additional funding is available through regional workforce development services for approved cybersecurity e-learning.
Contact your PHO to confirm what support your practice can access.
What should your practice do now?
You don't need to become a cybersecurity expert overnight. But you do need to know where you stand.
We recommend five simple steps:
Review the checklist. Understand what's required.
Check your current security. Identify what's working and what needs attention.
Talk to your IT provider. Confirm your existing protections and any gaps.
Get your team involved. Good cybersecurity starts with everyday habits.
Make a plan. Give yourself time to address any issues before April 2027.
The earlier you start, the more time you'll have to make improvements without a last-minute scramble.
How CyberAudit can help
Cybersecurity doesn't need to be complicated, and you certainly shouldn't need a dictionary of IT acronyms to understand it.
Backed by the cybersecurity expertise of the Netcare team, CyberAudit helps businesses understand their security risks and take practical steps to address them.
We can help GP practices work through the new cybersecurity checklist, identify potential gaps and understand what needs attention before April 2027.
Our approach is straightforward: clear advice, practical solutions and cybersecurity expertise you can count on.
Because your team should be focused on looking after patients, not worrying about cybersecurity.
Is your GP practice ready for April 2027?
Not sure where your practice stands?
Talk to CyberAudit about the new requirements and how we can help you prepare.