Website hosting for medical practices needs to do three things well: protect anything a patient types into the site, stay online when people are trying to book, and look trustworthy enough that patients feel safe getting in touch. The biggest risk usually isn’t the server. It’s a website quietly collecting health details it doesn’t need. Get the forms right first, then choose secure Australian hosting and keep the site maintained.
Key takeaways
- Health providers are covered by the Notifiable Data Breaches scheme regardless of size.
- Keep clinical details off general website forms. Use systems built for patient data instead.
- Every form entry can end up in three places: the database, an inbox and the backups.
- Choose hosting with account isolation, a firewall, Australian servers and off-site backups.
- Most risk sits in plugins and logins, so the site needs ongoing maintenance, not just a good host.
Why is a health practice website different?
Most small businesses with turnover under $3 million sit outside parts of the Privacy Act. Health providers don’t. The OAIC’s Notifiable Data Breaches scheme covers all private health service providers, whatever their size. A suspected breach must be assessed within 30 days, and serious ones reported to the OAIC and affected people (OAIC).
Health is also the sector reporting the most breaches. In 2025 it notified 225 of the record 1,205 breaches, and 59% of all breaches came from malicious or criminal attacks (OAIC). For a GP clinic, physio, psychologist or dental practice, the website is one more door to keep locked. Our overview of Privacy Act basics for small business websites covers the general rules.
What should a practice website collect?
As little as it can. A practice website’s job is to explain services, show who the practitioners are and make it easy to book or call. It shouldn’t be a place where patients type symptoms, test results or health fund details into a general contact form.
- Fine on the website: name, phone, email, preferred time, and which service or practitioner.
- Keep off general forms: symptoms, medical history, medications, referrals, test results and insurance or health fund numbers.
- Use dedicated systems for: online booking, intake questionnaires and patient messaging. Choose tools built for health information, run by a provider that explains where data is stored and how it’s protected.
Add a short note above the contact form: “Please don’t include medical details. We’ll call you back.” It sets expectations and cuts down what you have to protect.
Where does a form submission actually go?
This is the part most practices haven’t thought about. A typical WordPress form keeps several copies of every message.
| Copy | Where it sits | What to do |
|---|---|---|
| Form entry | The website database | Turn off entry storage, or delete entries on a schedule |
| Notification email | Reception’s inbox, and often phones | Send only a summary, with two-factor login on the mailbox |
| Backups | Your host’s and any plugin backups | Keep them encrypted, off-site and on a set retention period |
Deleting an entry doesn’t remove it everywhere. WordPress’s own erase tool “does not remove the data from backups” (WordPress.org). That’s another reason to collect less in the first place.
What should hosting for a medical practice include?
Once the forms are sensible, the hosting needs to protect what’s left. Look for these features in any secure web hosting:
- Account isolation. On cheap shared servers, one hacked neighbour can affect others. Our article on shared hosting security explains what isolation should mean.
- A web application firewall. It blocks attacks and password guessing before they reach WordPress. Our guide to the WordPress firewall shows how.
- Free SSL on every page. HTTPS encrypts what patients type on the way to your server.
- Australian servers. There’s no general law forcing private businesses to host in Australia. But under APP 8, you can remain accountable for how an overseas provider handles personal information (OAIC APP Guidelines, chapter 8). Local hosting keeps that simple.
- Off-site backups with a set retention. You need to recover the site, but you don’t want old form data kept forever.
- Two-factor login for every admin. Including the practice manager and any marketing contractor.
- Attack resilience. Practices are rarely targeted directly, but our article on DDoS protection explains what a good host absorbs for you.
Why does uptime matter for patient trust?
When a website is down, patients don’t wonder about your hosting. They wonder whether the practice is still open, and they may book elsewhere. If your booking button links to an outside system, a broken page can still stop people reaching it.
A hosting uptime commitment of 99.9% still allows for a little downtime each month, so pair it with monitoring that tells you the moment the site stops responding. Keep the practice phone number in plain text at the top of every page, so patients can call even if a booking widget fails.
Who looks after the website once it’s live?
A good host protects the server. It usually doesn’t update your plugins, check your forms or watch for a hacked admin account. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack). That’s why practices need someone responsible for updates and website security monitoring, not just a hosting account.
Also agree who does what if something goes wrong. The 30-day assessment clock starts when you suspect a breach, so you need logs, backups and a person to call quickly.
How do we help health practices?
Our hosting plans run in NEXTDC data centres in Brisbane and Melbourne, with free SSL and free migration on every plan. Business plans add phone support 7 days, 9 to 5, and our 24/7 emergency line is 0426 833 422. For the website itself, our Maintain & Protect care plans cover updates, malware scanning, firewall and login protection, and off-site backups kept for 30 days.
We aren’t lawyers, and we don’t give privacy compliance advice. We can make sure the website collects only what it should and is hosted and maintained with care.
Frequently asked questions
Does the Privacy Act apply to a small allied health practice?
In most cases, yes. The OAIC treats private health service providers as covered whatever their turnover, and they’re included in the Notifiable Data Breaches scheme. If you’re unsure whether your service counts as a health service, check the OAIC’s guidance or ask a privacy lawyer.
Can patients send referrals or results through our website?
We’d advise against using a general website form for that. Use secure messaging or a system designed for clinical documents, which controls who can see them and how long they’re kept. Keep the website for enquiries, bookings and information.
Is it a breach if our contact form emails go to a shared inbox?
Not by itself. But a shared inbox read on several phones is a common weak point. Turn on two-factor login, limit who has access, and make the notification email show only what reception needs to call the patient back.
Does our website need to be hosted in Australia?
There’s no general legal requirement for private practices. But you can stay accountable for how an overseas provider handles personal information, and local hosting is faster for Australian patients. For a health practice, Australian hosting is the simpler choice.
What should we do if we think our website has been hacked?
Contain it first: take the site offline or put it in maintenance mode, change passwords and preserve logs and backups. Then assess whether patient information was exposed, because the 30-day assessment period may apply. Our emergency line is 0426 833 422.
Sources
- Quick reference guide for responding to data breaches, OAIC
- Data breach notifications increase to all-time high in 2025, OAIC, 2026
- Tools Erase Personal Data screen, WordPress.org, updated August 2025
- APP Guidelines, Chapter 8: Cross-border disclosure of personal information, OAIC, October 2025
- State of WordPress Security in 2026, Patchstack