HISO 10029, the Health Information Security Framework, is Health New Zealand’s standard for protecting health information. It is published in parts for different kinds of organisations, and one part, HISO 10029.2:2023, is written specifically for micro to small organisations.
Is your practice a “micro to small organisation”?
The guidance applies to health organisations that meet two or more of these descriptions: a stand-alone business, a single site with a basic technology setup such as laptops, internet and practice software, up to about 25 staff, a patient population under 10,000, mostly outsourced IT support, and no in-house software development. That describes most physiotherapy, dental, psychology, optometry and similar practices.
What it means in practice
The framework is written in formal language, but most of what it expects of a small practice comes down to a handful of habits:
- Know what you have: a list of devices, systems and where patient information is stored.
- Control access: individual logins, multi-factor authentication, and access removed promptly when staff leave.
- Keep systems current: supported operating systems and software, with updates applied.
- Protect devices: encrypted laptops, screen locks, and care with devices connected to clinical equipment.
- Back up and plan for outages: tested backups and a way to keep seeing patients if systems fail.
- Manage suppliers: know what your practice-software vendor and IT provider are responsible for.
- Prepare for incidents: know who to call and how you would tell affected patients.
It sits alongside the Health Information Privacy Code 2020, which sets the rules for collecting, using and disclosing health information.
A sensible first step
Review your practice against the guidance once, write down the gaps, and fix them in priority order. Most practices find the first few fixes, such as MFA and tested backups, are quick.
We offer a practice security baseline aligned with HISO 10029.2. Call 04 282 0045 or read about IT for health practices.