Sensitive information under the Privacy Act
Health information is "sensitive information" under the Privacy Act, with a higher bar for how it's collected, stored and shared — and the small-business exemption doesn't cover health service providers.
- Home
- IT support for NDIS providers
NDIS providers
IT that keeps participant data safe.
For OTs, speech pathologists, physios, psychologists, support coordinators and SIL providers — mobile teams, sensitive records, audits, and staff who come and go. IT set up so the records stay private and the auditor's questions have answers.
The stakes
Participant data isn't like other data
A café that loses a laptop loses an afternoon. A provider that loses one has participants' records to answer for.
The Practice Standards expect it managed
The NDIS Practice Standards expect participant information to be managed, secured and recoverable — and expect you to show how. "It's in the cloud" isn't an answer.
A mobile team works from phones and cars
Notes typed between visits, photos on personal phones, a laptop on the back seat. The device is the perimeter, not the office — so the device is what gets secured.
The leaver with the shared login
A support worker finishes on Friday and still knows the shared Cliniko password on Monday. Access has to end the day they do — provably.
What we handle
The IT behind a provider that can show its work
The set-up we run for two occupational therapy practices in Sydney — the same foundations as our allied health support, with the NDIS layer on top.
Microsoft 365 Business Premium, set up for a practice
MFA on every account, Conditional Access so a stolen password alone gets nobody in, Intune so a lost laptop or phone is wiped remotely, SharePoint organised by what people need. Managed end to end.
Practice software support
Cliniko, Splose, Halaxy, Lumary, ShiftCare: logins, access levels, integrations with Microsoft 365, the vendor desk when the problem is at their end.
Backup with a tested restore
Microsoft 365 doesn't back itself up the way most people assume. An independent backup, test-restored on a schedule, so "recoverable" has evidence.
Onboarding and offboarding on day one
A checklist for every starter — account, MFA, phone enrolled, the right role in the practice system — and the reverse the day someone leaves, their notes and email kept for the practice.
Policies an auditor can read
A privacy policy, an NDIS-aligned information-management policy and an AI-use policy, written for how your practice works — and kept current as the Privacy Act changes, including the automated decision-making disclosures due from 10 December 2026 — the OAIC has the detail.
Telehealth and mobile working that just works
Teams or your telehealth tool with a camera and headset that behave, a laptop that signs in from a car park, a phone that holds work apps without exposing personal photos.
Being found by referrers and families
A website that says what you do and where, a Google profile with the right hours — so a GP or a parent searching for an OT finds you.
Audit-ready, not audit-theatre
What an auditor asks, and what you hand over
We're not auditors and we don't certify anyone — the audit is between you and your approved quality auditor. Our job is making the answers true, written down, and in your own tenant.
What they ask
- Who can see participant records, and how do you know?
- What happens when a worker leaves?
- Where is information stored, and is it backed up?
- Has a restore ever been tested?
- Is there a privacy policy, and is it followed?
- How are phones and laptops secured?
What you hand over
- An access list from Microsoft 365, by person and role
- Offboarding checklists, dated
- Backup reports and the last restore test
- The policies, dated and reviewed
- The Intune device list — encryption and MFA state
- The quarterly security report
How it works
Look, fix the foundations, keep it that way
-
01
Look
A free chat and a look at your tenant: who has access, MFA state, backup, devices, how the team works day to day. A plain-English summary of what's urgent and what can wait.
-
02
Fix the foundations
The first month: MFA and Conditional Access, the password vault, backup with a restore test, laptops and phones enrolled, the policies drafted with you — scheduled around sessions.
-
03
Keep it that way
Support through the portal, same-day for most fixes. Starters and leavers handled as they happen. Weekly sign-in report, quarterly security report, monthly report with hours against the fee.
What it costs
Two plans, one predictable invoice
What you pay — we're not GST-registered, so nothing is added. Bigger projects are quoted first; anything outside a plan is $100 an hour.
Essentials
$600 a month · up to 5 users
Support and Microsoft 365 managed properly. $120 a user a month after five.
- Same-day remote support through the portal
- Microsoft 365 managed: MFA, licences right-sized
- Onboarding and offboarding checklists
- Monthly report with hours against the fee
Secure
$900 a month
Essentials plus the safeguards the Practice Standards and the Privacy Act expect of a provider.
- Managed password manager — a team vault, access ends on exit
- Microsoft 365 backup with a tested restore
- Intune on laptops and phones
- Privacy, information-management and AI-use policies
- Phishing-awareness session, quarterly security report
If you're not happy in the first 90 days, every monthly fee you've paid comes back — set-up fees and advertising spend excepted. Every price is on one page; the plans in full are under managed IT support and services.
Why Tidewire
One person who knows your whole practice.
Remote-first from Melbourne's east, with two occupational therapy practices in Sydney already on this set-up. Your tenant is administered through Microsoft Partner Center with delegated access you can see and revoke; passwords live in a vault you can take with you; configurations and vendor details are documented and yours.
- Same-day remote fixesA secure remote session to a laptop in a car park, around the diary.
- Everything owned by youTenant, vault, documentation, domain — all in your name.
- Plain-English reportingMonthly, with hours delivered against the fee.
- No lock-inMonth to month, with the 90-day guarantee on monthly fees.
FAQ
Fair questions
Are you NDIS-registered yourselves?
No — we're the IT provider, not a registered provider. We align your IT with the Practice Standards' information-management expectations and give you the evidence: access lists, offboarding records, backup and restore records, policies. The audit stays yours.
Which practice systems do you support?
Cliniko, Splose, Halaxy, Lumary and ShiftCare day to day — logins, roles, integrations with Microsoft 365, exports — and whatever else you run. When the problem is at the vendor's end, we deal with their desk.
Can you help us pass an audit?
We can't promise an outcome and we don't certify anyone. We can make sure the information-management answers are true and written down before the auditor asks — which is most of what the IT side of an audit is.
Do our therapists need managed laptops?
If they hold participant information, yes: encryption, MFA, remote wipe and updates you can prove. A personal laptop with a work login is the gap most practices have. Intune comes with Business Premium; phones enrol for work apps only, so personal photos stay private.
What about AI scribes?
Useful, and a privacy decision: a session recording is health information. Before adopting one, check where audio and transcripts are stored, whether they're used for training, and what participants consent to — then write it into the AI-use policy. We help with the choice and the policy.
Make the records the safe part
Tell us how your team works — the systems, the phones, the laptops — and we'll say in plain English what's solid and what isn't. Free, no obligation.
Book a free 15-minute chator call 0439 649 099 · email hello@tidewire.com.au