IT Support for Medical Practices in NZ

Your practice manager just got a phishing email asking for staff W2s. Your practice management system was down for 40 minutes on Tuesday. The Privacy Commissioner is asking for a copy of your health information privacy statement. And you’re due for practice accreditation renewal in six months.

Healthcare IT is different. Not more complex than every other industry — different. Patient data lives under the Health Information Privacy Code (HIPC), your practice management system IS the business, unplanned downtime turns into cancelled appointments, and your professional obligations put you on the hook for how well you protect it all.

We look after general practices, specialist clinics, allied health providers, and aged-care operators across New Zealand. Here’s what IT support built for a healthcare business actually looks like.

The four IT problems every NZ medical practice hits

1. Practice management system uptime

MedTech, Indici, myPractice, Profile, Best Practice — whichever platform you’re on, it IS your business. When it’s down, receptionists can’t check people in, nurses can’t retrieve notes, and prescriptions don’t print. Even 20 minutes at 9am can turn into 30 cancelled bookings.

We wrap the underlying environment — Microsoft 365, the local server if there is one, the internet connection, the network — in monitoring that alerts us before staff notice. Backups running properly, patches applied without breaking things, redundant internet at the front desk. When something does fail, the aim is minutes not hours.

2. Patient data under the Health Information Privacy Code

The HIPC (Health Information Privacy Code 2020) sets the rules for handling patient information — collection, storage, access, correction, and breach reporting. The Privacy Commissioner takes it seriously; a preventable breach is a public matter.

What we handle as part of managed support:

• Data classification & access — patient data on M365 & SharePoint locked to the people who genuinely need it, not everyone
• Encryption at rest & in transit — full-disk encryption on every laptop, TLS everywhere, encrypted email options for sensitive referrals
• Named-user accounts only — no shared logins, so access logs actually show who saw what
• Immutable backups — ransomware can’t encrypt what it can’t reach
• Breach detection & response — managed EDR (endpoint detection & response) that flags suspicious behaviour early enough to matter

3. Mobile access for doctors, nurses & visiting staff

Doctors work between rooms, consult rooms, home & sometimes the hospital. Nurses cover multiple practices in a network. Locums come & go. Each device that touches patient records is a small risk unless it’s managed.

We roll out Microsoft Intune (mobile device management) across the fleet so that a lost laptop or phone gets remotely wiped in minutes, personal & work data are kept separate on BYOD devices, and when a locum’s engagement ends their access disappears the same day. Named accounts, per-device controls, no shared logins.

4. Cyber certification for insurance, boards & supply chain

Cyber insurance for healthcare is getting stricter every renewal. Boards & owners are asking for evidence — not promises — that the practice is running proper controls. Larger networks & PHOs (Primary Health Organisations) are starting to ask about your security posture before bringing you into shared workflows.

The answer that fits all three is SMB1001 — the cyber security certification standard built for SMBs in Australia & New Zealand. Gold (Level 3) is the tier most medical practices land on, and its 27 controls line up neatly with what a good practice already needs to do. Our LiveSecure Gold service takes you from “we’re not sure” to certified in three to six months. Read what SMB1001 Gold is, or take the free 2-minute readiness check.

What LiveSupport looks like for a medical practice

Our managed IT support (LiveSupport) is a fixed monthly cost per user + per device. What you get for it:

• A senior local team — real people who understand practice-management systems, not a call centre reading a script
• Every device managed, monitored & patched automatically — reception PCs, clinical laptops, tablets, iPads for the nurses
• Managed endpoint security (EDR + Microsoft Defender + Huntress) watching 24/7 for the things that matter
• Microsoft 365 configured for healthcare — sharing controls that stop patient data from leaking, email authentication that stops spoofed referrals, secure external sharing when you genuinely need it
• Backups you can actually restore from — including for the practice management database — tested every 90 days
• Redundant internet & wifi — cellular failover for the front desk so a Chorus outage doesn’t stop bookings
• Regular reporting — evidence of controls for accreditation, insurance renewals & board meetings

A real story (anonymised)

A five-doctor general practice in the North Island called us on a Monday. Their receptionist had clicked a “shared document” link in an email that morning, entered her Microsoft 365 password, and by midday attackers had used her account to send out 400 phishing emails to patients & referrers. The practice manager only spotted it when patients started ringing.

Two hours in, we had the compromised account locked, all sessions forcibly signed out, MFA properly enforced (it had been optional up till then), and every mailbox scanned for auto-forwarding rules the attackers had set up. By the end of day two we’d rolled out managed EDR, tightened M365 sharing settings, and started them on the SMB1001 Silver pathway.

They’re on Gold now. And their insurance premium at the next renewal was 18% lower than the previous year.

Frequently asked questions

Do you work with general practices, specialist clinics or both?

Both. General practices (single-site & small networks), specialist clinics (dermatology, dentistry, physio, mental health, and more), and allied-health providers. The IT foundations are similar; the practice-management system on top varies.

Are you familiar with MedTech / Indici / myPractice / Best Practice?

Yes. We manage the underlying environment (Windows, Microsoft 365, network, backup, security) that these platforms sit on. For deep platform-vendor tickets we work alongside the software vendor’s support team.

How do you handle the Health Information Privacy Code?

By treating patient data as high-classification from day one — encryption, access controls, named accounts, audit logging, monitored backups, and a written incident-response plan that meets the Privacy Commissioner’s notification expectations. We help you evidence it for accreditation & insurance.

What does managed IT actually cost for a medical practice?

Fixed monthly cost per user + per device. Most NZ practices in the 8 to 40-user range land between $95 and $170 per user per month, depending on plan tier & device count. We quote fixed & upfront after a free scoping call.

Can you help with our accreditation IT evidence?

Yes. Most of the IT-related evidence for practice accreditation — backup testing, security controls, incident response, staff training, access reviews — comes out of our LiveSupport & LiveSecure reporting. We’ll pull it together in the format your accreditor wants.

What if our practice management system goes down?

Depends where the problem is. If it’s on our side of the fence (server, network, M365), we’re on it before staff report it. If it’s the vendor’s platform, we escalate to them, keep pressure on the ticket, and help stand up whatever paper-based workaround you need until it’s back.

Can we co-manage — we have someone in-house already?

Yes. Roughly a third of our client base runs co-managed — an in-house IT person or PHO shared resource, with IT Live adding security depth, out-of-hours cover, and specialist tooling. We fit around what you have.

How do we start?

Free scoping call. We look at your current IT setup, your practice management system, what’s causing pain, and where the risks are — then send you a written recommendation and a fixed monthly quote. No obligation.

---

Talk to us about IT for your medical practice

Nice & simple: one number to call when the network drops or an email looks off. One relationship for support, security, backup & strategy. Local team who understand the practice-management system your day runs on.

→ Book a free scoping call or ring 09 280 1780.

Not healthcare? See the industries we specialise in.