CPD PDSA guide
A structured PDSA cycle guide to assess and improve cybersecurity posture in your GP practice. Maps directly to ePIP requirements 1, 2 and 5.
Cybersecurity is now a core operational requirement for every general practice. Patient health records, Medicare billing data and practice financial systems are high-value targets. The Australian Cyber Security Centre reports that healthcare is among the most targeted sectors, and small to medium practices are particularly exposed because they typically lack dedicated IT security resources.
This guide takes your practice team through a complete PDSA cycle focused on cybersecurity. It covers risk assessment, staff awareness training, incident response planning and policy development. The worked example shows how a real practice identified and closed its most significant gaps over a 12-week period.
The guide aligns with the ePIP (eHealth Practice Incentives Program) and maps directly to requirements 1, 2 and 5. Completing the full cycle can contribute up to 40 CPD hours across Educational Activities, Reviewing Performance and Measuring Outcomes categories.
Identify vulnerabilities across your practice systems including clinical software, email, remote access, backup processes and physical device security. Includes a structured risk register template.
Build a staff awareness program covering phishing recognition, password management, secure data handling and incident reporting. Includes session plans and assessment checklists.
Develop a cybersecurity policy and incident response plan tailored to general practice. Covers data breach notification obligations under the Notifiable Data Breaches scheme.
Completing the full PDSA cycle on cybersecurity can contribute approximately 9 CPD hours. The breakdown below shows how hours are allocated across RACGP CPD categories.
Research into cybersecurity frameworks, ePIP requirements and best-practice guidance for healthcare settings. Includes reading, webinars and vendor briefings.
Audit of current practice cybersecurity controls against the risk register. Gap analysis and benchmarking against ePIP compliance requirements.
Implementation of the improvement plan, post-cycle reassessment and documentation of changes. This is the core PDSA measurement stage.
Risk assessment and gap analysis
Staff awareness and training program
Incident response and breach notification
Policy development and documentation
ePIP alignment and compliance mapping
This PDSA guide is free for Australian GP practices.