The cycle audits what the practice can control without an IT contractor: who holds which logins, what happens when staff leave, whether backups restore, and how the team handles suspicious email. Each round of the audit closes one gap and documents it.
Information security is part of the RACGP Standards your accreditation assessor works from, and the completed cycle doubles as evidence that the practice reviews its security systematically.
The guide maps directly to ePIP requirements 1, 2 and 5. The worked example shows a practice identifying and closing its most significant gaps over a 12-week period.
Vulnerabilities across clinical software, email, remote access, backup processes and physical device security, recorded in a structured risk register.
A whole-team awareness program: phishing recognition, password management, secure data handling and incident reporting, with session plans and assessment checklists.
A cybersecurity policy and incident response plan written for general practice, covering breach notification obligations under the Notifiable Data Breaches scheme.
Up to 9 hours per participating GP when submitted as a practice-based or group activity: 3 hours educational activities, 3 hours reviewing performance, 3 hours measuring outcomes. Nurses record their participation toward the NMBA 20-hour requirement. A certified practice manager can claim the coordination work as professional development, on AAPM's conditions. The completed workbook is the supporting evidence.
CPD figures verified against the guide and the CPD home handbooks, 15 July 2026.
Type into it as you go; saves on your computer
Read online, print to PDF for your records
A4 PDF for printing or your records