Your patients trust you with their health. We make sure your IT never breaks that trust.

Yes, with an important distinction. Clinical software platforms like Medtech, Best Practice, and Gensolve have their own support teams and SLAs. ITstuffed is not the software vendor, and we won't pretend to be experts inside those systems. What we do is act as your IT partner in those conversations. Clinics with support agreements get faster resolution when their IT provider can communicate directly with the software vendor on their behalf, translating the technical environment, providing context about the clinic's setup, and making sure the right information gets to the right people quickly. Most practices find that issues get resolved significantly faster when we're in the room, so to speak, than when a practice manager is trying to bridge two technical conversations alone. Think of it as translating between two different languages: yours and theirs. We make sure nothing gets lost.

ACC expects its contracted providers to meet certain standards around the privacy and security of client information. A breach that is mishandled - or where basic security controls were clearly absent - can trigger a review of your provider status. This isn't a theoretical risk: the NZ Privacy Act now requires mandatory breach notification to the Privacy Commissioner in many cases, and that notification becomes part of a public record.

The best protection for your ACC contract is being able to demonstrate that you had appropriate controls in place and responded properly. That's exactly what ITstuffed helps you put in place - and document.

MFA is an important control, but it is not a complete solution on its own - and attackers know how to get around it. One increasingly common method is session token harvesting: a staff member receives a convincing phishing email, clicks a link, and enters their credentials on a fake login page. That page captures their live session token in real time, bypassing MFA entirely.

We have worked with a Christchurch healthcare practice where this happened. They had MFA in place. They still experienced a breach that spread to multiple accounts and triggered a Privacy Commissioner notification. Effective protection requires layered security - email filtering to stop the phishing email reaching the inbox, DNS filtering to block the malicious site even if clicked, endpoint detection to catch unusual behaviour, and identity threat monitoring to flag anomalous logins. MFA is one layer. It shouldn't be the only one.

Under the Privacy Act 2020, organisations that hold personal information - including health information - must take reasonable steps to protect it from unauthorised access, use, or disclosure. Healthcare information is treated as particularly sensitive. If a breach occurs that has caused, or is likely to cause, serious harm, you are legally required to notify both the affected individuals and the Privacy Commissioner. Failing to notify when required is a breach of the Act in itself.

Beyond the legal minimum, good practice means knowing what data you hold, where it lives, who can access it, and what your response plan looks like if something goes wrong. If you are unsure whether your current setup meets these obligations, an IT Fit Check is a good place to start.

We have formal SLAs in place for all managed services clients. Every support request is logged, triaged on receipt, and assigned a priority. Response times are guaranteed based on that priority: Critical (systems down, active security incident) 1 hour; High (significant impact on operations) 2 hours; Normal (single user affected, workaround available) 4 hours; Low (general queries, minor issues) 8 hours. In practice, most urgent calls are picked up within 15 minutes. Critical issues are not sitting in a queue. They are flagged immediately and handled first. You will always know the status of your request.