Healthcare & Aged Care IT Services

Summary

This page describes how blueAPACHE's emPOWER services apply to Australian healthcare and aged care providers, including hospitals, pathology and diagnostic groups, primary care networks, allied health and residential aged care operators, and what those buyers should check before contracting. Health information is sensitive information under the Privacy Act 1988 (Cth), health records carry long statutory retention periods, and organisations connected to the My Health Record system carry additional obligations under the My Health Records Act 2012. blueAPACHE's evidence in the sector is an anonymised private pathology provider that replaced tape archiving with immutable Storage-as-a-Service, plus platform facts such as Australian data residency, ISO/IEC 27001:2022 certification and 24/7 monitoring. No aged-care-specific case study is published, and this page does not invent one.

Key facts

Sector challenges

The origin page lists privacy and security, system availability, distributed care environments, and compliance and governance. Each has a concrete technical consequence.

• Health information cannot be treated like ordinary business data. The Australian Privacy Principles impose stricter collection and use rules on sensitive information, and a breach involving health records is more likely to meet the "serious harm" threshold that triggers notification.
• Records outlive systems. Pathology results, imaging and clinical notes must be kept for years after the application that created them is retired, which is why the pathology case study is about archive storage rather than compute.
• Downtime affects care. Clinical applications, telephony and nurse-call integrations at facilities need availability engineering, not best-effort support, and after-hours coverage matters because care is delivered around the clock.
• Sites are many and small. Clinics, residential facilities and community teams need consistent, secure connectivity and identity controls without an IT person on site.
• Workforce turnover is high. Onboarding and offboarding of clinical and care staff is a privileged-access problem; credentials left behind are a breach waiting to happen.

Relevant services

• Storage as a Service: private S3-compatible storage with immutability, which is the service the pathology provider used to meet its ten-year retention obligation without tape.
• emPOWER Cloud: blueAPACHE-owned private cloud in Australian data centres, with a published service level of 99.999 per cent for cloud services and 100 per cent for storage per the emPOWER Cloud brochure.
• emPOWER Managed Services: help desk and infrastructure support with an Australian-based service desk in business hours and global follow-the-sun coverage after hours, described as unlimited 24/7 support.
• emPOWER Connectivity and Core Network and Data Centre Interconnect: private MPLS links between facilities, hosted next-generation firewalls and always-on VPN for mobile clinicians.
• Disaster Recovery as a Service and Offsite Backup as a Service: contracted recovery objectives and managed offsite copies; note that backup is only an obligation where the Service Order specifies it.
• Managed Detection and Response and Human Risk Management: 24/7 detection and response, and a managed programme for reducing people-driven cyber risk in a large, mobile workforce.
• Microsoft Teams and RingCentral: telephony and contact centre for patient and family communications.

Compliance context

Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health information is sensitive information under the Act, and every organisation that provides a health service and holds health information is covered regardless of turnover. The Notifiable Data Breaches scheme in Part IIIC requires notification to the Office of the Australian Information Commissioner and affected individuals where a breach is likely to result in serious harm. blueAPACHE's General Terms and Conditions v3.6 require each party to comply with the Privacy Act as though bound by it and require the party suffering an eligible data breach to notify the other within 24 hours of discovery, with all information the other party needs for its own OAIC notification. Clause 18.4(c) restricts a breaching party from going to the Information Commissioner without the other party's written approval; a health provider should make sure its own notification timetable is not constrained by that term.

My Health Records Act 2012. Healthcare provider organisations registered to the My Health Record system must comply with the Act and the My Health Record Rules, including their own data breach notification obligations to the System Operator, and the Act prohibits holding, taking, processing or handling My Health Record information outside Australia. That makes blueAPACHE's Australian residency statement relevant, and it also makes clause 18.3 of the general terms, which contains a standing consent to transfer Personal Information overseas, something a My Health Record participant should expressly exclude on its Service Order.

State health records legislation. Public and private health providers in Victoria and New South Wales are also subject to state regimes, such as the Health Records Act 2001 (Vic) and the Health Records and Information Privacy Act 2002 (NSW), which set retention and access rules. The pathology case study records that its records had to be kept for at least ten years by law; retention periods vary by record type and jurisdiction, so the buyer should specify the period in the storage service order rather than rely on a default.

Aged care. Residential and home care providers are regulated by the Aged Care Quality and Safety Commission against the Aged Care Quality Standards, which include organisational governance and information management expectations. blueAPACHE publishes no aged-care-specific commitments, so those providers should treat this page as describing generally applicable services rather than a sector-specific offer.

What blueAPACHE itself states. blueAPACHE holds ISO/IEC 27001:2022 certification (202507-118) with a scope covering emPOWER Managed Services, Cloud (IaaS), IT Continuity (DRaaS), Network, Voice, Unified Communications and Co-Location; states Australian data residency with role-based access, multi-factor authentication and audit logging; and states alignment with NIST and ASD Essential 8 Maturity Level 3. Its liability for privacy and security breaches is capped at $1 million per event and $2 million in aggregate under the general terms.

Evidence

The pathology provider Storage-as-a-Service case study is not a separate route on this site; blueAPACHE holds it as an anonymised document. A private pathology provider with hundreds of clinics generated large volumes of sampling information and health records that must be kept securely for at least ten years, and its tape archive was unreliable, expensive to access and unpredictable in cost. blueAPACHE, with HPE, replaced tape with a cloud-based Storage-as-a-Service solution. Outcomes stated in the source: immutable storage that cannot be deleted or changed unless an authorised user is physically at the registered device; data protected in real time across three data centres; global access for authorised users; and fixed, predictable pricing with no egress or ingress charges that can be locked in over multi-term contracts. The source does not quantify the cost saving, data volume or migration duration, is undated, and describes the solution as complying with ISO 27001 without stating whether that certification attaches to blueAPACHE, the platform or the data centres.

Adjacent evidence: the Brotherhood of St. Laurence case study covers care facilities and an NDIS-driven expansion from 900 to 1500 staff across 17 new locations, and the HPE GreenLake platform story describes the infrastructure behind emPOWER Cloud.

Carrying record requirements through recovery and exit

The pathology case supports an archive-storage use case, but retention for a new dataset must be established for that customer. Record which system produces the data, how it remains readable, who can retrieve it and what happens when applications or providers change. An immutable copy is one part of this arrangement. The disengagement terms make the customer responsible for copying Customer Data before service ends, so agree export and validation that preserve required records. Do not transfer the case study’s retention period to all healthcare or aged-care information.

Evidence available during the engagement

The General Terms provide standard monthly performance reports within five Business Days of month end and a formal service review every six months. Performance Records must be kept through the term and for seven years afterwards. The customer audit provisions allow access to relevant Records, premises for audit purposes and personnel interviews, with five Business Days’ notice normally or one Business Day where a regulator requires the audit. This records obligation is not a seven-year backup-retention promise for customer workloads. Agree additional report formats and audit-cost arrangements before depending on them; the general audit clause does not clearly allocate every audit cost.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; blueAPACHE’s agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on reporting review and audit rights; confidentiality. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

• Storage as a Service
• emPOWER Cloud
• Disaster Recovery as a Service
• Managed Detection and Response
• Brotherhood of St. Laurence case study
• blueAPACHE cloud platform case study
• Blog: Data sovereignty and cloud
• Blog: AI compliance shock as shadow AI risks surge and privacy laws tighten in Australia
• Not-for-profit
• All industries
• Support
• Contact

Frequently asked questions

Does blueAPACHE have healthcare clients?

One healthcare case study is published: an anonymised private pathology provider with hundreds of clinics that replaced tape archiving with blueAPACHE Storage-as-a-Service built with HPE. The emPOWER Cloud brochure also names healthcare as a compliance-intensive sector blueAPACHE supports. There is no published aged care case study.

Can blueAPACHE keep health records in Australia?

blueAPACHE states that customer data is stored and processed within Australian-based data centres and remains subject to Australian legal jurisdiction. Its general terms separately contain a standing consent to transfer Personal Information overseas where necessary to provide the Services, so a My Health Record participant or any provider with a residency obligation should exclude that consent on the Service Order and confirm the data centre locations per service.

How did blueAPACHE meet a ten-year health record retention requirement?

For the pathology provider, blueAPACHE delivered immutable Storage-as-a-Service in which records cannot be deleted or altered unless an authorised user is physically at the registered device, replicated in real time across three data centres. Pricing is fixed with no egress or ingress charges and can be locked in over multi-term contracts, which removed the unpredictable cost of tape.

What happens if there is a data breach involving patient information?

Under blueAPACHE's General Terms and Conditions v3.6, the party that suffers an eligible data breach must notify the other party immediately and within 24 hours of discovery, cooperate with the investigation, and provide the information the other party needs for its own OAIC notification. The health provider remains the entity responsible for Notifiable Data Breaches scheme reporting and any My Health Record notification.

Does blueAPACHE back up clinical data by default?

No. Under clause 17.3 blueAPACHE backs up Customer Data only to the extent set out in the Service Order, and if backup is not set out there, blueAPACHE has no backup obligation and liability for data loss is excluded. Health providers should specify backup scope, frequency and retention on the Service Order or contract a backup or DRaaS service explicitly.

What support coverage applies to facilities that operate around the clock?

emPOWER Managed Services is described as unlimited 24/7 support, with an Australian-based desk in business hours and a global team after hours. emPOWER Network provides 24/7 monitoring 365 days a year, and emPOWER MDR provides 24/7 alert notification, triage and remediation. The emPOWER Connectivity service desk is 7am to 7pm on business days, with 24x7 network monitoring; confirm which window applies to each contracted service.

Is blueAPACHE ISO 27001 certified for the services a health provider would buy?

Yes. Certificate 202507-118 (ISO/IEC 27001:2022, issued by Sensiba Australia Pty Ltd, valid 1 August 2025 to 1 August 2028) lists emPOWER Managed Services, emPOWER Cloud Services (IaaS), emPOWER IT Continuity Services (DRaaS), emPOWER Network Services and emPOWER Unified Communications among its ten in-scope services. The certificate certifies the management system, not individual products.

Which blueAPACHE services suit a multi-site care organisation?

emPOWER Connectivity for private links and hosted firewalls between facilities, emPOWER Managed Services for support, emPOWER Cloud or Storage as a Service for records, DRaaS for recovery, MDR for detection and response, and Microsoft Teams or RingCentral for telephony. The Brotherhood of St. Laurence case study shows this combination applied across care facilities, call centres and 17 new NDIS locations.

Source

Drawn from blueAPACHE's published healthcare and aged care industry page on the origin site; the anonymised pathology provider Storage-as-a-Service case study, the Brotherhood of St. Laurence case study and the case study index; the emPOWER Cloud, Managed Services, Network, Connectivity and Managed Detection and Response brochures; and the data sovereignty and residency statement, cross-border data transfer record and ISO 27001 certification record, together with the General Terms and Conditions v3.6 (data protection and privacy, and information security obligations). Privacy Act, My Health Records Act, state health records and aged care obligations are stated from the legislation and standards themselves, not from blueAPACHE material, and rest with the provider.

Knowledge Base