Compliance
Praxi is built to meet Australian healthcare regulatory requirements. Our current compliance posture across key frameworks and obligations.
Regulatory compliance overview
Current posture across Australian healthcare and information security frameworks.
Privacy Act 1988 (APPs)
Last reviewed: 2026-09-14
Our privacy programme includes Australian-hosted clinical records, encryption, access controls and clinical audit logging. Policies and access/correction procedures address the Australian Privacy Principles. Eligible data breaches are assessed under the NDB scheme and notified to the OAIC and affected customers as soon as practicable.
Essential Eight
Last reviewed: 2026-09-14
The Essential Eight informs access control, patching and backup work. We have not completed an independent maturity assessment and do not claim an assessed maturity level. Recovery testing is described on our status page.
Services Australia IA 2020 v2.1
Last reviewed: 2026-09-14
Medicare and DVA integration work is underway. Services Australia conformance and certification are required before production electronic claiming is available.
AHPRA Alignment (PsyBA 2025)
Last reviewed: 2026-09-02
Clinical note templates, the note-signing cadence, supervision and CPD tracking and registration reminders are built around the PsyBA Code of Conduct (2025) and Ahpra's advertising guidelines. Every AI-suggested action requires practitioner approval. Compliance with your Board's Code remains yours; Praxi is built so the software never gets in its way.
Medicare approval pending
Last reviewed: 2026-08-11
Medicare claiming integration built; conformance testing against the Services Australia vendor environment is underway. The NOI has not yet been lodged, so Medicare claiming is not yet certified for production use.
Data Sovereignty
Last reviewed: 2026-09-14
Core clinical records and clinical AI processing are hosted in Australia. Payment, messaging, support and optional integration services have their own data flows and locations, described in the Sub-processors register. Optional video providers a practice connects under its own account (Zoom, Coviu) are listed there too. Anti-bot verification is self-hosted (ALTCHA proof-of-work), with no third-party captcha service.
Compliance governance
Praxi's compliance programme is run by the founder, with annual policy reviews and automated control testing in CI.
- Continuous monitoring: automated compliance checks run as part of the CI/CD pipeline. Automated checks support our Services Australia integration work; they do not establish certification.
- Annual review cycle: all ISMS policies reviewed annually (next review: January 2027). Privacy Impact Assessments conducted for new features processing personal information.
- Incident response: documented IR procedures aligned to the Notifiable Data Breaches scheme: assess eligible breaches and notify the OAIC and affected customers as soon as practicable (taking all reasonable steps to complete the assessment within 30 days, s 26WH). Tabletop exercises run at least once a year; the first has not run yet and is due by 30 November 2026, before any practice goes live.
Last reviewed: 2026-09-02.
Security documentation
Our security whitepaper, ISMS policy index and Privacy Impact Assessment are available now. An independent penetration test is planned before our first paying customer; ask to be notified when the report is on file.