CISSP-QUALIFIED GOOGLE WORKSPACE AUDITS FOR HEALTHCARE & ALLIED HEALTH CLINICS
Patient Data Deserves More Than Default Security
Your clinic runs on trust — and on Google Workspace holding patient records, referrals and sensitive correspondence. Default settings weren't built to protect that. SecureMyEmail runs a specialist audit of your Workspace environment, checked against the CIS Google Workspace Benchmark and CISA SCuBA baselines, and hands you a plain-English report on exactly what to fix, in order of priority.
THE RISK YOU CAN'T SEE
A Single Phishing Email Could Expose Patient Records
Healthcare providers are targeted precisely because patient data is valuable and defences are often thin. A compromised login, a silent forwarding rule leaking referral letters, or a phishing email that slips past default filters can expose sensitive health information and create real compliance exposure under the Privacy Act. Most generalist IT providers manage uptime and support tickets — not dedicated security audits. If nobody has specifically checked your Google Workspace against a recognised security baseline, you don't actually know where you stand.
THE PROCESS
Four Steps From Enquiry To Answers
Submit your details
A few quick questions, no obligation — tell us your platform, rough user count, and what's prompting you to look into this now.
Neil confirms access
Neil Frick will call you within 1 business day to confirm access credentials and scope the right tier for your environment.
We run the audit
Using Workspace Audit, your Google Workspace environment is checked against the CIS Google Workspace Benchmark, CISA SCuBA Baselines and Cyber Essentials Plus — over 100 automated, read-only checks aligned with GDPR and FERPA data-handling principles, and encrypted in transit and at rest.
You get the report
A plain-English findings report, prioritised by risk, so you know exactly what to fix first — no jargon, no scare tactics.
IS THIS YOU?
Built For Clinics Without An In-House Security Team
- You're a healthcare or allied health clinic with 10–50 staff on Google Workspace
- You handle patient records, referrals, or other sensitive health information
- You don't have a dedicated in-house IT security specialist
- You want a clear, independent check — not another subscription to manage
Not for: Individuals wanting help with a personal Gmail account, or large enterprises with an existing in-house security team.
COMPLIANCE CONTEXT
What Clinics & Allied Health Practices Are Expected To Have In Place
Health information is the most sensitive category of personal information under Australian law, and the obligations apply to every practice regardless of turnover — including sole practitioners.
Privacy Act 1988 — health service providers
All health service providers are covered by the Privacy Act regardless of size, and health information attracts higher protection under APP 3 and APP 11 than ordinary personal information.
Notifiable Data Breaches scheme
Health is consistently the top-reporting sector to the OAIC, and compromised email accounts are one of the leading causes. Detection depends on audit logging and alerting being enabled.
My Health Records Act 2012
Practices connected to My Health Record must maintain a written security and access policy covering user authentication, access management and how staff use their accounts.
State health records legislation
HRIP Act (NSW), Health Records Act 2001 (Vic) and equivalents impose their own health privacy principles on top of the Commonwealth regime.
RACGP information security standards
Accredited general practices are assessed against RACGP's Information Security in General Practice guidance, which covers access control, authentication and audit logs.
General information about obligations commonly relevant to Australian businesses in this sector — not legal advice. The audit reports on how your email and collaboration environment is configured against recognised security baselines; it does not certify you as compliant with any of these frameworks, and your own obligations depend on your size, structure and services.
WHO'S BEHIND THE AUDIT
No Client Case Studies Yet — Full Transparency Instead
As a new service, we don't have client testimonials yet — but every audit is run personally by Neil Frick, a CISSP-qualified auditor with over 40 years in Information Technology, using the same tools and baselines trusted by security-focused MSPs across Australia. His background includes work in highly secure environments, with military clearance to Top Secret level. We'd rather tell you that plainly than invent a review that isn't real.
THE PERSON DOING THE WORK
Meet Neil Frick
I've spent over 40 years in Information Technology, including time in highly secure environments with military clearance to Top Secret level. I'm CISSP-qualified, and I founded SecureMyEmail because too many small and mid-sized Australian businesses assume their generalist IT provider is “handling security” — when in reality, nobody has run a dedicated audit against a recognised baseline. Every audit that goes out under this business has been run personally by me, using the same tools and standards trusted by security-focused MSPs. No jargon, no scare tactics — just a clear report on where you stand.
— Neil Frick, Founder, SecureMyEmail
THE DETAILS
Straightforward Pricing, No Ongoing Contract
This is a point-in-time audit, not an ongoing managed security service. Pricing is based on user count. Pay online now to lock in your slot, or answer a few quick questions and Neil will call you before you commit.
Starter
Up to 10 users
$99
Full audit of Google Workspace or Microsoft 365, mapped to CIS, NIST and CISA SCuBA baselines, plus a plain-English findings report.
Growth
Up to 25 users
$199
Same full audit scope as Starter, priced for larger teams.
Enterprise
25+ users
Request a quote
Custom-scoped audit for larger environments.
Email Us For A Quote →COMMON QUESTIONS
Before You Enquire
It's a point-in-time audit — a deep, specialist check of your environment against recognised security baselines, delivered as a plain-English report. It's not a subscription and there's no ongoing contract.
One audit. One plain-English report. Every gap accounted for.
It takes one enquiry to get started, and one call with Neil to confirm access and scope. No lock-in, no jargon, no guesswork about where your business actually stands.
Run personally by Neil Frick, CISSP-qualified — SecureMyEmail