How much does IT support cost for a medical practice in Australia?

Managed IT support for an Australian medical practice is normally priced per user, per month. Our published plans run from $79 to $199 per user per month with a minimum of five users. The main thing that moves the number is how much of the Essential Eight cyber security framework is built in, not the size of your practice.

We publish these numbers deliberately. Practice owners comparing IT providers usually cannot get a straight number without sitting through a sales meeting first. We would rather you had the number now, and the meeting only if it makes sense.

The four plans map to security maturity. Sentinel, at $79 per user per month, delivers Essential Eight foundations through Microsoft 365 licensing. That is useful groundwork, but it is not full Maturity Level 1, and any provider who implies otherwise about an equivalent plan is overselling it. Fortress, at $139, delivers complete Essential Eight Maturity Level 1, which we consider the sensible floor for a business holding patient records. Knox, at $179, reaches Maturity Level 2, and Titan, at $199, reaches Maturity Level 3.

Whatever the tier, the day-to-day substance should look the same: a service desk your practice manager can actually reach, monitoring that notices problems before reception does, patching applied out of hours, backup jobs checked rather than assumed, and someone who deals with your software vendors when a fault sits between two systems. The tier changes how many security controls sit on top of that work; it should never change whether the phone gets answered. In a medical practice it also means knowing what a pathology downloader is and why it matters, because generic support runs out of depth exactly where clinics need it most.

Beyond the tier, a few things move the price in any provider's quote. On-site servers cost more to support than cloud systems, and for a general practice the biggest structural choice is exactly that: a Best Practice or MedicalDirector server in the storeroom needs more care than a cloud-hosted equivalent. Multiple sites cost more than one. Practices needing after-hours coverage, deeper compliance work or formal reporting pay more than those that do not. And the count itself matters: a user is a person who logs in, so a practice with twelve staff sharing eight logins pays for the people, not the machines. Ask any provider to define the unit they are charging for.

Also check what sits outside the monthly fee. Clinical software licences, such as your Best Practice or MedicalDirector subscription, are vendor fees, not IT support. Hardware is bought, not bundled, in most arrangements. One-off projects, such as a server migration or a new fit-out, are usually scoped separately. None of that is a trick; it only becomes one when a quote hides it. A good quote lists the exclusions plainly; a poor one lets you discover them.

When you compare quotes, force them onto one page: the same user count, the same named security controls, the same list of exclusions. Per-user pricing only helps you if the units are the same. Two quotes forty dollars apart usually differ by what one of them left out, and the Essential Eight gives you a neutral, government-published checklist for finding it.

Is the spend worth it? The Australian Signals Directorate puts the average cost of a cybercrime incident for an Australian business at $58,666, which is roughly seven years of Fortress cover for a five-user practice. We will say that once and leave it there, because the more useful point is about control: prevention is a known, budgetable line item, and an incident never is.

The honest caveat: the dearest plan is not automatically the right one. A small practice with no on-site servers, no contract-driven compliance load and a simple software stack does not need Maturity Level 3, and a provider who insists it does is selling, not advising. Equally, if a competitor quotes less than our floor, ask precisely which Essential Eight controls are included. A lower number that quietly omits tested backups or application control is not a cheaper version of the same product; it is a different product.

If you want to know where your practice stands before spending anything, our Essential Eight Cyber Security Scorecard is free, or call us on 1800 456 567.