The business of general practice, daily

No new Australian GP practice acquisition has reached the ACCC register since Partnered Health's own 3 July Ryan Plaza notification. Checked directly on the register this morning, the only general practice matter under the mandatory merger regime is still PH Medical Centres' proposed acquisition of Ryan Plaza Medical Services (MN-15027), which operates the Medicine on Second clinic at Maroochydore, an 11-GP practice. It remains at Phase 1 initial assessment, under assessment, effective 3 July, with submissions concluded and no determination published. A Phase 1 decision was expected in the second half of July: nine days of the month remain and nothing has been published, while the determination period itself runs to 14 August. The expectation is the Zoo's own, set out in the 10 July and 14 July editions, not a timetable the ACCC has published. The notification describes the acquiring PH Primary Care Group as 67 general practice clinics and medical centres engaging about 570 GPs, majority owned by Quadrant Private Equity through QPE Fund 6, which is the figure to hold for group size against the looser trade descriptions of 60 plus or 68 clinics.

The Bupa-Partnered Health parent transaction, reported by AFR Street Talk on 18 June at about $450m, has still not surfaced as a separate notification, so the ACCC and Foreign Investment Review Board approvals the Bupa deal needs remain outstanding. The data breach at Partnered Health still sits over that acquisition and there was no new development in it today. The position is as set out on Monday: 21 named clinics across New South Wales, Victoria, Queensland, Western Australia and the Australian Capital Territory; Medicare numbers, private health insurance and Veteran Card (DVA) numbers, concession card numbers and clinical records among the information at risk where a clinic held them; an interim injunction from the Supreme Court of New South Wales restraining use or publication of the accessed data; and the patient-management software vendor Best Practice cleared, confirming Partnered Health as a customer but saying its platform was not compromised. No OAIC outcome has been published, and neither Bupa nor Partnered Health has said publicly whether the breach engages any contractual provision in the acquisition agreement. For the buyer this stays a diligence and regulatory-exposure question at the target rather than a change to deal timing.

In New Zealand the comparator holds its date. Green Cross Health shareholders approved the NZD 270m sale of The Doctors, the country's largest GP network at around 65 clinics, to Tend Health at the Auckland annual meeting on 14 July, and completion is targeted by 31 July. The NZX announcements for GXH carry nothing on completion as at 22 July; the most recent filings are the 15 July director and officer disclosure and the 14 July meeting results. Green Cross is not a buyer in the Australian market and has given no public indication that it intends to become one.

A second Australian practice has disclosed a data breach in the space of a week. GO2 Health, at Everton Park in Brisbane's north, told the ABC that its main email mailbox was accessed in April following a phishing attack. The clinic provides general practice and veteran care. A spokesperson said experts were engaged to contain the breach and that patients who use the mailbox were alerted on 24 April. The Office of the Australian Information Commissioner was notified on 18 May. Affected patients were not emailed until 16 July, which the ABC puts at almost three months after the event.

On what was reached, the clinic said its investigation found data within the mailbox may have been accessed, including some patients' Department of Veterans' Affairs ID numbers and other information patients had provided to the inbox. It said there was no access to the system where it primarily stores patient information, and that the mailbox auto-archives, so the exposure covers emails from the preceding 12 months. On the delay, the spokesperson said it took nearly three months to identify which patients were affected, and that the clinic wanted to avoid causing undue concern by notifying the wrong people or communicating inaccurate information.

The business point is the notification clock, not the intrusion. A practice must tell the OAIC within 30 days where it believes a breach is likely to result in serious harm, and that obligation runs to the regulator. The gap between telling the regulator on 18 May and telling patients on 16 July is where the argument now sits, and the ABC reports experts calling for practices to be required to notify patients earlier in the investigation, given what clinics hold. For an owner the exposure is not confined to the clinical system. An ordinary reception inbox, auto-archiving a year of what patients send it, is itself a notifiable asset, and on this account it was the only thing that had to be breached.