Two items today. On the register, nothing has moved: no new Australian GP practice acquisition has reached the ACCC register since Partnered Health's own 3 July Ryan Plaza notification (MN-15027), re-checked directly this morning: still at Phase 1 initial assessment, effective 3 July, submissions concluded and no determination published. The decision the Zoo expected in the second half of July has not appeared with eight days of the month to run, and the determination period itself runs to 14 August. The Bupa-Partnered Health parent transaction is still absent as a separate notification, and the Foreign Investment Review Board approval that deal needs is also outstanding. Green Cross Health's NZD 270m sale of The Doctors to Tend Health holds its 31 July completion target, with no completion notice on the NZX as at today. The second item is Medius analysis of the current run of practice breaches and whether any of it changes how buyers evaluate a practice. On the public record in this market, not yet. The exposure itself was decided in court last October, in the Australian Clinical Labs penalty: it runs to the acquirer rather than the seller, and single-practice diligence here does not test for it.
No new Australian GP practice acquisition has reached the ACCC register since Partnered Health's own 3 July Ryan Plaza notification. Checked directly on the register this morning, the only general practice matter under the mandatory merger regime is still PH Medical Centres' proposed acquisition of Ryan Plaza Medical Services (MN-15027), which operates the Medicine on Second clinic at Maroochydore, an 11-GP practice. It remains at Phase 1 initial assessment, under assessment, effective 3 July, with submissions closed on 10 July and no determination published. Eight days of the month remain. The second-half-of-July expectation is the Zoo's own, set out in the 10 July and 14 July editions, not a timetable the ACCC has published, so it is our flag that is late rather than the regulator: the statutory determination period runs to 14 August. The notification describes the acquiring PH Primary Care Group as 67 general practice clinics and medical centres engaging about 570 GPs, majority owned by Quadrant Private Equity through QPE Fund 6, which is the figure to hold for group size against the looser trade descriptions of 60 plus or 68 clinics.
The Bupa-Partnered Health parent transaction, reported by AFR Street Talk on 18 June at about $450m, has still not surfaced as a separate notification, so the ACCC and Foreign Investment Review Board approvals the Bupa deal needs remain outstanding. The data breach at Partnered Health still sits over that acquisition and there was no new development in it today: no OAIC outcome has been published, and no new external coverage has emerged since the reporting of 15 to 17 July. The position is as set out on Monday last week: 21 named clinics across New South Wales, Victoria, Queensland, Western Australia and the Australian Capital Territory; Medicare numbers, private health insurance and Veteran Card (DVA) numbers, concession card numbers and clinical records among the information at risk where a clinic held them; an interim injunction from the Supreme Court of New South Wales restraining use or publication of the accessed data; and the patient-management software vendor Best Practice cleared. Neither Bupa nor Partnered Health has said publicly whether the breach engages any contractual provision in the acquisition agreement. Bupa's only timing marker remains settlement 'later this year', the wording of The Medical Republic on 16 July rather than a quoted Bupa commitment.
In New Zealand the comparator holds its date. Green Cross Health shareholders approved the NZD 270m sale of The Doctors, the country's largest GP network at around 65 clinics, to Tend Health at the Auckland annual meeting on 14 July, and completion is targeted by 31 July. No completion notice appears on the NZX for GXH as at today, eight days out. Green Cross is not a buyer in the Australian market and has given no public indication that it intends to become one.
Three GP practice operators have disclosed data incidents since mid-June: Ochre Health, Partnered Health and GO2 Health. No Australian buyer, broker or adviser has published a repricing, a new condition or a withdrawn offer tied to any of them, and neither Bupa nor Partnered Health has said whether the breach at Partnered Health engages any provision of their acquisition agreement. Nothing visible in this market has yet changed how a practice is priced or bought. That is a different thing from the exposure being small. No buyer here has been made to price it.
The exposure was decided in court last October. On 8 October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8m, the first civil penalty under the Privacy Act: $4.2m for failing to take reasonable steps to protect personal information, $800,000 for failing to assess the breach reasonably and expeditiously, and $800,000 for failing to notify the regulator promptly. The breach was at Medlab Pathology in February 2022. Australian Clinical Labs had bought Medlab's assets in December 2021, about two months earlier. More than 223,000 people had their information taken. The Privacy Commissioner, Carly Kind, described the outcome as 'an important turning point in the enforcement of privacy law in Australia'.
The liability fell on the acquirer, for the state of a business it had owned for about three months. Named firms reading the judgment (Corrs Chambers Westgarth, Ashurst, Lavan, Carroll & O'Dea) make the same point about the diligence: the technical enquiry did not go far beyond an IT questionnaire, and that was held insufficient given the sensitivity of the data the target held. A practice sale transfers the patient data and the condition it was kept in, alongside the billings, the lease and the roster. Diligence that prices the first three and not the last leaves the data exposure with the buyer.
A change in evaluation would show up as contract terms: penetration testing or a vulnerability assessment as a pre-completion condition, cyber warranties and a specific indemnity written into the contract of sale rather than left to the general warranties, part of the price held in escrow against a breach found after completion, or a move by insurers on cyber cover for practices. None of that is observable in the Australian GP market at single-practice size, where the buyer is often another GP and the diligence is a spreadsheet, an accountant and a walk-through. The penalty is decided and the liability runs to the acquirer. Whether that reaches the level of the market where most practices change hands, or stays with the corporates and groups large enough to be worth suing, is unresolved.
Own a practice and thinking about your exit, this year or in three? Write to kate.marie@mediusglobal.com.au, in confidence.
Buying, lending or researching? The full operator dataset behind the Zoo is licensed: get the full data.