Governing Digital Dependencies: Connecting Systems, Suppliers and Care
For aged care CEOs and executives, cybersecurity governance means organising the people, systems and suppliers that protect information and sustain essential care. That capability needs clear ownership, deliberate investment and ongoing attention.
A new shift is starting, but staff cannot access the roster. A residential care home needs to confirm staff allocations; a home care team needs to coordinate visits. Both need current care information and a reliable way to communicate. A cyber incident, supplier outage or precautionary shutdown could create this situation.
The response depends on decisions made well before that shift: which systems were selected, how they connect, what suppliers committed to and whether alternative arrangements were funded. CEOs and executives bring those decisions together. Their task is to establish capability that staff can use and the board can assess.
Define care requirements before technology commitments
Start with an essential service and follow the work it requires. In residential care, this might involve allocating staff, accessing care instructions and completing handover. In home care, it might involve coordinating visits, communicating changes and recording care delivered. Identify the information, applications, connectivity and suppliers supporting that work.
Clinical and operational leaders should define what safe delivery requires, including how long disruption can be tolerated, how current information must be and what can continue through alternative arrangements. Technology specialists can then translate those needs into security and recovery requirements. These become criteria for procurement, system changes and investment.
Consider a roster supplier whose recovery arrangements take longer than the service can safely tolerate. Executives need to resolve that gap through stronger supplier commitments, secure alternative arrangements or another solution. The decision should record the care consequences, resources required and any remaining risk, with approval at the appropriate level.
Give each dependency an owner
Applications are often purchased separately, yet several may depend on the same login service, network or technology provider. An alternative communication tool may become unavailable alongside the roster if both use the same affected login. Executive oversight needs to cover these shared dependencies and the responsibilities between teams.
Assign an internal owner for each critical service, with authority to coordinate care, technology, procurement and suppliers. Make clear who maintains access permissions, checks supplier performance and escalates gaps. Agree who can authorise incident containment, activate continuity arrangements and approve resumption, drawing on technical and clinical advice.
The Australian Signals Directorate’s cyber supply chain guidance recommends setting clear supplier security expectations, documenting them in agreements and checking that they are met. For an aged care provider, the practical application includes agreeing incident notification, after-hours support, recovery responsibilities and access to essential information during disruption. Verify how these commitments fit together across suppliers.
A supplier’s availability commitment needs to be assessed alongside the whole care workflow. Confirm which organisation restores each component, how handovers occur and how staff will be supported while recovery proceeds. Include arrangements for retaining access to necessary data if a supplier relationship ends.
Fund the capability throughout its life
The purchase price covers only part of the commitment. Providers also need resources for secure configuration, access reviews, maintenance, staff training, supplier oversight and testing. Include these costs and the people responsible in business cases, alongside the expected care and operational benefits.
Protecting people also means protecting sensitive information and the reliability of care records. Secure alternatives need controlled access and current information; temporary working arrangements need a way to reconcile records afterwards. Fund the work required to maintain these safeguards as services, staff and systems change.
COBIT 2019 provides a useful organising framework, connecting the management of service agreements and vendors with security, risk and continuity. Applied proportionately, it can help executives allocate responsibilities and identify gaps across the organisation. Relevant objectives should be selected around the provider’s needs.
Establish a regular review of critical dependencies and revisit arrangements after incidents, exercises, major integrations or supplier changes. Use findings to prioritise improvements, assign funding and give the board evidence of progress.
Bring one dependency to the executive table
Select one essential service and review its care requirements, shared dependencies, accountable owner, supplier commitments and ongoing costs. Decide which gaps require action, who will resolve them and when the outcome will be checked. This connects daily care delivery with executive decisions and board assurance.
eHomeCare’s Digital Governance and Technology Advisory services help providers connect responsibilities, care requirements and technology decisions. Start a conversation about governing the digital dependencies your services rely on.
Hubert van Dalen is the founder of eHomeCare, providing independent digital strategy, governance, technology and transformation advisory services to Australian aged care and disability providers.
Comments