Healthcare data centre requirements in Australia: five checks before you commit

October 20 2026, by Macquarie Technology Group | Category: Data Centres

Data Centre Security: The Ultimate Guide To Protecting Your Critical Infrastructure | Macquarie Data Centres

Choosing a data centre for healthcare starts with the workloads it will support and what happens if they become unavailable. Establish where every copy of patient data will reside, who can access the environment and whether resilience matches the clinical impact of downtime. Then ask for evidence of the provider’s controls. These answers help you look beyond a feature list to an arrangement that fits each workload, gives your team operational visibility and supports your privacy, security and risk obligations.

The checks below focus on infrastructure due diligence. Privacy and health-records requirements vary by organisation and jurisdiction, so involve your privacy, compliance and legal advisers in interpreting the obligations that apply to you.

Why healthcare data centre workloads need a different assessment

Healthcare data centre decisions need to account for both the sensitivity of health information and the consequences of losing access to clinical systems.

Health information remains sensitive over time. Unlike a payment card or account credential, a medical history cannot simply be replaced after exposure. That increases the importance of data location, operational jurisdiction, encryption-key control and physical access.

When medication histories, allergies, imaging or pathology results are unavailable at the point of care, teams may need to fall back on slower processes. An interruption can affect care delivery as well as productivity and revenue. The clinical consequences of an outage should therefore guide resilience and recovery requirements. Different systems may need different levels of protection.

1. Map where patient data and operational data reside

Start with a complete data-location map. Include production systems, backups, replicas, disaster recovery environments and any monitoring, support or telemetry data collected by a provider. “Hosted in Australia” is not specific enough if a copy, log or support pathway sits elsewhere.

The physical location of the data and equipment.
The legal entity operating the service and the jurisdiction governing it.
The location and control of encryption keys.
Whether overseas personnel can administer, monitor or support the environment.
The provider’s deletion, media-handling and data-return processes at contract end.

These facts give privacy and legal teams the evidence needed to assess the arrangement. They also show where contractual commitments may be required. Australian location, Australian operational control and customer-controlled encryption address different risks and should not be treated as interchangeable claims.

2. Match resilience to clinical consequence

Classify workloads before comparing facility designs or service levels. A useful first pass separates systems that support care at the point of delivery from those that can tolerate a longer interruption.

Workload category	Typical examples	Decision focus	Evidence to request
Clinical operations	Electronic medical records, medication management, imaging retrieval and pathology results	Recovery objectives based on the consequences of unavailability	Facility topology, maintenance procedures, dependency map, failover tests and contracted service levels
Operational and administrative	Rostering, billing, reporting and general collaboration	Acceptable interruption, recovery sequence and cost trade-offs	Recovery objectives, backup and restore tests, support model and service remedies

For systems with a low tolerance for interruption, determine whether planned maintenance can occur without taking your equipment offline. Concurrent maintainability is a design characteristic often associated with Tier III requirements, but a tier label should not replace assessment of the actual architecture, dependencies and operating procedures.

Read the contracted service level closely. A marketed uptime figure and a contractual commitment are not the same. Check how an outage is defined, which events are excluded, how performance is measured, what remedies apply and whether the commitment covers the complete service chain. Recovery objectives should account for connectivity, customer equipment, applications and operational processes, not only the data centre building.

3. Check who can access your equipment and systems

You should be able to establish who can enter the facility, work on your racks and administer supporting systems, and who employs them. Check:

Whether on-site engineers and remote-hands personnel are directly employed or subcontracted.
The vetting process and any clearances relevant to the contracted service.
Cabinet-level access controls and the retention and availability of access logs.
Approval, escort and escalation processes for planned and emergency access.
The locations from which monitoring, service desk and administration are performed.

Offshore support can create an access pathway even when patient data remains physically in Australia. Treat support location, privileged access and data location as separate due-diligence questions, then assess them against your organisation’s commitments and risk settings.

4. Check the scope of certifications and assurance reports

Certifications and assurance reports are useful only when their scope matches the facility and services you are buying. Request current documents that identify the relevant legal entity, locations and control boundaries.

ISO/IEC 27001 certification can provide evidence about an information security management system. SOC 2 reports can provide information about controls assessed against selected trust services criteria, with a Type II report addressing control operation over a defined period. Neither establishes that a healthcare customer complies with its own obligations. Review the scope, period, exceptions and complementary customer responsibilities.

Under an appropriate non-disclosure agreement, seek the underlying assurance reports where available. Follow up on the operational details the reports leave open: how incidents are detected and escalated, when customers are notified, how evidence is preserved, and what support is available if you need to investigate or make a notification.

5. Plan for connectivity and future capacity

Healthcare environments exchange information with imaging and pathology providers, referral networks, government systems and cloud platforms. Connectivity choices can affect latency, resilience, migration options and cost. Confirm that you can use the carriers, cloud on-ramps and network partners required by your clinical ecosystem, and understand any commercial or technical constraints.

Medical imaging also needs a longer planning horizon. Model storage growth against the applicable retention period and expected modality volumes, rather than the initial contract term alone. Translate that forecast into rack space, power, cooling, connectivity and expansion requirements. Where contiguous capacity matters, establish whether it can be contractually reserved rather than assumed.

Healthcare data centre evaluation checklist

Classify each workload by clinical consequence and set recovery objectives.
Map every copy of patient data, including backups, replicas, disaster recovery and telemetry.
Identify the operating entity, parent entity and relevant jurisdictions.
Confirm where encryption keys are held and who can use them.
Document all physical, privileged, monitoring and support access pathways.
Confirm employment, subcontracting, vetting and clearance arrangements for personnel.
Review access logging, retention and customer reporting.
Assess facility topology, maintenance procedures and end-to-end dependencies.
Review contractual outage definitions, exclusions, measurement and remedies.
Obtain current, facility-specific certificates and scoped assurance reports.
Review audit exceptions and complementary customer responsibilities.
Confirm incident escalation, notification and investigation support.
Validate carrier, cloud and partner connectivity requirements.
Model storage, power, cooling and space growth over the relevant planning period.
Document provider and customer responsibilities in the final architecture and contract.

Make the requirements clear before you commit

Before selecting a facility or negotiating service levels, be clear about the consequences of downtime for each workload. That gives you a basis for deciding where greater resilience is justified and where a simpler arrangement may be enough. Use those requirements to assess data location, access, assurance, connectivity and capacity, so the final choice reflects how your organisation actually operates.

Your data centre partner needs to support today’s workloads and leave room for your requirements to change. Macquarie Data Centres provides secure, resilient and scalable data centre solutions for hyperscale, enterprise, government and cloud environments.

Frequently asked questions

Which data centre is suitable for healthcare data in Australia?

A suitable data centre can evidence where data resides, who operates and accesses the environment, how resilience supports each workload, and which controls have been independently assessed. Suitability depends on the organisation, jurisdiction, architecture, contracted service and clinical consequence of downtime, so the infrastructure review should include privacy, security, legal and operational input.

Does health data have to stay in Australia?

There is no reliable one-line answer for every healthcare organisation. Applicable requirements can depend on the organisation, jurisdiction, data, service and contractual commitments. Infrastructure teams should establish the location of all data copies and access pathways, then give that evidence to privacy and legal advisers for interpretation.

What resilience do clinical systems need?

Set resilience and recovery objectives according to the clinical consequence of unavailability. Systems used at the point of care may need maintenance without service interruption, resilient connectivity and tested recovery processes. Administrative systems may support longer recovery, allowing the organisation to direct investment to services where interruption carries the greatest consequence.

What should we ask about access to our equipment and systems?

Establish who can access the facility, cabinets, management interfaces and support systems; who employs them; what vetting applies; where they work; how access is approved and logged; and whether records are available for review. Include remote hands, monitoring and service desk functions.

Does certification mean a provider is compliant with health privacy requirements?

No. A certification or assurance report covers defined controls, entities, locations and periods. It can support due diligence, but it does not establish a customer’s compliance. Check the scope and exceptions, then document the responsibilities that remain with your organisation.

How should we plan for medical imaging storage growth?

Forecast growth across the relevant retention and planning period, including changes in modality volumes and image sizes. Convert the forecast into storage, rack, power, cooling and network requirements, and confirm how expansion capacity will be secured.