Clinical systems · 24/7 · Australian DBAs only

SQL Server support for healthcare

Patient administration, pathology, radiology and electronic medical records run on databases that cannot be taken down at a convenient hour, and that hold the most sensitive category of personal information in the country. Remote DBA cover from Australian consultants, from $1,500 a month.

Free 20-point health check Call 1800 431 416

Healthcare databases have two properties that change how they must be run. They are read at three in the morning by someone making a clinical decision, and they hold health information — which Australian privacy law treats as a special category, with a higher bar and a mandatory breach notification regime behind it.

That combination rules out a lot of ordinary database practice. A maintenance window that suits a retailer does not suit an emergency department. A backup you have never restored is not a backup when the system holding a medication chart is unavailable. And an access model you cannot describe in writing is a problem the first time a privacy officer asks who can see what.

The systems we are usually called about

What sits on SQL Server in a health service

Most of the clinical estate, in practice — and it is rarely one vendor. The job is keeping a mixed, vendor-certified estate current without breaking a certification.

Patient administration and EMR

The system the whole organisation schedules around. Usually vendor-supported on top, which means the database must be patched to a level the vendor still certifies — not simply to the latest build.

Pathology, radiology and PACS

Large, growing, and intolerant of slow storage. Index and query work here shows up directly as how long a clinician waits for a result to open.

Integration and messaging

HL7 and FHIR interfaces, SSIS packages and interface engines sitting between systems that were never designed to talk. When these stall, nothing visibly breaks until results stop arriving.

Reporting and clinical analytics

SSRS, SSAS and data marts that are often running on the production instance because that is where they were first built. Separating them is one of the commonest quick wins.

Rostering, payroll and ERP

Not clinical, but a health service that cannot roster staff is in as much trouble as one that cannot schedule theatre.

Research and registry databases

Often the least governed part of the estate, frequently holding identified data, and usually administered by whoever built it. A good place to start an access review.

What you have to be able to answer

The obligations that shape a clinical database

These are the questions a privacy officer, an auditor or a board risk committee will eventually ask. They are easier to answer when the database was configured with them in mind.

Health information is sensitive information under the Privacy Act, which sets a higher bar for collection, use and disclosure than ordinary personal information
The Notifiable Data Breaches scheme requires assessment and, where the threshold is met, notification to the OAIC and to affected individuals — so you must be able to establish what was accessed, by whom, and when
Where My Health Record is involved, the My Health Records Act carries its own obligations and its own penalties, separate from the Privacy Act
State and territory health records legislation applies on top of the federal regime, and differs by jurisdiction — public health services usually carry additional departmental requirements as well
The ACSC Essential Eight expects vendor-supported, patched software, which is the control that an ageing SQL Server version quietly fails
Encryption at rest across the data files and the backups together, because a backup tape or a restored copy is the part of the estate most often forgotten

Getting started

How an engagement with a health service usually runs

Nothing is changed in a clinical system before we understand what depends on it. The first phase is deliberately read-only.

Read-only assessment first

The free 20-point health check runs against one instance using read-only scripts you can read before they run. Nothing is installed and no configuration changes, which is what makes it approvable inside a change-controlled environment.

Map the vendor certification constraints

Which SQL Server version and patch level each clinical vendor certifies, in writing. This decides what is actually possible, and it is the step that turns a patching backlog into a plan.

Fix recoverability before performance

Restores tested rather than assumed, recovery objectives documented against what the configuration can really deliver, and encryption extended across backups as well as data files.

Then run it

24/7 monitoring with alerts routed to an on-call DBA, patching inside your change windows with a tested rollback, and a named consultant who knows which of your systems cannot be touched between 7am and 7pm.

Start with one instance

The free 20-point health check is read-only, takes about twenty minutes of your time, and gives you a written report whether or not you engage us. For a clinical estate it is the cheapest way to find out what you are actually running.

Book the free health check

Published 9 October 2026

FAQ

Common questions

Yes — it is the normal case rather than an exception. Changes are raised, scheduled into your windows, and carry a tested rollback. The initial health check is read-only and installs nothing, which is usually what makes it approvable quickly in a clinical environment.

Yes. SQL Server 2008 through 2022 is in scope, including versions past their support end date — we can keep those running safely while the upgrade is negotiated. What we will not do is tell you that an out-of-support version is fine; we will document the exposure so you can put it in front of the vendor and your risk committee.

Onsys DBAs based in Australia, and only them. No offshore engineer holds credentials to a client database environment, on any plan. Access is through individually named accounts rather than shared credentials, every session is logged, and we tell you which engineers hold access before you sign — it goes into the agreement. Access is revoked the day an engagement ends.

No. The health check needs no access whatsoever — you run the scripts and send the output. For ongoing support, if your policy prohibits external logins, we work screen-shared with your own staff driving. It is slower, and we will say so, but it is a legitimate way to run the engagement.

Monthly plans start at $1,500 excluding GST for up to 10 SQL Server instances — $150 per instance — with a two-hour response SLA at any hour and 10 professional service hours a month. Plan B is $3,000 and Plan C is $7,500 for larger and mixed-platform estates. Project work is quoted as a fixed price after the assessment.