Practice policies and procedures: what every Australian GP clinic needs

Most practice managers do not inherit a clean policy set. You inherit a shared drive with 47 documents, half of which are out of date, three of which reference a Practice Principal who left in 2019, and none of which have been read by anyone since the last accreditation.

If that sounds familiar, this guide is for you.

Policies and procedures are the backbone of a compliant, well-run practice. Done well, they make the practice safer, more consistent, and easier to run. Done badly, they are a compliance theatre exercise that nobody reads and nobody follows. This guide covers what policies you actually need, how to prioritise them, and how to keep them alive.

Everything here is aligned to the RACGP Standards for general practices, 5th Edition. The 6th Edition was released in August 2026 but transition arrangements have not yet been announced, so 5th Edition remains the operational standard for your practice today.

Why policies actually matter

Practice managers who have been through accreditation know this already, but it's worth naming.

Policies are how you evidence that your practice does things the same way every time, no matter who is on shift. That consistency is what protects patients from harm and staff from making avoidable mistakes.

When a surveyor arrives, they will not just look at your policies. They will ask staff about them. If your infection control policy says one thing and reception does something else, the surveyor sees that gap immediately. Undocumented compliance does not count, but neither does documented non-compliance.

The point of a policy is not to have it. The point is to run the practice by it.

The full policy set, grouped by priority

Every practice is different, but the RACGP Standards imply a common core of policies that every Australian general practice needs. Here they are, grouped into three tiers.

Tier 1: Must-have

These are non-negotiable. If any of these are missing, you fail accreditation. If any of these are stale, you have a real safety risk. Fix these first if you are starting from scratch.

1. Infection prevention and control policy Covers hand hygiene, standard and transmission-based precautions, cleaning schedules, waste segregation, sharps handling, and management of blood or body fluid exposure. This is the single most-referenced policy in a survey.

2. Sterilisation policy and procedure Covers reprocessing of reusable medical devices, cycle documentation, biological indicator testing, and traceability. If your practice does any in-house sterilisation, this policy has to be watertight.

3. Cold chain management policy Covers vaccine storage, temperature monitoring, breach response, and reporting. Cold chain breaches are one of the most common practice failures assessors write up.

4. Emergency response plan Covers medical emergencies in the clinic, evacuation, fire, natural disaster, bomb threat, and lockdown. Must be documented, communicated, and rehearsed at least annually.

5. Clinical handover and continuity of care policy Covers handover between clinicians, referrals in and out, results follow-up, and recall systems.

6. Patient results management policy Covers how pathology, imaging, and specialist reports are received, reviewed, actioned, and communicated. Assessors will trace a random result end-to-end through your system.

7. Recall and reminder system policy Covers how patients are called back for follow-up, how the register is maintained, and how failures to attend are managed.

8. Complaints handling policy Covers how complaints are received, logged, investigated, resolved, and used to improve the practice. Includes escalation to health complaint bodies.

9. Incident management policy Covers how clinical and non-clinical incidents are reported, investigated, and used to prevent recurrence. Links to your incident register.

10. Privacy and confidentiality policy Covers patient information handling under the Privacy Act, staff obligations, breach response, and what patients can expect. Must be publicly available to patients.

11. Consent policy Covers informed consent for procedures, telehealth, sharing information, and use of student observers. Aligned to Australian consent law.

12. Credentialing and scope of practice policy Covers verification of AHPRA registration, indemnity, qualifications, and CPR for all clinical staff. Includes ongoing monitoring.

13. Workplace health and safety policy Covers your obligations under state or territory WHS legislation. Not optional, and heavily scrutinised in bigger practices.

14. Bullying, harassment and discrimination policy Covers prevention, reporting, investigation, and support. Culturally, this is one of the policies that sets the tone of a workplace.

15. Code of conduct Covers expected staff behaviour, professionalism, and confidentiality. Sits alongside the bullying policy and reinforces the same expectations.

Tier 2: Should-have

You can probably operate without these for a short period, but you cannot pass accreditation with gaps here, and each one addresses a real risk.

16. Medication management policy Covers prescribing, dispensing in-clinic, sample medications, drug of dependence handling, and disposal.

17. Emergency medications policy Covers what emergency medications the practice stocks, who can administer them, expiry checking, and replacement.

18. Sample management and pathology collection policy Covers labelling, chain of custody, storage, and transport of specimens.

19. Chaperone policy Covers when a chaperone is offered, who acts as chaperone, and documentation.

20. Home visit and after-hours care policy Covers when and how these are provided, safety considerations, and documentation.

21. Telehealth policy Covers eligibility, consent, documentation, technology use, and clinical safety in telehealth consultations.

22. Digital records and IT security policy Covers access controls, passwords, backups, software updates, and cybersecurity basics.

23. Data breach response policy Covers identification, containment, notification obligations (Notifiable Data Breach scheme), and remediation.

24. Business continuity and disaster recovery policy Covers what happens if you lose power, internet, clinical software, or premises. Not the same as your emergency response plan.

25. Waste management policy Covers general, recyclable, clinical, cytotoxic, and pharmaceutical waste streams. Must align with your state or territory regulations.

26. Cleaning and environmental hygiene policy Covers cleaning schedules, products used, staff or contractor responsibilities, and audit.

27. Equipment maintenance policy Covers routine servicing, calibration where required, and tagging of tested and safe electrical equipment.

28. Vaccine management policy Sits alongside cold chain, covers stock rotation, ordering, storage, wastage, and administration.

29. Staff recruitment and induction policy Covers hiring processes, reference checks, criminal history checks where required, Working with Children Checks, and onboarding.

30. Staff training and continuing education policy Covers mandatory training, CPD requirements, competency verification, and record-keeping.

31. Performance review policy Covers how and how often staff are reviewed, feedback processes, and support for underperformance.

32. Leave and rostering policy Covers annual, sick, personal, carer's, long service, and parental leave, plus rostering and shift management.

33. Grievance policy Covers how staff can raise concerns, who they can go to, and how issues are handled.

34. Communication policy Covers internal team communication expectations, use of practice email, messaging apps, and phones, and what is off-limits.

35. Practice governance policy Covers ownership, decision-making authority, reporting lines, and how the practice is run.

Tier 3: Nice-to-have

These reflect good operational practice but are less commonly assessed at a strict pass or fail level. Build them out as capacity allows, especially as your practice grows.

36. Social media policy Covers what staff can and cannot say about the practice or patients on personal social media, and how the practice's own accounts are managed.

37. Mobile phone and personal device policy Covers use of personal phones in clinical areas, taking photos, and separation of personal and work communications.

38. Media and external enquiries policy Covers who can speak to media, what can be said, and how to handle external requests.

39. Gifts, hospitality and pharmaceutical industry policy Covers what staff can accept from patients, suppliers, and pharmaceutical representatives.

40. Uniform and dress standards policy Covers what staff wear, why, and how the practice is presented to patients.

41. Financial delegation policy Covers who can authorise expenditure, at what level, and with what documentation.

42. Fee policy Covers how fees are set, communicated to patients, discounted, and collected.

43. Environmental sustainability policy Covers energy, water, waste, and supply choices. Nice-to-have under the 5th Edition, but mandatory under the 6th Edition. Worth starting now.

44. Patient advocacy and support policy Covers how the practice supports patients through complex situations (interpreter services, support persons, decision-making capacity).

45. Research and quality improvement policy Covers how the practice participates in QI activities, research, and data extraction requests.

That is 45 policies. Not every practice needs all 45. A small solo GP practice might legitimately combine some into fewer documents. A large corporate practice will need every one of them plus a handful of internal governance ones.

How to prioritise if you are starting from scratch

If you are looking at this list and quietly panicking because your practice has ten policies total and half are out of date, here is where to start.

Week 1: Write or refresh Tier 1 policies 1 to 5 (infection control, sterilisation, cold chain, emergency response, clinical handover). These are the highest safety-risk policies. Get them right first.

Weeks 2 to 4: Complete the rest of Tier 1. By the end of month one, you have all 15 must-have policies in place.

Months 2 to 3: Work through Tier 2, roughly 5 to 8 policies per fortnight. By the end of month three, you have a functional policy set covering 35 policies.

Months 4 to 6: Add Tier 3 as capacity allows. Some of these will already exist in draft form as internal notes.

This is a realistic pace for a practice manager doing this alongside their normal role. Faster is possible if you have dedicated support. Slower is fine if the practice is smaller or you already have some in place.

What makes a policy actually useful

A policy is useful when it does three things:

1. Tells a new staff member what to do without needing to ask
2. Matches what the team actually does in practice
3. Can be found and read in under a minute

Most practice policies fail one or more of those tests. Some fail all three.

Here is what separates a useful policy from a compliance-theatre policy:

Written in plain English. Assume the reader is competent but not familiar with the specific process. Legal or technical language belongs in the appendix, not the first paragraph.

Short and focused. A typical policy should be 2 to 4 pages. If yours is 12 pages, either it should be split into multiple policies, or it has too much preamble.

Named owner and review date. Every policy needs a clear owner (a person, not a role that might be vacant) and a review date. If either is missing, the policy is orphaned.

Version controlled. A policy should have a version number, a date, and a change log. When a surveyor asks "when did you last update this?", the answer must be visible in the document itself.

Consistent structure. All your policies should follow the same template. Purpose, scope, policy statement, procedure, related documents, review schedule. Consistency makes them easier to write and easier to read.

Cross-referenced. Policies do not stand alone. Your infection control policy references your sterilisation policy. Your complaints policy references your incident policy. Make the links visible.

Signed off. The practice principal or clinical governance lead should approve every clinical policy. This is what gives the policy operational weight.

Keeping policies alive

Writing policies is the easy part. Keeping them useful is the hard part. Practices that do this well tend to share four habits.

Review on a schedule, not on inspiration. Every policy should have a review date. When it comes up, review it, even if you think nothing has changed. Ten minutes now beats a two-hour rewrite in twelve months.

Review after every incident. If something goes wrong in the practice and the relevant policy did not prevent it, that is a signal. Either the policy needs updating, or the team needs retraining. Log the review in your incident report.

Read a policy at every team meeting. Rotate through them. Two policies per team meeting means you cover the full Tier 1 set every two months, and the whole practice policy set at least once a year. This is the single most effective way to keep policies in team consciousness.

Test policies in real scenarios. Once a quarter, pick a policy and run a scenario. What would happen if we had a fridge breach on a public holiday weekend? What would happen if a patient collapsed in the waiting room? If the policy does not answer the question clearly, refresh it.

Common mistakes with policies

Six patterns practice managers often fall into, and how to avoid each.

Copying policies from another practice or the internet without adapting them. Every practice has its own workflows, systems, and people. A borrowed policy that references processes you do not use is worse than no policy.

Writing policies that describe an aspiration, not the reality. If the policy says "temperature is logged every four hours" and the team actually logs it twice a day, the surveyor will see the gap and it will be worse than if the policy said "logged twice daily".

Letting policies live in a folder nobody opens. Policies in a shared drive that is three folders deep might as well not exist. Make them accessible from the practice management software, from the intranet, or from a printed folder in a visible spot.

Never involving the team in writing them. The people who follow a policy day to day know exactly where it breaks down. A policy written entirely by the practice manager, without input from reception or clinical staff, will have blind spots.

Treating a policy as a one-time job. A policy is a living document. If you have not touched it in two years, assume it needs work.

Confusing volume for quality. Fifty long, out-of-date policies is worse than twenty short, current ones. Focus on making the core set genuinely useful before expanding.

How Practice Managed helps

The hardest part of managing practice policies is not writing them. It is keeping them current, keeping them accessible, and keeping them read.

Practice Managed handles all three. Every policy has a next review date, and you see what is due soon and what is overdue. When a policy is updated, staff who need to read the new version are asked to acknowledge it, and you see who has. When a surveyor arrives, the full policy library, with every version and every acknowledgement, is in one place.

Practice Managed opens for sign-up soon. Join the early access list to be first to start your free 30-day trial. No credit card needed.

Final thought

A good policy set is what turns a busy practice from something that runs on individual heroics into something that runs on systems. It is what protects patients when someone has an off day, and it is what protects your team when something goes wrong.

Start with Tier 1. Get the fundamentals right. Build outward from there. And keep them alive by making them part of how the practice actually works, not just how it looks on paper.

---

This guide is general information for Australian practice managers. It is not a substitute for professional advice or the RACGP Standards themselves. For the definitive text, visit the RACGP's 5th Edition hub.