What Every Practice Should Know About Patient Data, Downtime, and HIPAA
Medical, dental, behavioral health, and physical therapy practices run entirely on their systems: schedules, charts, imaging, billing. Here’s what HIPAA actually expects, how the incidents actually happen, and what well run practice IT looks like, in plain English.
Get the Free Healthcare Practice Technology Guide
Six plain English pages: your obligations, the four incidents that actually happen to practices, the security baseline, and the questions practice owners should ask. Instant delivery.
No spam. Unsubscribe anytime. Your information stays private.
Your Obligations, In Plain English
HIPAA is a long regulation, but the expectations behind it reduce to three themes every practice can act on.
The Security Rule Goes Beyond the EHR
A compliant EHR covers the software only. The practice is responsible for everything around it: workstations, email, WiFi, phones, and policies. The required foundation is a documented security risk analysis, and its absence is the most cited finding in enforcement actions.
Breaches Come With a Clock
When protected health information is compromised, notification duties follow: patients, regulators, and in larger incidents the media, generally within 60 days of discovery. The clock does not pause while a practice figures out who does what.
Your Vendors Are Your Responsibility
Every outside company that touches patient information, from the IT provider to the billing service to the shredding vendor, needs a signed business associate agreement. Practices are accountable for the ones they missed.
How Practice Incidents Actually Happen
Healthcare incidents are rarely sophisticated. Four ordinary events cause most of the damage, and every one is preventable with known measures.
Ransomware Meets Patient Care
When schedules, charts, and imaging are encrypted, appointments get cancelled and patients get diverted, which is exactly why attackers favor healthcare: the pressure to pay is medical, not just financial. Practices with tested, isolated backups and written downtime procedures keep seeing patients while systems are restored. Practices without them make the hardest calls of their year in a single morning.
The Lost Laptop
A device with patient data leaves the building every day, in bags, cars, and home offices. Encrypted, a lost device is generally a non event. Unencrypted, it can mean patient notifications, regulator reports, and penalties. The difference is a checkbox someone either configured or didn’t.
The Phished Front Desk
Staff juggling phones, patients, and portals are the most targeted people in the building. One convincing email harvests a login, and that login reads schedules, insurance details, and patient records. Training, phishing simulation, and MFA turn the most targeted people into the strongest layer.
The Disposal Trap
Old computers, copiers, and drives hold images of everything they ever touched. Returning a leased copier or recycling a PC without documented wiping has produced some of healthcare’s most expensive settlements. Disposal is a safeguard, not an errand.
What Well Run Practice IT Looks Like
Whoever manages your practice’s technology, internal or outside, this is the baseline worth reviewing together. Every item maps to a safeguard or a known incident.
A Living Risk Analysis
Documented, reviewed annually, and covering every system that touches patient information. It’s the foundation regulators ask for first, and the roadmap for everything else here.
Unique Logins and MFA
No shared front desk accounts, anywhere. Every user identified, every account protected with multifactor authentication, so audit trails mean something and stolen passwords don’t.
Encryption Everywhere
Laptops, desktops, phones, and email carrying patient information encrypted and documented, converting lost device incidents into non events.
Backups Plus Downtime Procedures
Daily backups with a copy ransomware can’t reach, restore tested on a schedule, and written procedures for seeing patients while systems are down.
A Complete BAA File
A current inventory of every vendor touching patient information, a signed agreement for each, and same day access removal when vendors or staff depart.
Training and Monitoring
Staff trained at hire and annually with documentation, phishing tested regularly, and systems watched around the clock, because incidents don’t keep office hours.
Common Questions
Our EHR is HIPAA compliant. Doesn't that make our practice compliant?
No. A compliant EHR covers the software itself. HIPAA holds the practice responsible for everything around it: workstations, email, WiFi, phones, staff training, policies, business associate agreements, and the required security risk analysis. Most practice breaches happen outside the EHR.
What is a security risk analysis and is it really required?
A security risk analysis is a documented review of where protected health information lives in your practice and what threatens it. It is a required element of the HIPAA Security Rule, it is the first document regulators request after a complaint or breach, and its absence is among the most cited findings in enforcement actions.
Why does ransomware hit healthcare practices so hard?
Because practices can’t operate without schedules, charts, and imaging. When systems are encrypted, appointments get cancelled and patients get diverted, which makes healthcare more likely to face pressure to pay. Practices with tested, isolated backups and written downtime procedures keep seeing patients while systems are restored.
Does a lost laptop really count as a breach?
It depends on encryption. A properly encrypted device that is lost or stolen is generally not a reportable breach. The same device unencrypted can mean patient notifications, regulator reports, and penalties. Encryption is the closest thing HIPAA has to a safe harbor.
What is in the free healthcare practice technology guide?
A six page plain English guide covering your HIPAA obligations, the four incidents that actually happen to practices, a ten item practice security baseline, downtime and patient care planning, and the questions practice owners should ask about their IT.
Start With the Guide. Decide From There.
Download the Healthcare Practice Technology Guide and review the baseline with whoever runs your IT. If you’d rather have the answers verified for you, a free HIPAA readiness assessment for your practice is available too.