Most attacks on small practices start with an email, a stolen password or a lost laptop. This page lists the basic protections that federal health cybersecurity guidance recommends for small practices. The single most important action: turn on two-step sign-in for email and every system that holds patient information.
This page is practical IT guidance, not legal advice. It doesn't tell you what HIPAA requires of your practice. For that, see the HHS HIPAA for Professionals pages, and talk to your compliance adviser or attorney.
| Your plan |
What applies to you |
| Managed plan |
Many of these steps are part of your plan. The "What we do" lines say which. Ask us about the rest. |
| Ordered online (self-serve) |
Use the steps as a checklist. The services you ordered cover some of them; the rest are yours or your IT person's. |
The U.S. Department of Health and Human Services (HHS) runs the 405(d) program with the healthcare industry. Its guide, Health Industry Cybersecurity Practices (HICP), has a volume written for small organizations without their own IT or security staff. The steps below follow that volume (2023 edition). It names five main threats to healthcare organizations:
- email phishing and other social engineering;
- ransomware;
- loss or theft of equipment or data;
- insiders losing data, by accident or on purpose;
- attacks on network-connected medical devices.
¶ Email and phishing
- Use a business email service with spam and malware filtering turned on.
- Turn on two-step sign-in for email, for web access and for the email app on every computer.
- Turn off old email connections, such as IMAP and POP, that can't use two-step sign-in.
- Label emails from outside the practice as external, so staff take a second look.
- Use your email service's encryption option when you send patient information.
- Give each person their own email account. Don't share one between people.
See Phishing for how to spot a phishing email and what to do with one.
¶ Access control and two-step sign-in
- Give every person their own account in every system: computers, email, practice management and imaging software. HHS 405(d) advises avoiding shared or generic accounts.
- Give each person only the access their role needs.
- Keep administrator accounts separate from everyday accounts, and protect them with two-step sign-in.
- Set computers to lock themselves after a few minutes of inactivity.
- Review who has access to what on a regular schedule.
- When someone leaves, end their access straight away and change any shared passwords they knew. See New Hire and Departing Employee IT Checklist.
See Turn On Two-Step Sign-In and Passkeys for setting it up.
What we do (managed plan): we set up accounts with two-step sign-in and remove access when you tell us someone has left.
¶ Updates and patching
- Let Windows and Mac computers install updates automatically.
- Update other software too, such as browsers, PDF readers and practice software. HHS 405(d) suggests at least monthly where updates aren't automatic.
- Replace computers and software that no longer get security updates from the maker. An old Windows version at the front desk is a common weak point.
What we do (managed plan): we monitor and install updates on the computers you've enrolled. See Software Updates.
- Run antivirus on every computer, set to update itself.
- Keep the computer's firewall on.
- Don't let everyday users install software. Only an administrator should.
What we do (managed plan): our installer turns on and hardens Microsoft Defender. See What the Security Baseline Does. Managed detection and response is available too; see Managed EDR.
Ransomware attackers go after backups first. A backup only helps if it survives the attack and you know it restores.
- Back up patient records, imaging and practice files automatically, every day.
- Keep at least one copy offline or separate from your network, so ransomware on your computers can't reach it.
- Encrypt backups, especially any copy kept in the cloud.
- Test a restore regularly. A backup you've never restored from is a guess.
- If your practice software is cloud-hosted, ask the vendor how they back up your data and how you'd get it back.
Confirm with whoever runs your backups that you know how long a full restore takes. That number decides how long the practice is closed after an attack.
¶ Device encryption and lost devices
- Turn on full-disk encryption on every laptop and on any computer that holds patient information. On Windows this is BitLocker; on a Mac it's FileVault.
- Don't put patient information on unencrypted USB drives.
- Lock away computers and equipment that can't be encrypted, and keep the network closet locked.
- Teach staff to report a lost or stolen laptop, phone or tablet straight away.
If a device is lost or stolen:
- Call us on (206) 593-8072.
- Write down when and where it was last seen, and what was on it.
- Change the passwords for any account that was signed in on it.
Whether the device was encrypted matters a great deal. The HIPAA breach rules apply to "unsecured" protected health information: information "not rendered unusable, unreadable, or indecipherable to unauthorized persons" by methods HHS specifies, such as encryption (45 CFR 164.402).
- Run a separate guest Wi-Fi network for the waiting room, patients and visitors.
- Keep practice computers, imaging equipment and practice software on the staff network only.
- Use a strong staff Wi-Fi password, and don't post it where patients can see it.
- Change the staff Wi-Fi password and any door codes when someone who knew them leaves.
- Ask us before connecting new medical or imaging equipment to the network.
¶ Vendors and business associate agreements
Many practices rely on outside vendors that handle patient information: practice management, imaging, billing and cloud backup companies.
Under the HIPAA rules, a vendor that "creates, receives, maintains, or transmits protected health information" on a practice's behalf is generally a "business associate" (45 CFR 160.103), and the arrangement must be documented in a written agreement, usually called a business associate agreement or BAA (45 CFR 164.502(e)).
- Keep a list of vendors that handle patient information.
- Ask each one whether it signs a BAA, and keep a copy.
- Ask your compliance adviser which vendors need one.
- Train every person when they start, and at least once a year after that.
- Cover phishing, safe handling of patient information, screen privacy at the front desk, and how to report something suspicious.
- Include part-time staff, managers and dentists or physicians.
- Practice phishing tests can show who needs extra help.
Don't wipe the computer and don't wait. Disconnect it from the network and call us on (206) 593-8072. See I Think My PC Got Infected.
The HIPAA breach notification rules set deadlines once a breach of unsecured patient information is discovered. Notices to affected individuals must go out "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (45 CFR 164.404(b)). There are further rules for notifying HHS and, for larger breaches, the media. Read the HHS Breach Notification Rule page and talk to your compliance adviser or attorney about what applies to you. If you have cyber insurance, call your insurer early too.
What we do: we help you work out what happened, which computers and accounts were affected, and what information may have been exposed. We give you the technical facts; decisions about notification are yours and your adviser's.
HHS and the Office of the National Coordinator for Health IT (ONC) publish a free Security Risk Assessment (SRA) Tool for small and medium practices. It walks you through questions about your practice and produces a report. ONC's page says use of the tool "is neither required by nor guarantees compliance with federal, state or local laws". It is a good place to start a yearly review. We can help you answer the technical questions.
| Area |
The basic step |
| Email |
Filtering on, two-step sign-in, one mailbox per person |
| Access |
One account per person, least privilege, end access on the last day |
| Updates |
Automatic, and no unsupported Windows or software |
| Endpoint protection |
Antivirus and firewall on every computer |
| Backups |
Daily, one copy offline, encrypted, restore tested |
| Lost devices |
Full-disk encryption on, report losses straight away |
| Wi-Fi |
Guest network separate from the practice network |
| Vendors |
A list, and a BAA where needed |
| Training |
At hire and at least yearly |
| Incidents |
Disconnect, don't wipe, call us |
- Technical Volume 1: Cybersecurity Practices for Small Healthcare Organizations, HHS 405(d), 2023 edition: the five threats; email configuration and two-step sign-in, IMAP and POP, external tags; one account per person; ending access when someone leaves; separate administrator accounts; automatic lock; patching at least monthly; antivirus, firewall and endpoint encryption; reporting lost devices; guest networks and locked network closets; cloud backups under a BAA and encrypted; training at onboarding and at least yearly.
- Health Industry Cybersecurity Practices (HICP), HHS 405(d): the HICP program and its volumes.
- 45 CFR 164.404: Notification to individuals, Electronic Code of Federal Regulations (current as of October 30, 2026): notices "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach".
- 45 CFR 164.402: Definitions, eCFR: the definition of unsecured protected health information.
- 45 CFR 160.103: Definitions, eCFR: the definition of a business associate.
- 45 CFR 164.502(e), eCFR: business associate assurances documented in a written contract or agreement.
- 45 CFR 164.308(a)(1), eCFR: the required risk analysis, "an accurate and thorough assessment of the potential risks and vulnerabilities".
- Breach Notification Rule, HHS Office for Civil Rights: HHS's own explanation, including notifying HHS and the media.
- Security Risk Assessment Tool, ONC (HealthIT.gov), version 3.7, page updated September 18, 2026: what the tool is for and its disclaimer.
- Cyber Essentials, CISA: two-step sign-in for all users, least privilege, automatic updates, regular automated backups with offline copies, and an incident response plan.
- NIST SP 1300, Cybersecurity Framework 2.0: Small Business Quick-Start Guide, NIST, February 2024: back up and test backups; full-disk encryption on laptops and tablets.
Last reviewed: October 2026