Practice security guide

1. Turn on the drive encryption built into your computers

Lost and stolen laptops have been behind many reported HIPAA breaches. Windows and Mac computers already include drive encryption; it just needs to be turned on. Encryption that meets HHS's guidance can also affect whether a lost device has to be reported; if that happens, decide it with your attorney.

2. Require multi-factor sign-in (MFA)

A stolen password alone should never be enough to open email, the EHR or remote access. Phishing for passwords is how many practice breaches start, and MFA blocks many of them.

3. Protect your email domain (SPF, DKIM and DMARC)

These three DNS records tell the world which servers may send email as your practice. Without them, criminals can more easily send email that looks like it came from you, to patients, payers or your own staff.

4. Keep computers, browsers and software up to date

Many successful attacks use flaws that already have a fix. Automatic updates close them without anyone having to remember.

5. Make sure antivirus protection is on

Windows includes Microsoft Defender Antivirus. It protects you only while it is switched on and up to date.

6. Back up patient data, and test the backup

A backup lets you keep seeing patients after ransomware, theft or a failed drive. HIPAA requires a data backup plan and a way to restore data, and a backup only counts if you have tested restoring from it.

7. Secure your office router and Wi-Fi

Your router is the front door between the internet and every computer in the office. Patients in the waiting room should never be on the same network as your EHR computers.

8. Work remotely without exposing the office

Remote Desktop and screen-sharing tools that are reachable from the internet are a common way criminals get into small offices, including billers and providers who chart from home.

9. Passwords, screen locks and admin accounts

Unique passwords stop one stolen password from opening everything. Automatic screen locks keep charts private at the front desk and in exam rooms. Day-to-day accounts without admin rights block a lot of malware from installing itself.

10. Stop phishing and email fraud

A common scheme: criminals get into one mailbox, quietly forward copies of mail to themselves, then send convincing requests to change bank details, pay a fake invoice or send patient records.

11. Send patient information the safe way

Patient records sent as ordinary email attachments can be read by anyone who gets into either mailbox. Pick a safe channel for each kind of message and write it down so staff do not improvise.

12. Connected medical devices, printers and other equipment

Imaging systems, ECG and lab equipment, copiers, cameras and smart TVs are computers too. Many cannot be patched by you, and some store patient data on an internal drive.

13. Vendors and business associate agreements (BAAs)

A vendor that creates, receives, keeps or sends patient information for you is a business associate and needs a signed BAA: often your EHR, billing service, IT provider, cloud storage, answering service, e-fax and shredding company.

14. Physical security: screens, paper and disposal

Many privacy problems are physical: a screen the waiting room can read, a chart left at the front desk, a laptop in a car, or old records in the recycling bin.

15. When someone leaves the practice

Former staff accounts that still work are an easy way in. Do these steps on the person's last day.

16. If something goes wrong

Acting quickly limits the damage and protects patients. Keep this page where you can find it without your computer.

Get the full guide with your HIPAA Security Program: a guided Security Risk Analysis built on the HHS tool, an action plan, and this guide.