Healthcare Cybersecurity for Medical Practices: A HIPAA IT Checklist

• Administrative safeguards: Risk analysis, security policies, workforce training, and a designated security official.
• Physical safeguards: Controlled access to facilities, workstations, and devices.
• Technical safeguards: Access controls, audit logs, integrity protections, and secure transmission.

The foundation of all of it is the security risk analysis, a documented review of where your patient data lives, what threatens it, and how you're addressing those risks. It's also where practices most often fall short. An incomplete or outdated risk analysis is one of the deficiencies federal regulators cite most frequently.

Risk and Governance

• Complete a documented security risk analysis, and update it at least annually or whenever systems change.
• Keep a current inventory of every device, application, and system that stores or accesses patient data.
• Designate a security officer, even if it's a part-time role.
• Maintain written security policies and review them each year.
• Sign a Business Associate Agreement (BAA) with every vendor that handles patient data, including your billing company, IT provider, EHR vendor, and cloud services.

Access and Passwords

• Give every user a unique login. No shared accounts.
• Turn on multi-factor authentication (MFA) for email, the EHR, practice management software, and all remote access.
• Grant access by role, so staff see only what their job requires.
• Remove access the same day an employee or contractor leaves.
• Use a password manager instead of spreadsheets or sticky notes.

Devices and Network

• Apply operating system and software updates promptly, ideally automatically.
• Run endpoint protection (antivirus with detection and response) on every computer.
• Encrypt laptops and any device that leaves the office.
• Use a business-grade firewall, and keep guest Wi-Fi separate from the clinical network.
• Include connected medical devices and printers in your inventory and update plan.

Email and Staff Training

• Use advanced spam and phishing filtering on email.
• Train staff at hire and at least once a year, and run simulated phishing tests.
• Verify any request to change bank details or payment instructions by phone, using a number you already have.
• Encrypt emails that contain patient information.

Backup and Recovery

• Back up critical data daily, and keep at least one copy offline or unchangeable so ransomware can't reach it.
• Test restoring from backup at least quarterly. An untested backup is only a hope.
• Write a downtime plan that covers how you'll see patients, capture charges, and submit claims if systems go down.
• Keep a disaster recovery plan with clear roles and contact numbers, stored somewhere you can reach during an outage.

Monitoring and Incident Response

• Monitor systems for suspicious activity, ideally around the clock.
• Keep an incident response plan: who to call, what to disconnect, and how to preserve evidence.
• Know your breach notification duties. Under HIPAA, affected patients generally must be notified without unreasonable delay and no later than 60 days after a breach is discovered, and larger breaches must also be reported to HHS and the media.
• Review your cyber insurance so you know what it covers and what it requires of you.

What is healthcare cybersecurity?

Healthcare cybersecurity is the set of people, processes, and technology that protect patient data and the systems a practice depends on, such as the EHR, practice management software, email, and billing tools, from theft, ransomware, and downtime.

How often should a medical practice do a HIPAA security risk assessment?

HIPAA requires a risk analysis and regular review, and whenever your systems or operations change significantly. Most experts recommend doing it at least once a year, and the proposed Security Rule update would formalize a regular schedule.

Does HIPAA require multi-factor authentication?

The current Security Rule doesn't name MFA specifically, but it requires reasonable safeguards for access to patient data, and MFA is widely considered a baseline. The proposed Security Rule update would make MFA an explicit requirement.

What does HIPAA-compliant IT support include?

At a minimum: a signed Business Associate Agreement, security risk assessments, access management with MFA, patching, endpoint protection, encrypted and tested backups, monitoring, staff training, and help responding to incidents.

What should a practice do first after a cyberattack?

Disconnect affected devices from the network without wiping them, call your IT provider or incident response contact, notify your cyber insurance carrier, and avoid paying any ransom without expert advice. Then assess whether HIPAA breach notification is required.