Small practices run on practice-management, imaging and scheduling systems that can't afford downtime, and they hold exactly the patient information attackers target. We put the HIPAA technical safeguards in place and keep the office running.
Without an IT department, one bad day can close the schedule and trigger notification duties.
When practice-management or imaging systems are encrypted, appointments, charting and billing stop until data is restored.
Referrals, X-rays and records requests move between offices, specialists and patients, too often by email or fax.
Waiting-room Wi-Fi, front-desk PCs and imaging equipment on one flat network give an intruder room to move.
The Security Rule sets the safeguards; the Breach Notification Rule sets the clock when they fail.
is the latest you can notify affected patients after discovering a breach of unsecured protected health information. The rule says without unreasonable delay.
patients affected means you must also notify HHS and, in many cases, prominent media in the area.
An accurate, documented assessment of risks to electronic patient information is a required first step under the Security Rule.
Sources: HHS: HIPAA Security Rule · HHS: Breach Notification Rule
The technical side of HIPAA, without getting in the way of patient care. Before any vendor stores or can access patient information, HIPAA requires a business associate agreement, so ask every IT provider about it up front.
Share referrals, imaging and records requests through encrypted, expiring links with a full access log.
See Secure File Share →Encrypted, versioned backups of practice-management and imaging data, tested so you can actually restore.
Backup & storage →Patched, encrypted and monitored front-desk and operatory PCs with automatic screen locks.
Workstation support →Separate guest Wi-Fi, clinical devices and office PCs so one compromise doesn't reach everything.
Network & wireless →Monitor entrances, front desks and supply rooms with centrally managed cameras.
Security cameras →Reliable, monitored servers for the systems your practice runs on site.
Servers →No vendor can make a practice compliant on its own. We implement and document technical safeguards. Your policies, training, risk analysis and business associate agreements remain your practice's responsibility.
We secure and back up the systems you already run rather than replacing them. Tell us what you use and we'll plan around it.
It depends on how much data you have and how backups are set up. We design backups around how long your practice can afford to be down, and test restores so the number is known.
Yes. You can send a patient a password-protected, expiring link to download or upload records, with no account or app required.