Who this is for
Small healthcare organizations face the same kind of threats as large hospital systems with a fraction of the staff to handle them. We designed this service for independent medical and specialty clinics, dental and orthodontic offices, behavioral health and therapy practices, physical therapy and chiropractic offices, and the medical billing, coding and transcription companies that support them. Under HIPAA, many of those support companies are business associates with obligations of their own.
What the Security Rule asks for, in everyday terms
The HIPAA Security Rule is built around protecting the confidentiality, integrity and availability of electronic protected health information. It is deliberately flexible, so it expects you to decide what is reasonable for your size and risk. At a high level it points to three kinds of safeguards:
- Administrative: a documented risk analysis, written policies, assigned security responsibility, workforce training, vendor oversight and a contingency plan.
- Physical: controlling who can reach devices and workstations, and handling equipment disposal and reuse properly.
- Technical: unique user accounts, access controls, audit logging, protection against tampering and secure transmission of data.
Texas adds its own layer. Texas's medical privacy law is broader than HIPAA in who it treats as a covered entity, and it includes workforce training expectations. Your attorney can tell you how it applies to you.
Common gaps we look for
Small practices tend to share a recurring set of weaknesses, and most are fixable without heroic budgets:
- Shared logins to the records system or front-desk computers, so activity cannot be tied to a person.
- Laptops, phones and removable drives that are not encrypted.
- No written, recent risk analysis, or one that was never updated after the practice changed systems.
- Vendors that touch patient data without a business associate agreement being tracked.
- Backups that exist but have never been restored, leaving the contingency plan unproven.
- Former employees whose accounts were never disabled.
- Patient information sent through ordinary email or text without a safe process.
How we can help
We start with a free assessment to understand where patient data lives and who touches it. From there, a plan can include managed detection and response with automated 24/7 monitoring, multi-factor authentication, encryption and endpoint protection, email security, and backup and recovery planning. We can support your risk analysis process and help draft policies and an incident response plan that match how your practice really operates. Staff training is included as an option through our awareness and phishing training, since workforce training is a core expectation.
If our work involves access to protected health information, we would expect a business associate agreement to be part of the engagement. If you need leadership across all of this, our vCISO service can own the program for you, and our ransomware protection guidance covers the threat that most often disrupts clinics.
Insurance and incidents
Healthcare organizations are frequent targets, and carriers often ask detailed questions at renewal. Our cyber insurance readiness work helps you document your controls accurately. If an incident involving patient data does occur, breach notification obligations under federal and Texas law may apply, and decisions about notifying patients and regulators belong with your counsel. A tested response plan helps you move quickly and keep good records while they advise you.
Serving clinics and practices across Dallas, Fort Worth and the wider metroplex, we work remotely by default and visit on-site when it helps. Start with the free assessment below.