Home / Industries / Healthcare & dental
When the schedule, the charts and the phones stop, patients wait and revenue stops with them. You get IT and AI set up the way HIPAA expects, without slowing down the front desk.
A practice runs on a handful of systems: the EHR or practice management software, imaging, e-prescribing, phones and email. If any one of them goes down, the whole day backs up. Ransomware groups know that, which is why healthcare is one of their favorite targets.
HIPAA adds a second layer. Every system that touches patient information needs the right safeguards, every vendor that handles it needs a business associate agreement, and you need a documented risk analysis that shows you looked. Federal enforcement has focused heavily on organizations that couldn’t produce one.
The rule itself is changing, too. HHS proposed a major update to the HIPAA Security Rule in January 2025 that would make safeguards such as multi-factor sign-in, encryption and asset inventories firm requirements instead of “addressable” ones. Final action is currently projected for July 2027, and the current rule is enforced in the meantime. Most of what the proposal asks for is good practice anyway, so it makes sense to build toward it now.
Every practice answers to HIPAA. Depending on your services, a few other rules sit on top of it.
Healthcare breaches have been the most expensive of any industry for 13 years running, and the patterns behind them are well documented. These are the ones that show up again and again, with the numbers behind them and what I do about each.
It’s the first document investigators ask for and a factor in most HIPAA Security Rule enforcement. Regulators launched an initiative aimed at exactly this gap in late 2024, and every settlement comes with years of monitored corrective action.
What I doA documented, practice-wide risk analysis of every system that holds patient data, a risk management plan that tracks each gap to closure, and a yearly review so it never goes stale.
For the first time in three years, exploited vulnerabilities were the leading way in. The most common organizational cause, cited by 42% of victims, was not having enough people watching the systems.
What I doManaged patching for computers, servers and network gear, a running inventory so nothing is forgotten, and monitoring backed by a person who actually responds to the alerts.
Malicious email (22%) and compromised credentials (18%) together opened four in ten attacks. One reused password on an email account can unlock everything behind it.
What I doMulti-factor sign-in on every account that supports it, email filtering tuned for healthcare scams, and short, regular training built around the messages your staff actually receive.
That’s up from an average of 20% between 2009 and 2017. Billing, coding, IT and software vendors hold your patient data, and when one is breached, your patients get the letter.
What I doA vendor inventory, a current BAA for each one, a check of how each vendor protects your data, and limits on what they can reach inside your systems.
Source: Insurance Business, on HIPAA Journal’s analysis of HHS OCR breach data (2026)
Across all industries, breaches took an average of 247 days to identify and contain. The longer an attacker goes unnoticed, the more data leaves and the more it costs.
What I doAlerts on suspicious sign-ins and unusual activity, logs kept long enough to investigate, and a written incident response plan your staff has actually walked through.
Most small breaches aren’t hacks. They’re an email, fax or letter sent to the wrong person, and each one is still a reportable breach.
What I doEncrypted email for patient information, warnings before sending outside the practice, safer fax and print workflows, and training on the mistakes that actually happen.
Related services: Managed IT services · Network security & cybersecurity · Secure AI · Microsoft 365 & Google Workspace · Staff training
AI is arriving in healthcare quickly: note drafting, prior authorizations, patient messaging. The rule that matters most is simple. Patient information only goes into tools covered by a signed BAA.
Most of a practice’s lost time isn’t clinical. It’s intake, faxes, prior authorizations and no-shows. That’s where AI pays off first, under a signed BAA.
AI that reads insurance cards, referral faxes and scanned records and puts the details into your practice management system for staff to confirm.
Best forFront desks buried in faxes, scans and phone calls.
Your own scheduling history used to predict which appointments are at risk, so reminders and overbooking are aimed where they matter.
Best forPractices losing revenue to empty slots and repeat denials.
It depends on the product and the contract. Free, personal and many business plans don’t come with a BAA, so patient information can’t go into them. OpenAI and other AI vendors offer specific enterprise and healthcare products that can be covered by a BAA, and even then compliance depends on how the tool is configured and used. I’ll help you choose one that fits your practice and set it up correctly.
No. The current rule is fully in force, and the proposed update mostly turns existing good practice into firm requirements. Building toward it now means the final rule becomes paperwork instead of a project.
Your EHR vendor secures their system. You’re still responsible for the computers, network, Wi-Fi, email, user accounts and backups in your office, and for the risk analysis that covers all of it.
Yes. Whenever my work could touch patient information, a business associate agreement is in place before the work starts.
Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.
Tell me what runs your practice today. You’ll get a plain-English view of where you stand with HIPAA and what to fix first.