Why clinic security matters
Clinics keep information that criminals can use for years. A single patient record can include:
Inside one patient record
Example record. No real patient information.
- Identity
- Full name and address(hidden in this example)
- Date of birth(hidden in this example)Cannot be changed
- Social Security number(hidden in this example)
- Copies of IDs and insurance cards(hidden in this example)
- Identity information: Could be used to open accounts.
- Insurance
- Insurance member numbers(hidden in this example)
- Insurance information: Could be used for false claims, or for care and prescriptions in someone else's name.
- Payment
- Payment information(hidden in this example)
- Payment information: A credit card can be canceled.
- Medical
- Diagnoses and visit notes(hidden in this example)
- Prescriptions and lab results(hidden in this example)
- Images and scans(hidden in this example)
- Medical information: Medical history cannot be changed.
What a ransomware attack can do
- Step 1
Systems locked
, which leads to - Step 2
Records copied
, which leads to - Step 3
Payment demanded
, which leads to - Step 4
Staff may lose access
Schedules, charts, billing, and images
Small clinics are easy targets
Many small clinics rely on a few people, a few vendors, and older equipment, with no security team. Security reporters have found that small and mid-sized healthcare organizations remain frequent targets.
Leaks have occurred
A small neurology practice in New York: ransomware may have affected 6,800 people. HHS found no accurate and thorough risk analysis. The practice paid $25,000 and agreed to a corrective action plan.
A women's health group: a breach reported in 2020 affected 37,989 people. HHS again cited the lack of an accurate and thorough risk analysis and announced a $320,000 settlement in 2026.
A medical payments company, Change Healthcare, was attacked in 2024. The attackers used a stolen password on a remote login that had no second login step. About 192.7 million people were affected, the largest healthcare breach ever reported. Many clinics could not get paid for weeks.
What the law requires
The HIPAA Security Rule already requires practices to assess the risks to their electronic patient information.
Rule change proposed for July 2027
January 2025
Update proposed
Today
Not final
July 2027
Target for a final rule
HHS has proposed stricter rules. The date and details may change. The proposal would generally require second login steps, encryption, a device list and network map, a 72-hour restore plan, and regular security testing.
Fixing gaps now means less to rush later.
What we do about it
We visit your clinic, find everyday gaps, and show you which ones to fix first. We do not change your systems. With your approval, we work with your IT company, or one we refer, to make sure it has all the information it needs about what to fix. No risk analysis can promise that a breach will never happen.