Best Practices for Healthcare Security

Which security practices matter most for a specialty practice?

The security practices that matter most for a specialty practice are email protection, endpoint protection, access management with multi-factor sign-in, data backups that are tested, an asset inventory, managed vendor access and a rehearsed incident plan. These practices address phishing, ransomware and lost or stolen equipment, threats the HHS 405(d) guidance describes for small clinics.

None of these needs a large budget, but each needs an owner. In a small practice that owner is often the practice administrator working with a managed IT provider, and the program works only when both know who does what.

The order matters more than completeness. A practice with multi-factor sign-in on email and the EHR, plus a backup it has restored, is in a far stronger position than one with a thick policy binder and neither control.

What is HICP and why use it?

HICP, Health Industry Cybersecurity Practices, is the HHS 405(d) program's guide to the threats and defenses that matter for health care organizations. Its 2023 edition sets out ten cybersecurity practices, with Technical Volume 1 written for small organizations and Technical Volume 2 for medium and large ones.

The ten practices are email protection systems, endpoint protection systems, access management, data protection and loss prevention, asset management, network management, vulnerability management, incident response, network connected medical devices, and cybersecurity oversight and governance. Each comes with sub-practices sized for the organization.

There is also a regulatory reason to use it. Public Law 116-321, signed on 5 January 2021, directs HHS to consider whether a covered entity or business associate had recognized security practices in place for the previous 12 months when deciding fines, audit outcomes and remedies under the HIPAA Security Rule. The law's definition includes the approaches published under section 405(d) of the Cybersecurity Act of 2015.

That makes HICP a practical framework to adopt and document. Adopting it does not replace HIPAA duties, and the 12-month look-back means the records of having it in place matter as much as the practices themselves.

How does an MSO change the security picture?

An MSO concentrates risk. When one organization runs the EHR, practice management, billing and IT for many clinics, a single compromised account or misconfigured system can reach every clinic at once.

• Shared identity: Use one identity provider across clinics, with roles scoped to the clinic a user works in, so a front-desk login at one site does not open charts at another.
• Tenant separation: In shared EHR or billing systems, confirm clinic-level data boundaries are enforced by the software and tested, not only by convention.
• Acquisition onboarding: Each newly joined practice brings its own devices, accounts and vendors. Inventory them, reset credentials and move them onto central controls before connecting them to shared systems.
• Central logging: Collect sign-in, EHR access and endpoint alerts from all clinics in one place, so a pattern across sites is visible.
• Local downtime plans: Each clinic still needs paper or offline procedures for check-in, charting and prescriptions if central systems go down.

MSOs also inherit the weakest clinic's habits. A program that sets a minimum standard, checks each clinic against it and blocks shared-system access until the standard is met keeps one site from exposing the rest.

Practices to put in place first

This checklist puts the HICP practices in the order a small practice can act on them. Each line names the practice and the first concrete step.

• 1. Access management: Turn on multi-factor sign-in for email, the EHR, remote access and the bank, and remove shared logins at the front desk.
• 2. Email protection: Enable the email provider's filtering and link scanning, set up sender authentication for the practice domain, and give staff a one-click way to report suspicious messages.
• 3. Data protection: Back up the EHR, imaging and file shares to a copy that the main network cannot delete, and restore one backup on a schedule.
• 4. Endpoint protection: Run managed antivirus or endpoint detection on every workstation and laptop, encrypt laptop disks and apply operating system updates automatically.
• 5. Asset management: Keep a list of every computer, phone, imaging device and cloud service, with owner and location, and wipe devices before disposal.
• 6. Vulnerability management: Patch internet-facing systems, such as firewalls and remote access gateways, first, and track anything that cannot be patched.
• 7. Network management: Put guest Wi-Fi, medical devices and staff workstations on separate networks.
• 8. Incident response: Write a one-page plan with who to call, how to isolate a machine and how to switch to downtime procedures.
• 9. Connected medical devices: List networked devices, their vendors and how each is updated, and keep them off the general staff network.
• 10. Oversight and governance: Name an owner for the program, review it at a fixed interval and record what was done.

The HIPAA Security Rule also requires a risk analysis at 45 CFR 164.308(a)(1), an accurate assessment of risks to the ePHI the practice holds. Run it after the checklist's first pass, so it describes the practice as it is now rather than before the basics were in place.

Where does specialty software add risk?

Specialty practices run more than an EHR, and each extra system adds accounts, data copies and vendor connections. The risk sits in the systems that are easy to forget.

• Imaging devices: Ophthalmology, dermatology and orthopedic imaging often runs on vendor-supplied workstations with older operating systems. Isolate them and control who can sign in.
• Image storage: Local PACS or image folders may sit outside the EHR's access controls and backups. Include them in both.
• Vendor remote access: EHR, device and billing vendors often use remote support tools. Require named accounts, multi-factor sign-in and access only when requested.
• Online booking and forms: Tracking scripts on booking or intake pages can send data to third parties. Review every script on pages where patients enter information.
• Fax and document intake: Digital fax inboxes and scanning folders collect referrals and records. Limit access and include them in retention and backup plans.
• Billing partners: Outsourced billing services see claims data. Confirm a business associate agreement is in place and limit their system access to what the work needs.

When a practice commissions custom software, such as a referral portal or a patient intake app, the same questions apply at design time. Ask the builder how sign-in, roles, audit records and backups work before the first screen is drawn.

How do you rehearse an incident in a small practice?

Rehearse with a short tabletop exercise and a real restore. A tabletop walks the team through a scenario on paper; a restore proves the backups work. Both fit into a single afternoon.

Pick one scenario, such as ransomware encrypting the front-desk workstations on a Monday morning. Walk through who notices, who they call, how the managed IT provider isolates machines, how the clinic checks patients in without the EHR, and who decides whether to cancel appointments.

Write down every gap the exercise finds, such as a phone number nobody had or a downtime form nobody could locate. Fix those first, then restore last night's EHR backup to a test machine and confirm a known patient record opens.

Repeat with a different scenario next time: a lost laptop, a phished billing login or a vendor breach. Each rehearsal also becomes part of the record that the practice's security practices were in place.

Where practice security programs slip

• Multi-factor everywhere except one: Email is protected, but the remote desktop gateway or the billing portal still accepts a password alone.
• Backups on the same network: Ransomware encrypts the backup drive along with the servers because it was always connected.
• Old accounts left open: Staff who left months ago still have EHR or email access because offboarding depends on someone remembering.
• Vendor access always on: A support tool stays installed and connected, so anyone who steals the vendor's credentials can reach the practice.
• Policies without records: The practice has a policy set but no dated record of training, reviews or restores, which weakens its position under the 12-month look-back.
• MSO standards not checked: New clinics join shared systems before their devices and accounts meet the minimum standard.

Each of these is cheap to fix and expensive to discover during an incident. A short monthly check against this list, done by the practice administrator with the managed IT provider, keeps them from building up. Record the date and the result of each check, so the practice can show the work later.

How Agnotic can help

Specialty practices and MSOs often need software that fits their workflows and makes these practices easier to keep. Agnotic Technologies builds that software for the client: referral and intake portals, practice dashboards and integrations with single sign-on, clinic-scoped roles, audit records, backup and restore tests, and vendor access paths designed in.

For an MSO joining new clinics, Agnotic can also build the identity and tenant boundaries in shared systems so each clinic sees only its own patients.

Sources

• HHS 405(d): HICP Technical Volume 1, Cybersecurity Practices for Small Healthcare Organizations (2023 edition)
• Public Law 116-321: HITECH amendment on recognized security practices
• 45 CFR 164.308: HIPAA administrative safeguards, including (a)(1) risk analysis