For group and solo practices, cyber-threats don't look like a large, dramatic event. Incidents often start with something simple, like a compromised account. From there, attackers may access patient information, impersonate you in communications, or sell that data for identity theft, financial fraud, or extortion.

Actual incident data shows hackers are automating attacks against any weak target they can find, not just large systems. But these threats can be mitigated with proper safeguards.

Because of existing threats, the HIPAA security rule was created as a necessary defense to protect health information through safeguards implemented and maintained by the practice. 

Most practitioners aren't aware that they must perform a risk assessment to understand where risk exists, put certain safeguards in place, and have documentation to support it. The rule applies to all covered entities that handles PHI including small and solo practices.

These are necessary and real defenses to protect patient data and keep practices operational. Compliance protects patient privacy, maintains trust, and helps reduce the risk of costly penalties. 

As a provider looking to implement security compliance, these alternatives commonly show up, but ultimately fail at meeting the compliance need:

• Software-as-a-Service Platforms: Powerful, often complex software, at a recurring price, and requires you to evaluate risk and determine safeguards.

• Templates and AI: Feasible, but requires heavy effort and modest technical skill-set to piece together a consistent solution that is still often incomplete or prone to error.

• Consultants and Managed Services: Comprehensive, but more expensive, time-intensive, and require ongoing back-and-forth to implement and maintain.

• Cybersecurity Insurance: Limited in scope, often excludes or restricts coverage for regulatory fines, and typically requires risk assessments and security controls. Gaps in compliance can lead to reduced or denied claims.

• Health Record Systems: Do not make a practice compliant or secure, and are open to vulnerabilities outside the EHR's control. A risk assessment and safeguards are still required by the HIPAA Security rule to protect against these risks.