Healthcare & Medical
We find out whether patient records, medical devices, workstations and portals are safe from attackers, then fix what we find without interrupting care. Patient records are among the most sensitive data there is, and care cannot pause for an outage. We secure and run the technology of medical practices and the businesses that serve them.
Medical practices, clinics, dental groups, labs and the companies that serve them hold some of the most sensitive records that exist, and attackers pay attention. Patient data is valuable, downtime can interrupt care, and federal law sets specific security duties for the organizations that handle it.
Medical environments are familiar ground: we have worked on HIPAA-regulated systems and on the technology of an innovation building inside a major hospital complex. That experience goes into a practical program for practices and healthcare businesses, not a binder that sits on a shelf.
What we see in your industry
- The HIPAA Security Rule requires a documented risk analysis and administrative, physical and technical safeguards for electronic protected health information.
- Business associates, such as billing, cloud and IT vendors, share responsibility and need written agreements and oversight.
- Breach notification has deadlines: individuals must be notified without unreasonable delay and within 60 days of discovery.
- Clinicians want AI help with notes and summaries, which calls for a private deployment under a business associate agreement.
The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities and their business associates. It requires administrative, physical and technical safeguards for electronic protected health information, and it starts with a risk analysis of where that information lives and what threatens it. The HITECH Act extended these duties directly to business associates and strengthened enforcement.
The Breach Notification Rule sets the clock. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery of a breach of unsecured protected health information, and breaches of 500 or more people must be reported to HHS contemporaneously. Many states add shorter deadlines of their own (Florida's is 30 days), so knowing quickly what was accessed matters.
We help with the practical work behind those rules: a documented risk analysis, access controls and audit logging, encryption, tested backups and a contingency plan, business associate agreements with the vendors that touch patient data, and a rehearsed incident response plan. This is general information, not legal advice.
AI is the newest question for clinics. Notes, summaries and coding help are useful, but a public chatbot is the wrong place for patient information. Running a model inside your own environment, under a business associate agreement where one is required, lets clinicians use the tool without the record leaving your control.
Two articles cover the details. "HIPAA Security Rule Checklist for Medical Practices and Business Associates" is a working list for the risk analysis and safeguards, and "HIPAA and the Cloud" explains business associate agreements for Microsoft 365, Google Workspace and Amazon Web Services. "Vendor and Third-Party Risk for Mid-Size Firms" shows how to keep the vendor inventory behind those agreements current.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a hospital group's segmented clinical network, a radiology group's PACS and DICOM network between 14 imaging centers (illustrative), and a nationwide dental organization's open-source practice platform, and an AI evidence pack for a medical group's insurer renewal and a hospital customer's vendor questionnaire (illustrative).
HIPAA Security Rule Checklist for Medical Practices and Business Associates
The HIPAA Security Rule applies to every practice and vendor that touches electronic patient data. Here is what it requires today, the deadlines that apply after a breach, and where HHS's proposed overhaul stands.
Work like yours
A nationwide dental group on its own open-source platform, with drivers we wrote for its imaging hardware
A dental organization with a nationwide presence, a leader in its segment, handling patient records and diagnostic images under HIPAA.
Nationwide practice network, open-source practice management, custom imaging driversRead the case
A hospital network that keeps clinical systems, medical devices and guests apart, and logs everything
A regional hospital group in the southeastern United States, a leader in its segment.
6 campuses, 40 outpatient clinics, 12,000+ connected devices, 20+ segmentsRead the caseImages that follow the radiologist: DICOM over encrypted links between fourteen imaging centers
A radiology group with 14 imaging centers and 3 hospital reading rooms, a leader in its segment.
17 sites, ~1.2 million studies a year, 1 Gb/s circuits, 10 Gb/s at the data centers, 2-site VNARead the case
An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire
An outpatient medical group in Arizona with six clinics and about 140 clinicians, a leader in its segment.
6 clinics, about 140 clinicians, 9 AI tools in use, 12 evidence artifacts, 1 insurer renewal, 1 hospital questionnaireRead the case
Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint
A regulated firm that needed to prove what it sent and received, a leader in its segment.
Every inbound and outbound message, 1 Object Lock archive bucket, AWS KMS protecting each message fingerprintRead the caseA multi-clinic group moves its practice-management SQL Server to Always On with point-in-time restore
A healthcare group of 12 clinics with about 700 staff.
~600 GB across 5 databases, 2 synchronous replicas plus 1 asynchronous disaster recovery replicaRead the caseHow we help
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreSuper Intelligence
American‑made Super Intelligence: AI your team can learn, trust and deploy.
Learn moreMicrosoft Exchange, Active Directory & SQL
Exchange, Active Directory and SQL Server built redundant, backed up and recoverable, and engineers on call when they fail.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDo you sign business associate agreements?
We sign a business associate agreement where our work involves access to your protected health information, as HIPAA requires for vendors that create, receive, maintain or transmit it for a covered entity. We also help you review the BAAs your other vendors offer. Your counsel should approve the final terms.
What is ePHI and where does it live in a medical practice?
ePHI is electronic protected health information: health data that identifies a patient and is stored or sent electronically. It sits in your electronic health record, but also in email, scanned documents, copiers, laptops, phones, backups and cloud storage. A list of every location is the first step of a risk analysis.
What is a HIPAA Security Rule risk analysis and how often is it needed?
A risk analysis is an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of your ePHI. The Security Rule requires it, and it is a required specification, not an option. Repeat it when your environment changes, such as a new system, vendor or office, and keep the documentation for six years.
Can we use Microsoft 365, Google Workspace or other cloud services under HIPAA?
Many practices do, but the service must be configured correctly and covered by a business associate agreement with the provider. We set up access control, multi-factor authentication, encryption, retention and logging, and we check that no free or consumer tools handle patient data. No product is compliant on its own.
Is email HIPAA compliant?
Email can be used to send ePHI when it is protected appropriately, for example with encryption in transit, secure message options, strong authentication on the mailbox and email authentication records such as SPF, DKIM and DMARC. Your risk analysis should decide what is reasonable. Our email authentication article explains the technical side.
What does a HIPAA penetration test or security assessment involve?
We test your external exposure, your network and the systems that hold ePHI to find weaknesses before an attacker does, and we deliver a plain-language report with fixes. A penetration test supports your risk analysis but does not replace it. We do not certify HIPAA compliance.
Do you help after a ransomware attack or lost device?
Yes. We contain the incident, preserve evidence, help establish what ePHI was affected and support your notification decisions with your counsel. Encrypted laptops and backups can change whether an event counts as a reportable breach, which is why preparing beforehand matters. Call (305) 404-9404.