Services
HIPAA security for medical & dental practices
Most practices know HIPAA applies to them. Far fewer know what it actually asks for on the technology side — and the newer the practice, the more likely the honest answer is "whatever the EHR vendor set up." That is rarely enough, and it is not what an investigator asks to see first.
We help small medical and dental practices in central New Jersey do the part HIPAA actually requires: a written security risk assessment, staff training, and fixing the gaps the assessment finds. We are an IT company rather than a law firm, and we are clear about where that line sits.
"Is my practice compliant?" — the honest answer
No product, badge or certificate makes a practice HIPAA compliant. HHS does not recognise any HIPAA certification, so a vendor selling one is selling marketing. What actually counts is a documented process: a risk analysis, safeguards chosen because of it, written policies, trained staff, signed business associate agreements, and records showing all of it is kept up.
The missing piece is almost always the first one. HHS enforcement actions against practices of every size cite the same failure again and again — no accurate, thorough risk analysis — and it is the document an investigator asks for first after a breach or complaint. Most small practices we see have some of the right safeguards in place. Very few can show the written assessment that ties them together.
The security risk assessment
A risk assessment answers three questions in writing: where does patient information live, what could realistically go wrong with it, and what are you doing about each risk. For a small practice it is a site visit, a few conversations with whoever knows the systems, and a written report — not a months-long audit.
The report is yours. It is the document you keep for HHS, hand to a cyber insurer, and update when something changes: a new EHR, a move, a new location, or an incident.
- An inventory of everywhere patient data lives — EHR, imaging, email, scanned paper, phones, backups and vendor portals
- Threats and vulnerabilities for each, rated by likelihood and impact
- The safeguards already in place, and the ones missing
- A prioritised remediation plan, in plain English, with the low-value items marked as such
- A written report you keep as your documentation
Staff training people actually sit through
HIPAA requires security awareness training for your whole workforce, front desk included. The version that works is short and specific to how your office runs: the phishing emails your staff actually receive, what to do the moment someone clicks something, why the shared front-desk login has to go, and how patient information should and should not leave the building.
Every session is logged with who attended and when, because training that cannot be shown did not happen as far as an investigator is concerned.
- Phishing and impersonation — including the AI-written kind with no typos
- Passwords, multi-factor sign-in, and why logins are never shared
- Email, fax and texting mistakes that become breaches
- What to do, and who to tell, if something looks wrong
- Attendance records kept for your documentation
Fixing what it finds
An assessment that produces a list nobody acts on is just a more expensive way to be exposed. Because we are also the IT company, we can close the technical gaps ourselves rather than handing you a report and a referral.
- Individual logins for every person, and same-day removal when someone leaves
- Multi-factor authentication on email, the EHR and remote access
- Encryption on laptops and portable drives
- Email set up under a business associate agreement, with encryption for messages that carry patient data
- Backups that are kept off-site and tested by actually restoring them
- Patching, supported operating systems, and isolating older imaging machines that cannot be upgraded
- Audit logging that is turned on and retained
Opening a new practice
The cheapest time to get this right is before the first patient. Every system is new, there are three people to train instead of fifteen, and the risk assessment can describe the whole setup in an afternoon. Retrofitting the same controls into a busy practice two years later costs more and interrupts more.
For a new practice we set up the accounts, devices, email and backups correctly from day one, get the business associate agreements in place, and write the initial risk assessment once the systems are running.
Where our part stops
We are not attorneys. Legal questions — whether an incident is a reportable breach, how to word a patient notice, what a contract obligates you to — belong with a healthcare attorney, and we will say so rather than guess. We also do not issue certifications, because there are none worth having.
What we can do is make the practice genuinely more secure, give you the written assessment and training records HIPAA asks for, and be the person who already understands your systems when a question from an insurer, a payer or HHS arrives.
Common questions
How often does a practice need a risk assessment?
The current rule requires the risk analysis to be kept accurate and up to date rather than naming a fixed schedule. In practice that means reviewing it at least once a year and whenever something significant changes — a new EHR, a move, a new location, or a security incident. The proposed update to the Security Rule would add explicit 12-month cycles for related work, such as a technology asset inventory and a compliance audit.
Will you sign a business associate agreement?
Yes, before we access anything. HHS lists IT and managed service providers that support systems holding patient information as business associates, so any IT provider in that position should sign one. Be uncomfortable with any who won't.
Our EHR vendor says they handle HIPAA. Isn't that enough?
They handle their application. Your computers, email, Wi-Fi, backups, staff logins and the risk assessment are still yours. The EHR vendor's BAA covers what they host — not the front-desk PC with a shared password or the laptop that goes home at night.
We're a small practice. Does HHS really go after offices our size?
Yes. HHS has penalised small providers too, and in 2025 put out a release subtitled "Small Health Care Providers Also Must Comply with the HIPAA Rules." The penalty is rarely the biggest cost, though — a breach means patient notifications, a disrupted schedule and lost trust, which is why the assessment is worth doing for its own sake.
Can you help with a cyber insurance application?
Yes. The questions insurers ask — multi-factor authentication, backups, endpoint protection, training — overlap almost entirely with what a risk assessment covers, and having the assessment makes the application faster and the answers more accurate.
No obligation
Talk it through first
Tell us what's happening and we'll give you an honest read on what it needs — including if that turns out to be nothing. We work across Middlesex, Somerset, and Mercer County.
Reading on this
- HIPAA Checklist for a New Medical Practice: What to Do Before Day OneThe cheapest time to get HIPAA right is before the first patient. Here's the order we'd do it in, and the two items new practices miss most.
- What a HIPAA Risk Assessment Actually Involves (For a Small Practice)It's the requirement HHS enforcement keeps coming back to, and the one small practices skip most. What it is, what goes in it, and what it isn't.
- Is Gmail HIPAA Compliant? Email Options for Medical PracticesShort answer: free Gmail, no. Google Workspace or Microsoft 365, yes — but only once they're set up for it. Here's what that means.
- The HIPAA Security Rule Update: What's Proposed and What's Required NowMandatory MFA, mandatory encryption, annual audits. HHS proposed all of it — and none of it is final yet. Here's what that means for a small practice.
- Cybersecurity for Dental Offices: The Gaps We Find Most OftenThe imaging PC nobody can update, the front-desk login everyone shares, and the vendor with permanent remote access. The gaps we see in dental offices.
Other services
- Managed IT supportProactive monitoring, patching, and help-desk support that keeps your systems healthy—so problems get solved before they cost you time.
- Networks & Wi-FiFast, secure, reliable connectivity. We design, install, and tune networks for offices and homes that just work.
- Computer repair & setupFree diagnosis over the phone or remotely. Then hardware and software troubleshooting, upgrades, and new-device setup—on-site or remote.
- Fully Managed ITYour whole IT function, outsourced. No internal IT person, and no expectation that anyone on your staff becomes one.
- Co-Managed ITYou already have an IT person. We take the specialist load, the out-of-hours cover, and the projects that would otherwise stall.
- Microsoft 365Setup, migration, licensing and the security settings that Microsoft leaves switched off — email, files and accounts configured properly.
- IT ModernizationReplacing the setup that grew by accident — a roadmap, a modern workplace, and the manual steps automated away.
- AI Enablement & AutomationPractical uses of AI in a small business, the setup to do it without leaking your data, and honesty about where it does not help.
- Security AdvisoryFractional security guidance for a business that needs the thinking but cannot justify hiring for it.