HIPAA security and cybersecurity for small practices without an IT department
Small medical and dental practices start with a written HIPAA risk analysis, then fix what it finds: MFA, one login per person, endpoint protection, email under a BAA, backups you can restore and staff training. Small law firms need the same controls for their ethics duties and their clients. I explain what the rules say, compare security services that fit a 2 to 50 person office, and help you set them up.
Get a quoteBook a 15-minute call
I'm an independent technology advisor. Some of the providers I compare pay me for advising you. It doesn't change how I compare options. How I get paid.
Dental offices
Shared front desk logins, imaging PCs on old Windows, X-rays to specialists and your insurance renewal.
Medical practices
The HIPAA Security Rule, HHS's small-practice playbook and a 90-day plan for 2 to 50 staff.
Law firms
ABA duties, client security questionnaires, wire fraud and a control plan for 3 to 30 people.
What a small practice actually has to do
The HIPAA Security Rule asks every covered practice to start in the same place: a written risk analysis. The rule calls it “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic PHI, in 45 CFR 164.308(a)(1)(ii)(A).
The next requirement is risk management: fixing what the analysis finds, to a reasonable and appropriate level. The rule scales to your size and budget, so a five-person therapy office and a 40-person clinic make different choices.
HHS publishes a Security Risk Assessment Tool built for small and medium-sized providers. My HIPAA risk assessment guide explains how to use it and when to get outside help.
HHS has also proposed a bigger Security Rule update. It was published in January 2025 and is listed for final action in July 2027, so it isn’t law today. The healthcare cybersecurity guide tracks its status.
The eight controls that matter most
These come from the Security Rule, HHS’s 405(d) guidance for small organizations and HHS’s voluntary Cybersecurity Performance Goals:
- MFA on email, remote access and every admin account.
- One login per person, with access removed the day someone leaves.
- Endpoint detection and response on every computer and server, with someone watching the alerts.
- Email under a BAA, plus a clear rule for when to encrypt. See HIPAA compliant email and Google Workspace and HIPAA.
- Backups you can restore, with one copy offline or immutable.
- Updates on every device, and a plan for anything that can’t be updated.
- Training and phishing tests for everyone, owners included.
- BAAs with every vendor that touches PHI, from your IT company to your online fax service.
The same list answers most of the questions on a cyber insurance application.
How I help
I’m an independent technology advisor, not a lawyer or an auditor. I read the regulations and HHS guidance, explain them in plain English with sources, and help you choose and set up security services.
For each gap, I compare at least two options. The providers I work with include Coro, CyberMaxx, Huntress, Hook Security, Keeper, Documo and Cloudli. I also tell you when an option I don’t work with fits better, like Microsoft Defender for Business if you’re already on Microsoft 365.
I don’t certify compliance and no product does either.
Start with the checklist
The HIPAA security checklist has 30 items with the regulation or guidance behind each. It runs in your browser, saves nothing, and prints a list of what’s still open.
Every guide on this site
- Cybersecurity for healthcare practices: the full guide for 2 to 50 staff.
- HIPAA risk assessment: what HHS requires, the SRA Tool and OCR cases.
- HIPAA compliance for dental offices: imaging PCs, front desk logins and referrals.
- Cybersecurity for law firms: ABA duties, wire fraud and client questionnaires.
- HIPAA compliant email: BAAs, encryption and options with prices.
- Google Workspace and HIPAA: the BAA, covered services and setup.
- HIPAA compliant online fax: BAAs, prices and replacing fax lines.
- Cyber insurance requirements: what insurers ask and how to prepare.
- HIPAA security checklist: the interactive self-check.
- Glossary: 45 terms in plain English.
Frequently asked questions
What does a small practice have to do first for HIPAA security?
Do a written risk analysis of every system that holds electronic PHI, as 45 CFR 164.308(a)(1)(ii)(A) requires, and then a risk management plan to fix what it finds. HHS offers a Security Risk Assessment Tool built for small and medium-sized providers.
Can you make my practice HIPAA compliant?
No one can do that with a product or a service alone. I compare and help set up security services, but compliance depends on your risk analysis, policies, configuration and training. For legal questions, talk to a health care attorney.
Are you a lawyer or an auditor?
No. I'm an independent technology advisor. I explain what HHS and the regulations say, with sources, and I help you choose and set up security services. I don't give legal advice or certify compliance.
How do you get paid?
Some of the providers I compare pay me for advising the businesses I work with. The How I get paid page explains it.
Do you only recommend providers that pay you?
No. Each comparison on this site includes options I don't work with, such as Microsoft Defender for Business, Google Workspace, Paubox and KnowBe4, and I say when one of them fits better.
Free quote, no obligation
Tell me about your setup. I will compare options for you.
Fill in two short steps. I review every request myself, compare at least two providers that fit, and reply with a plain-English summary.