Cybersecurity for healthcare practices with 2 to 50 staff

Who this page is for

• You own or manage a medical, dental, therapy or chiropractic practice with 2 to 50 staff.
• Nobody on staff does IT full time.
• You know HIPAA has a Security Rule, but you aren’t sure what it asks for in practice.
• Your cyber insurance renewal, a payer contract or a scary news story is pushing you to act.

If you run a law firm, the duties are different. Start with cybersecurity for law firms instead.

What this usually looks like

A typical case: an eight-person family practice. Everyone shares two front desk logins. The EHR is in the cloud, but scanned referrals sit on a Windows PC in the back office. Email runs on a business plan nobody has looked at in years. Backups go to a USB drive that stays plugged in.

Then the cyber insurance renewal asks about MFA on all remote access and email, EDR on every endpoint, and the date of the last risk assessment. The office manager doesn’t know the answers.

That practice needs a written risk analysis, a short list of fixes in the right order, and services set up correctly.

What the HIPAA Security Rule requires

The Security Rule covers electronic protected health information (ePHI). It applies to covered entities, such as health care providers that conduct certain transactions electronically, and to their business associates. The rule’s general requirement, in 45 CFR 164.306, is to protect the confidentiality, integrity and availability of ePHI against reasonably anticipated threats.

The rule is flexible on purpose. Under 164.306(b), a practice can choose measures based on its size, complexity and capabilities, its technical infrastructure, the cost of the measures, and the probability and criticality of risks.

Each standard has implementation specifications marked “Required” or “Addressable.” Addressable doesn’t mean optional. Under 164.306(d), you must assess each one, implement it if it is reasonable and appropriate, or document why not and implement an equivalent alternative where reasonable.

Safeguard type	Where it is	What it covers	Examples of required specifications
Administrative	45 CFR 164.308	Risk analysis, risk management, security official, workforce access, training, incident procedures, contingency plan, evaluation, business associate contracts	Risk analysis, risk management, sanction policy, activity review, incident response and reporting, data backup plan, disaster recovery plan, emergency mode operation plan
Physical	45 CFR 164.310	Facility access, workstation use and security, device and media controls	Disposal of ePHI and hardware, removing ePHI before media re-use
Technical	45 CFR 164.312	Access control, audit controls, integrity, authentication, transmission security	Unique user identification, emergency access procedure
Documentation	45 CFR 164.316	Written policies and records	Keep documentation 6 years, make it available, review and update it

Encryption, automatic logoff, security reminders and log-in monitoring are all addressable. That is why two practices can make different choices, as long as each documents its reasoning.

Start with the risk analysis

The first required specification in the rule is the risk analysis: “an accurate and thorough assessment of the potential risks and vulnerabilities” to ePHI, under 164.308(a)(1)(ii)(A). The next one, risk management, requires measures that reduce those risks “to a reasonable and appropriate level.”

HHS’s Guidance on Risk Analysis says the rule doesn’t prescribe a method, and that the process “should be ongoing.” It also says the rule doesn’t set a frequency.

OCR enforces this. In 2025 and 2026, HHS press releases describe a Risk Analysis Initiative and a run of settlements where OCR found no accurate and thorough risk analysis. One was a small New York neurology practice that paid $25,000 after ransomware encrypted its network, according to the April 25, 2025 HHS release.

The HIPAA risk assessment guide explains what HHS expects in one, how to use the HHS SRA Tool, which HHS offers as a direct download, and when to bring in outside help.

The federal playbooks for small organizations

HICP 2023 and Technical Volume 1

HHS’s 405(d) program publishes the Health Industry Cybersecurity Practices (HICP). The 2023 edition names five top threats: social engineering, ransomware, loss or theft of equipment or data, insider data loss, and attacks against network connected medical devices.

It answers them with ten practices. Technical Volume 1 is written for small organizations without dedicated IT or security staff. Its sub-practices are short and concrete:

HICP practice	Small-organization sub-practices	What it means in a small office
1. Email protection	1.S.A configuration, 1.S.B education, 1.S.C phishing simulations	MFA on email, filtering, external tags, encryption for PHI
2. Endpoint protection	2.S.A basic controls	Antivirus or EDR, disk encryption, automatic patching, no local admin rights, MFA for remote access
3. Access management	3.S.A basic access management	One account per person, MFA on admin and VPN, separate admin accounts, same-day removal
4. Data protection	4.S.A to 4.S.C	Policies, procedures and training on where PHI may go
5. Asset management	5.S.A to 5.S.C	Inventory, buying and retiring devices safely
6. Network management	6.S.A to 6.S.C	Separate guest Wi-Fi, locked network closet
7. Vulnerability management	7.S.A	Find and fix missing patches
8. Incident response	8.S.A, 8.S.B	A written plan and information sharing
9. Medical devices	9.S.A	Security for connected devices, like imaging
10. Governance	10.S.A to 10.S.D	Policies, risk assessment, training, cyber insurance

HICP is voluntary, but it turns the Security Rule’s general standards into a to-do list sized for a small office.

The healthcare Cybersecurity Performance Goals

HHS also publishes voluntary healthcare Cybersecurity Performance Goals (CPGs). The ten essential goals are:

1. Mitigate known vulnerabilities
2. Email security
3. Multifactor authentication
4. Basic cybersecurity training
5. Strong encryption
6. Revoke credentials for departing workforce members
7. Basic incident planning and preparedness
8. Unique credentials
9. Separate user and privileged accounts
10. Vendor and supplier cybersecurity requirements

The enhanced goals add items like asset inventory, network segmentation and centralized log collection.

Ransomware and email threats: what the sources say

• HHS says reports of large breaches rose 102 percent from 2018 to 2023, on its NPRM page.
• The same HHS page says large breaches affected over 167 million people in 2023.
• In April 2026, OCR’s director said “Hacking and ransomware are the most frequent type of large breach reported to OCR,” in the four-settlement release.
• The FBI’s 2025 Internet Crime Report counts 24,768 business email compromise complaints with about $3.05 billion in reported losses in 2025.
• The same report says the top ransomware variants most affected critical manufacturing, healthcare and public health, and government facilities.

Ransomware also has a HIPAA consequence. HHS’s ransomware fact sheet says that when ransomware encrypts ePHI, a breach is presumed unless the practice shows a low probability that the PHI was compromised.

Controls mapped to the services that deliver them

Each row is a control, the rule or practice behind it, and the kind of service that provides it.

Control	Rule or guidance	Service category	Providers I work with	Options I don’t work with
MFA on email, remote access and admin accounts	HICP 3.S.A; CPG MFA; 164.312(d)	Built into your email platform, plus a password manager	Keeper; Coro	Google Workspace, Microsoft 365, 1Password
Endpoint detection and response	HICP 2.S.A; 164.308(a)(5)(ii)(B)	EDR, or managed EDR or MDR with people watching alerts	Huntress; CyberMaxx; Coro	Microsoft Defender for Business
Email security and encryption	HICP 1.S.A; 164.312(e)	Email filtering and encrypted email under a BAA	Coro	Google Workspace, Microsoft 365, Paubox, Virtru, LuxSci
Backups you can restore	164.308(a)(7)(ii)(A)	Backup with an offline or immutable copy	Coro lists a cloud backup module	Your IT company’s backup tool
Training and phishing tests	164.308(a)(5); HICP 1.S.B, 1.S.C	Security awareness training	Hook Security; Coro; Huntress	KnowBe4
Secure fax	Privacy Rule safeguards; 164.312(e); BAA	Cloud fax under a BAA	Documo; Cloudli	eFax Corporate, SRFax, iFax
Risk analysis	164.308(a)(1)(ii)(A)	Assessment service or the HHS SRA Tool	CyberMaxx [VERIFICAR]	HHS SRA Tool (do it yourself)

Details for email are on the HIPAA compliant email page. Fax options are on the HIPAA compliant online fax page. If you use Google, read Google Workspace and HIPAA before anything else.

Options compared

Provider or option	Best for	How it works	Pricing info (as of October 2026)	Pros	Cons
Coro (I work with them)	Practices that want one dashboard for endpoint, email and cloud apps	Packages like Coro AI Essentials bundle endpoint security, EDR, email security and cloud app security; Coro says its data protection can scan files and email for PHI	Not published; quote through a partner or Coro (pricing page)	One agent and one console for a small team	BAA not confirmed on its public pages [VERIFICAR]; still needs someone to review alerts
Huntress (I work with them)	Practices that want managed EDR instead of a tool they watch themselves	Managed EDR, plus managed identity protection for Microsoft 365 and Google accounts, SIEM and security awareness training	Managed EDR MSRP $8.99 per endpoint per month; 50-seat minimum when bought direct or through a reseller (pricing)	Published prices; no Huntress-required seat minimum when bought through an MSP	The 50-seat direct minimum doesn’t fit a 10-person office, so a small practice would buy through an IT provider
CyberMaxx (I work with them)	Practices with 25 to 50 staff, or several locations, that want a full MDR service	MaxxMDR, described as 24x7x365 detection and response, with a healthcare page	Not published	Full detection and response service	Priced by quote; a 5-person office may not need this level of service
Hook Security (I work with them)	Short, regular staff training and phishing tests	3 to 5 minute modules, a HIPAA compliance track and automated phishing simulations (details)	Per seat, not published	Short lessons that fit between patients	Training alone doesn’t stop attacks
Keeper (I work with them)	Replacing shared passwords and spreadsheets	Business password manager with shared folders and admin controls	Business Starter is for 5 to 10 users; prices didn’t display when I checked [VERIFICAR]	Keeper says its platform is HIPAA compliant (source)	BAA terms not confirmed [VERIFICAR]
Microsoft Defender for Business (I don’t work with them)	Practices on Microsoft 365 that want EDR at a low list price	Device security for up to 300 users; included in Microsoft 365 Business Premium	$3.00 per user per month, paid yearly (Microsoft)	Low cost; one vendor with your email	You or your IT company must watch the alerts
KnowBe4 (I don’t work with them)	Practices that want published per-seat prices for training	Training plus phishing simulations	From $2.40 per seat per month for 25 to 50 seats on a 3-year term, prices as of May 2026 (KnowBe4)	Published prices	25-seat lowest band and 3-year term

What it costs

I only quote published list prices. As of October 2026:

• Microsoft Defender for Business: $3.00 per user per month, paid yearly.
• Huntress Managed EDR: MSRP $8.99 per endpoint per month, with $7.99 shown as the example at 100 endpoints.
• KnowBe4 SAT Foundation: $2.40 per seat per month at 25 to 50 seats on a 3-year term.
• Documo cloud fax: from $25 per month on the annual Solo plan (Documo pricing).

Coro, CyberMaxx, Hook Security and Cloudli quote by request. What moves the price most is the number of users and devices, whether a person watches alerts 24/7, contract length, and whether your IT company already resells one of these tools.

If you want to see which gaps you actually have before you price anything, use the HIPAA security checklist.

A 90-day plan by practice size

These timelines assume no active incident. If you’ve had one, contact your cyber insurer’s hotline and your IT company first.

2 to 10 staff

• Days 1 to 30: confirm the BAA with your email provider, turn on MFA for every mailbox, give everyone their own login, and start the HHS SRA Tool.
• Days 31 to 60: put EDR on every computer, encrypt laptops, move passwords into a password manager, and set up a backup copy that isn’t on the office network.
• Days 61 to 90: finish the risk analysis and risk management plan, run a first phishing test, and write a one-page incident response plan.

11 to 25 staff

• Days 1 to 30: everything above, plus an inventory of every device, including imaging and lab equipment.
• Days 31 to 60: managed EDR or MDR so alerts don’t sit unread, separate admin accounts, and a list of every vendor that touches PHI with a BAA for each.
• Days 61 to 90: a test restore, monthly training, and a tabletop run of the incident plan.

26 to 50 staff or several locations

• Days 1 to 30: consider an outside risk assessment, since the scope is bigger.
• Days 31 to 60: MDR with 24/7 coverage, network segmentation between clinical devices and guest Wi-Fi, and centralized logging.
• Days 61 to 90: written security expectations for your IT provider, an annual training calendar, and a review of what your cyber insurer asked at the last renewal.

The cyber insurance requirements guide lines these steps up with renewal questions. Dental offices have extra items, like imaging PCs and shared front desk logins, covered on the dental office page.

The proposed Security Rule update

None of those proposals is a legal requirement today. Many of them already show up in HICP, in the CPGs and on insurance applications, so doing them now is rarely wasted.

Common mistakes

1. Buying tools before the risk analysis. You end up paying for features you don’t need and missing the gap that matters, like a backup drive that’s always plugged in.
2. Treating a vendor certificate as compliance. A “HIPAA compliant” badge or a signed BAA covers the vendor’s side. Your configuration, policies and training are still yours.
3. Shared logins at the front desk. The rule requires unique user identification under 164.312(a)(2)(i). Shared accounts also make any investigation guesswork.
4. EDR with nobody watching. An alert that sits in an inbox at 2 am doesn’t stop ransomware. Decide who responds, or pay for managed EDR or MDR.
5. Backups on the same network. Ransomware that encrypts your server can reach a mapped backup drive. Keep one copy offline or immutable, and test a restore.
6. Ignoring the IT company’s own access. Your outside IT provider likely needs a BAA, and MFA on its remote tools.

Definitions for terms like ePHI, MDR and immutable backup are in the glossary.

If you want me to line up these services for your practice and compare at least two options for each gap, send me your practice details through the quote form.