Managed IT and Cybersecurity for Columbus Medical and Dental Practices

Our EHR vendor handles security, right?

For its own platform, yes. An EHR host is a business associate, directly liable under the Security Rule for what it holds. Its responsibility stops there. It does not reach the workstations, the email or the network on your side, and the business associate agreement does not move your obligations onto the vendor.

Your risk analysis has to cover all the electronic patient information you create, receive, keep or send, and none of this lives inside the EHR:

• The workstation in the operatory.
• The laptop at the front desk.
• The email that carries a referral.
• The multifunction scanner.
• The wireless network clinical devices share with everything else.

If the vendor has a breach of unsecured patient information, it has to tell you without unreasonable delay and within 60 days of discovering it. Your own duty to notify patients runs from your discovery, on the same standard. Depending on the relationship, the vendor’s discovery can count as yours, which is worth settling in the contract before it matters. Breaches also go to HHS: at the same time as the patient letters when 500 or more people are affected, and within 60 days after the end of the calendar year when fewer are. Either way, the letters go out with the practice’s name on them.

Covering your side of that line is Managed IT and cybersecurity work, separate from whatever the EHR vendor secures on its own platform.

Ransomware locked our files. Is that a HIPAA breach?

OCR’s position is that when ransomware encrypts unsecured patient data, an impermissible disclosure has occurred and a breach is presumed. A clean restore brings the data back, but it does not end that presumption.

The way out is a documented four-factor risk assessment showing a low probability that the information was compromised, and the practice carries that burden of proof. So the line between an IT incident and a breach with patient letters often comes down to how good the logging and documentation were before the attack.

The Security Rule already requires a data backup plan, a disaster recovery plan and an emergency mode operation plan. Beyond that minimum, three things get a practice through a ransomware event:

• Backups you have restored from.
• Copies an attacker holding your admin credentials cannot reach.
• A written answer to how you keep seeing patients while systems are down.

An honest risk analysis points at those anyway. A backup you have restored from is the floor.

Can we prove the controls our cyber insurance renewal asks about?

The questionnaire is short, and the questions are narrower than they look. Is multifactor authentication enforced on email and remote access? Is endpoint detection on every workstation and server? Are backups tested by restoring from them? Do staff complete security training, and how often? You sign the form, so the answers are yours to stand behind.

For a small practice the gap usually shows up in the exceptions. Most practices find accounts sitting outside multifactor authentication: a shared front-desk login, the mailbox the scanner sends to, a service account a legacy imaging system uses. Proving “enforced” means producing the policy, the accounts it covers, and each exception with a reason next to it.

The rest work the same way. Endpoint coverage is a report measured against a device inventory. A restore test is a date, the systems restored and the result. Training is completion records with names on them. None of it comes from your EHR host, whose security attestation describes its platform, not your side of the line.

Our Compliance-as-a-Service work tracks those records between renewals, so the next questionnaire is a file you update instead of a month of asking around.

What does the HIPAA Security Rule require of a small practice?

HIPAA covers any health care provider who transmits health information electronically in connection with a covered transaction, which any practice that bills insurance electronically does. The Security Rule applies to covered entities and business associates alike, with no threshold for headcount, revenue or number of providers. A two-dentist office and a hospital system are equally covered.

Two requirements sit at the center. The first is a risk analysis: an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of the electronic patient information you hold. The second is risk management: security measures that bring those risks down to a reasonable and appropriate level. Both are required.

Other safeguards, including encryption, are labeled addressable. That does not mean optional. It means you assess whether the safeguard is reasonable and appropriate, put it in place where it is, and document why where it is not, with an equivalent alternative where one fits.

The rule lets a practice weigh its size, complexity, technical capabilities and the cost of security measures. That shapes how you comply, not whether you must. Our cybersecurity and virtual CISO work with medical and dental practices starts there, with what a risk analysis finds in a specific practice. Then we turn it into security measures, not a document in a drawer.

Is the Security Rule changing, and what about Ohio law?

HHS proposed a major update on January 6, 2025. It would add requirements around multifactor authentication, encryption, asset inventories and network maps, network segmentation and penetration testing, and remove the distinction between required and addressable. The comment period closed on March 7, 2025. It has not been finalized or withdrawn, and HHS now names July 2027 as the anticipated date for final action. The version in force today is the 2003 rule as amended by the 2013 Omnibus Rule, and that is the one to plan against.

Ohio’s breach law, section 1349.19, excludes HIPAA covered entities entirely. A provider that is not a covered entity falls under it, but only for a narrow kind of “personal information,” such as a name paired with a Social Security number. Even then, it applies only where the breach creates a material risk of identity theft or fraud. Notice is due in the most expedient time possible and within 45 days. A breach of clinical records alone can fall outside it.

Almost everything the proposal would mandate is something an honest risk analysis would flag anyway. To find out where you stand, our $349 Security Analysis at https://outreach.ttscyber.com/analysis is an independent assessment mapped to 38 compliance frameworks, with no sales call attached. It is a starting point for the Security Rule risk analysis, not the risk analysis itself.