The most common thing we hear from small practices is some version of: "Our IT person set up a firewall and antivirus, so we're HIPAA compliant."
Both are real security controls, and you should have them. But neither is close to sufficient, and the framing itself is the problem. It treats compliance as a technology purchase. It isn't one.
No product is "HIPAA certified"
HHS does not certify or endorse any hardware or software. A vendor can be HIPAA-eligible: it will sign a business associate agreement, and its service can be configured to support your obligations. But the configuration, and the documentation proving it, are yours.
Technology is about a third of the work
The rest is the risk analysis, written policies, workforce training, agreements with every vendor that touches patient data, and the records that prove each of those happened. A practice with an excellent firewall and no risk analysis is in a worse position than a practice with modest equipment and a complete, honest one.
What an investigator asks for first
An Office for Civil Rights (OCR) investigation usually starts with a patient complaint, a breach the practice reported itself, or an audit. The first requests are for documents, not packet captures: your risk analysis, your policies, training records, business associate agreements, and evidence that someone reviews activity logs.
The most common finding in OCR settlements with small providers is the absence of an accurate and thorough risk analysis. Not a weak firewall. The missing document.
What the Security Rule actually asks for
- A Security Official named in writing, a person in your practice
- An enterprise-wide risk analysis and a plan to manage what it finds
- Workforce access controls, training, and a sanction policy
- Incident response procedures and a contingency plan: backup, disaster recovery, emergency operation
- Business associate agreements with every vendor handling patient data
- Facility, workstation and device safeguards
- Technical controls: unique logins, audit logs, integrity, authentication, encryption in transit
- Written policies, with documentation kept six years
The firewall and antivirus support a few of those lines. Most of the list is people, process and paper.
Where to start this week
- Name your Security Official in a one-sentence memo, signed and dated by the practice owner.
- List every vendor that handles patient data (EHR, billing, fax, email, backup, IT support) and check that you have a signed BAA with each one.
- Schedule a risk analysis. Everything else hangs from it.