HIPAA security risk assessments for small practices in Hampton Roads
Every dental and medical practice that keeps patient records is required to have one. I do the assessment, write the report in plain English, and walk you and your IT provider through what to fix. Fixed price, about three weeks, no disruption to patients.
Findings summary
Page 3 of 14
Security risk analysis for an 11-person dental practice in Chesapeake
- 1 Email has no second sign-in step High One stolen password opens every patient message. Turn on multi-factor sign-in for all 11 mailboxes; about an hour for your IT provider.
- 2 Backups go to a drive that stays plugged in High Ransomware would lock the backup along with the server. Keep one copy offline and test a restore every quarter.
- 3 Front desk shares one computer login Medium There is no record of who opened which chart. Give each person their own login.
- 4 No signed business associate agreement with the imaging vendor Medium Request their standard agreement and keep it on file.
- 5 Check-in screen is visible from the waiting room Low Turn the monitor or add a privacy filter.
Most practices find out they need this the hard way
The HIPAA Security Rule requires a documented risk analysis no matter how small the office. Here is when it usually comes up.
- Your cyber insurance renewal asks for it
- Insurers increasingly ask whether you have a current risk assessment, and a "no" can raise your premium or limit your coverage.
- A patient complaint or a lost laptop
- When the HHS Office for Civil Rights investigates, the risk analysis is one of the first documents it asks to see. Not having one is among the most common findings.
- You changed something big
- A new EHR or imaging system, a second location, or a new IT provider all change where patient data lives and who can reach it.
- "Our IT company said we're fine"
- Your IT provider keeps systems running. A risk analysis is a separate, written assessment of risk to patient data, and most IT providers are glad to have one to work from.
How it works
About three weeks from the first call to your finished report. Everything that happens in your office is scheduled around your patients.
-
A 15-minute call
We talk about your practice, your systems and your deadline. You get a fixed price before you commit to anything.
15 minutes
-
A short questionnaire
Your office manager answers questions about staff, software, vendors and backups. We both sign a business associate agreement first.
About an hour of your staff's time
-
A walkthrough of your office
I look at computers, the network, the front desk, backups and how records move. Before opening, after close, or on a Saturday.
About 2 hours on site
-
Your report and a review meeting
Every finding ranked by risk, with a plain-English fix. I walk you through it and answer your IT provider's questions.
1-hour meeting, in person or by video
Founding client rate
ByteTempest is new, so I'm offering the complete risk assessment to my first practices at a reduced price. In return I ask for honest feedback and, only if you're happy with the work, a short testimonial I can share.
Practices up to 15 staff, one location. Same scope as the standard assessment.
5 founding spots left
You'll work with me the whole way
I'm Brian. I hold a B.S. and M.S. in Cybersecurity, and I started ByteTempest because small practices carry the same obligations as hospital systems with none of the security staff.
There's no sales team and no hand-off to a junior analyst. The person on your first call is the person who walks your office and writes your report.
Questions practices ask
Something else on your mind? Ask me directly.
Is this really required for a practice our size?
Yes. The HIPAA Security Rule requires every covered practice to conduct an accurate and thorough assessment of the risks to the electronic patient information it holds. There's no small-practice exemption. What changes with size is how much work it takes, which is why a small practice doesn't need an enterprise-sized engagement.
We already have an IT company. Doesn't that cover it?
Usually not. Keeping computers and the network running is different from assessing and documenting risk to patient data. I work alongside your IT provider rather than replacing them, and the report gives them a clear, prioritized list to act on.
Will this interrupt patient care?
No. The on-site walkthrough happens before opening, after close, or on a Saturday, and the questionnaire takes your office manager about an hour.
How do you handle our patient information?
We sign a business associate agreement before I start. I don't copy patient records. The assessment looks at systems and practices, not charts. My working notes are stored encrypted and deleted after your report is delivered, unless you ask me to keep them for next year's update.
Is this a HIPAA certification?
No, and be wary of anyone who sells one. HHS doesn't certify practices as HIPAA compliant. What you get is the documented risk analysis the Security Rule requires, plus a plan to reduce the risks it finds.
How often do we need to do this?
HHS expects the risk analysis to be reviewed and updated regularly, and whenever something significant changes in your office. Most practices update it every year. If you're on the compliance care plan, the yearly update is included.
TempestVitals
Free and charitable clinics serve the patients with the least margin for a breach, often with no budget for security. Each year I do 4 complete risk assessments for qualifying Hampton Roads clinics at no cost.
For IT providers
If you support medical or dental offices and your clients keep asking about HIPAA, I can do the risk assessment while you keep the relationship and do the fixes.
Find out where your practice stands
A 15-minute call is enough to tell you whether you need a full assessment and what it would cost. No obligation, and no sales pitch.