Medical, Dental and Community Health
Security for medical practices, dental offices and health centers
The HIPAA Security Rule expects a documented risk analysis, safeguards that follow from it, and agreements with every vendor that touches patient data. We help practices do that work and keep the evidence current.
- Rule
- HIPAA Security Rule, 45 CFR 164.302–318
- First requirement
- An accurate, thorough risk analysis
- Vendors
- Business associate agreements required
- Certification
- None exists for HIPAA; evidence does
At a glance
Medical practices, dental offices and community health centers that handle electronic patient records must meet the HIPAA Security Rule at 45 CFR Part 164, Subpart C. CyberAccord helps them complete an accurate risk analysis, put administrative and technical safeguards in place, manage protection day to day, and keep the documentation regulators expect.
HIPAA Security Rule, 45 CFR Part 164 Subpart C
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
A documented risk analysis comes first
Section 164.308(a)(1) requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of electronic patient information, and security measures that reduce those risks to a reasonable level. It also requires regular review of audit logs and access reports. A risk analysis that is years old, or that skips cloud systems, is a common gap.
Source45 CFR 164.308, Administrative safeguards (opens in a new tab)
Technical safeguards on every system that holds patient data
Section 164.312 sets standards for access control, audit controls, integrity, authentication and transmission security. That reaches the practice management system, imaging, email, and every laptop and phone used to reach them, not only the electronic health record.
Source45 CFR 164.312, Technical safeguards (opens in a new tab)
Every vendor that touches patient data needs an agreement
Billing services, IT providers, cloud hosts and imaging vendors that create, receive, maintain or transmit electronic patient information are business associates. Section 164.314 sets what the contract must contain, including flowing the same duties down to their subcontractors.
Source45 CFR 164.314, Organizational requirements (opens in a new tab)
Breach notification runs on a fixed clock
When unsecured patient information is breached, the Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Knowing what happened quickly depends on logging and monitoring being in place beforehand.
Source45 CFR 164.404, Notification to individuals (opens in a new tab)
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
- 2 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- 3 · Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
FAQ
Sector questions, answered
Is there such a thing as HIPAA certification?
No. HHS does not certify organizations for HIPAA compliance, and no outside certificate replaces your own obligations. What protects you is a current risk analysis, safeguards that follow from it, signed business associate agreements, and records showing the work was done.
How often should we redo the risk analysis?
The rule requires the analysis to be accurate and the program to be reviewed and updated as needed. In practice, update it at least yearly and whenever you change systems, open a location or add a major vendor.
Our EHR is cloud-hosted. Doesn't the vendor handle security?
The vendor secures its platform under a business associate agreement. You still control who has access, how staff sign in, the devices they use, and the email and file sharing around the record. Those remain your responsibility.
Do community health centers have extra obligations?
Often. Centers that run substance use disorder programs may also fall under 42 CFR Part 2, which requires formal policies to protect those records. Federal grant terms and HRSA site visits also look at how patient information is protected.
What does a dental office need beyond antivirus?
Multi-factor authentication on email and remote access, managed protection on every workstation including imaging PCs, tested offline backups, staff training, and a written risk analysis. Those cover the areas the Security Rule and most cyber insurers ask about.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.