# Security for medical practices, dental offices and health centers

> Medical practices, dental offices and community health centers that handle electronic patient records must meet the HIPAA Security Rule at 45 CFR Part 164, Subpart C. CyberAccord helps them complete an accurate risk analysis, put administrative and technical safeguards in place, manage protection day to day, and keep the documentation regulators expect.

Source: https://www.cyberaccord.com/industries/healthcare · Last reviewed: 2026-10-22

The HIPAA Security Rule expects a documented risk analysis, safeguards that follow from it, and agreements with every vendor that touches patient data. We help practices do that work and keep the evidence current.

## Key facts

- **Rule:** HIPAA Security Rule, 45 CFR 164.302–318
- **First requirement:** An accurate, thorough risk analysis
- **Vendors:** Business associate agreements required
- **Certification:** None exists for HIPAA; evidence does

## The obligations and risks you face

### A documented risk analysis comes first

Section 164.308(a)(1) requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of electronic patient information, and security measures that reduce those risks to a reasonable level. It also requires regular review of audit logs and access reports. A risk analysis that is years old, or that skips cloud systems, is a common gap.

Source: [45 CFR 164.308, Administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)

### Technical safeguards on every system that holds patient data

Section 164.312 sets standards for access control, audit controls, integrity, authentication and transmission security. That reaches the practice management system, imaging, email, and every laptop and phone used to reach them, not only the electronic health record.

Source: [45 CFR 164.312, Technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)

### Every vendor that touches patient data needs an agreement

Billing services, IT providers, cloud hosts and imaging vendors that create, receive, maintain or transmit electronic patient information are business associates. Section 164.314 sets what the contract must contain, including flowing the same duties down to their subcontractors.

Source: [45 CFR 164.314, Organizational requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.314)

### Breach notification runs on a fixed clock

When unsecured patient information is breached, the Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Knowing what happened quickly depends on logging and monitoring being in place beforehand.

Source: [45 CFR 164.404, Notification to individuals](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404)

## What we recommend

- [Managed Security](https://www.cyberaccord.com/services/managed-security)
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso)
- [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing)

## Applicable frameworks

- [HIPAA](https://www.cyberaccord.com/compliance/hipaa)
- [NIST](https://www.cyberaccord.com/compliance/nist)

## Frequently asked questions

### Is there such a thing as HIPAA certification?

No. HHS does not certify organizations for HIPAA compliance, and no outside certificate replaces your own obligations. What protects you is a current risk analysis, safeguards that follow from it, signed business associate agreements, and records showing the work was done.

### How often should we redo the risk analysis?

The rule requires the analysis to be accurate and the program to be reviewed and updated as needed. In practice, update it at least yearly and whenever you change systems, open a location or add a major vendor.

### Our EHR is cloud-hosted. Doesn't the vendor handle security?

The vendor secures its platform under a business associate agreement. You still control who has access, how staff sign in, the devices they use, and the email and file sharing around the record. Those remain your responsibility.

### Do community health centers have extra obligations?

Often. Centers that run substance use disorder programs may also fall under 42 CFR Part 2, which requires formal policies to protect those records. Federal grant terms and HRSA site visits also look at how patient information is protected.

### What does a dental office need beyond antivirus?

Multi-factor authentication on email and remote access, managed protection on every workstation including imaging PCs, tested offline backups, staff training, and a written risk analysis. Those cover the areas the Security Rule and most cyber insurers ask about.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com