HIPAA tells you to safeguard ePHI. It does not tell you whether your safeguards actually work. This page explains the difference and what small healthcare practices should do about it.
Most small healthcare practices we talk to have a HIPAA binder somewhere. Policies signed. Annual training completed. A business associate agreement on file with the billing company. And still, when you ask a direct question — who would notice if a front-desk mailbox were taken over on a Tuesday afternoon, and how long would it take? — the room gets quiet.
That gap is the real issue. HIPAA cybersecurity is not the same thing as HIPAA documentation. The Security Rule requires administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. It does not audit your firewall rules, test your backups, or confirm that multifactor authentication is actually enforced on every account that touches ePHI. Those things are your responsibility to verify.
The numbers explain why it matters for practices under 100 employees. Healthcare made up roughly 7% of global breach counts in 2023 but about 31% of exposed records. Providers with fewer than 50 employees experienced roughly three times the breach rate of large providers, and small to mid-size providers accounted for about 70% of healthcare breaches. Attackers are not skipping your dental practice, eye care clinic, or surgery center because you are small. In many cases they choose you because you are.
This page covers what the HIPAA Security Rule actually requires in technical terms, where small practices commonly fall short, and how to tell the difference between having a control and knowing it works.
A practical walk through the technical safeguards under HIPAA, the ePHI safeguards small practices most often get wrong, and how to test whether your controls hold up.
HIPAA compliance vs cybersecurity is the distinction that trips up most practice leaders. Compliance is a legal standard measured against documentation and reasonable effort. Cybersecurity is an operational outcome measured against an attacker. You can be defensibly compliant on paper and still lose a week of scheduling to ransomware. You can also run strong security and still fail an audit because nothing was written down. Both matter. They are not interchangeable.
The Security Rule's technical safeguards break into five areas: access control, audit controls, integrity controls, person or entity authentication, and transmission security. Translated into plain English, that means every user has a unique login and only the access their job requires; system activity is logged and someone reviews those logs; ePHI cannot be altered or destroyed without detection; identities are verified before access is granted; and data is encrypted in transit. Encryption is technically an addressable specification rather than a flat requirement, but if you skip it you must document why and implement an equivalent alternative. In practice, for a small practice, encrypting laptops and email is easier to defend than explaining why you did not.
Here is where small practices usually come up short. Shared logins at the front desk defeat audit controls entirely, because you cannot attribute an action to a person. Former employees retain access to the EHR or the practice email tenant months after departure. Audit logs exist but nobody reads them, which satisfies the letter of the requirement and none of its purpose. Multifactor authentication is enabled for administrators but not for the clinical staff whose inboxes contain referrals, imaging links, and patient correspondence. And backups are configured, but no one has attempted a restore in over a year. A backup you have never restored is an assumption, not a control. Our vulnerability management and email security pages go deeper on two of the most commonly neglected areas.
HHS and NIST have published crosswalks mapping HIPAA Security Rule requirements to the NIST Cybersecurity Framework and SP 800-53 controls. That mapping is useful because it gives a small practice a concrete control set to work from rather than reading regulatory language and guessing. It also makes clear that HIPAA's expectations are risk-based: what is reasonable for a 12-person ophthalmology practice differs from a 400-bed hospital, but the reasoning behind your decisions needs to be documented and current.
That documentation starts with the required risk analysis. A HIPAA security risk analysis is not a checklist exercise — it is supposed to identify where ePHI lives, who can reach it, what could go wrong, and what you are doing about it. Practices that treat it seriously usually discover systems and vendor connections they had forgotten existed. Medical device exposure is a growing example: reported device-related attacks rose roughly 60% in 2023 over 2022, and about 35% of providers acknowledged at least one device-related breach. Imaging systems, ophthalmic equipment, and dental sensors often sit on the same network as clinical workstations with no one tracking their patch status.