A health care town
Mosaic Life Care’s St. Joseph medical center is a 358-bed teaching hospital and the only tertiary hospital between Kansas City and Omaha, and the health system is the region’s largest employer, with more than 5,000 caregivers and more than 60 locations. Around it sits a network of independent practices, pharmacies, home health agencies and vendors that touch patient data.
Attackers know where the data is. In the FBI’s 2025 Internet Crime Report, the health care and public health sector faced the most cyber threats of the 16 critical infrastructure sectors, including 460 ransomware attacks. A small clinic or billing company is often an easier way in than a hospital.
What HIPAA requires today
- A written risk analysis of every place you store or send electronic patient information, followed by a plan to reduce the risks you find.
- Safeguards such as access controls, audit logs, backups, security training and a plan for incidents.
- Business associate agreements with every vendor that handles patient data for you, including your IT provider.
- Breach notification. Under HIPAA, affected patients must be told without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS at the same time, and to local media when 500 or more residents of a state are affected.
HHS proposed a major update to the Security Rule in January 2025 that would make encryption and multifactor authentication required in most cases and add an annual asset inventory and network map. As of October 2026 it is not final, but practices that start now will be ready either way. Our HIPAA cybersecurity guide covers it in detail.
How we help St. Joseph practices
We do not sell one security product. We compare vetted managed security providers that work with health care, line up their scope, response times and pricing side by side, and make sure the one you pick signs a business associate agreement. Because our office is here in St. Joseph, we can sit down with you in person. For day to day IT support, see managed IT in St. Joseph.
This page is general information, not legal advice. For decisions about your obligations, talk with your attorney or compliance advisor.
