HIPAA Cybersecurity for Medical and Dental Practices

Why health care is the top target

Patient records are valuable, and medical offices cannot afford downtime, which makes them a favorite target. In the FBI’s 2025 Internet Crime Report, the health care and public health sector faced the most cyber threats of all 16 critical infrastructure sectors, including 460 ransomware attacks and 182 data breaches. Across all industries, the FBI received more than 1 million complaints with reported losses near $21 billion, and business email compromise alone accounted for about $3 billion.

Small practices are not too small to matter. They are often the easier way in, especially through a vendor, a shared password or an unpatched computer.

What the HIPAA Security Rule requires today

The Security Rule applies to covered entities, such as medical, dental and vision practices, pharmacies, clinics and health plans, and to their business associates. It requires them to protect electronic patient information with three kinds of safeguards:

• Administrative. A written risk analysis and risk management plan, a named security official, workforce training, access management, a contingency plan with data backup and disaster recovery, and incident procedures.
• Physical. Control over who can get to workstations, servers and devices, and rules for disposing of and reusing equipment and media.
• Technical. Unique user logins, automatic logoff, audit logs, integrity controls and secure transmission. Encryption is currently addressable, which means you must use it or document why an equivalent measure is reasonable.

The risk analysis is the foundation. It has to cover every place patient data lives or travels, including laptops, phones, email, cloud apps, the practice management system and backups.

The proposed update, and what to do now

On January 6, 2025, HHS proposed a major update to the Security Rule. The comment period closed on March 7, 2025, and as of October 2026 the rule has not been finalized. As proposed, it would:

• Make encryption and multifactor authentication required in most cases.
• Require a written technology asset inventory and network map, reviewed at least every 12 months.
• Set more specific requirements for what the risk analysis must include, also reviewed every 12 months.
• Turn most of today’s addressable specifications into required ones.

None of that has legal effect until a final rule is published. But encryption, MFA and an asset inventory are also what cyber insurers and attackers care about, so practices that put them in place now are better protected today and ready if the rule is finalized.

Your IT provider is a business associate

If an IT company, cloud service, billing firm or answering service can access your patient data, it is likely a business associate and must sign a business associate agreement. Before you hire a managed IT or security provider, confirm it will sign one, explain how it protects your data and tell you how it will notify you of an incident. We check this for every provider we put in front of you.

Missouri and Kansas add their own rules

HIPAA’s breach rule requires notice to affected patients no later than 60 days after discovery, plus notice to HHS for breaches of 500 or more people, and to local media when 500 or more residents of a state are affected. State laws add more. Missouri’s breach law covers medical and health insurance information and requires notice to the Attorney General when more than 1,000 residents are notified. Kansas’s law does not include medical information in its definition. Our Kansas City cybersecurity page compares the two side by side.

How we help

We are an independent advisor, not a security vendor. We compare vetted managed IT and security providers that work with health care, line up their scope, response times and pricing, confirm they will sign a business associate agreement, and map their services to your cyber insurance application. Then we coordinate the work and stay involved. Local help: St. Joseph, Kansas City and Overland Park.

This page is general information, not legal advice. For decisions about your obligations, talk with your attorney or compliance advisor.