Awareness Is Not the Bottleneck
Every October brings a wave of security-awareness material into healthcare organizations, and most of it tells people things they already know. Staff know phishing exists. They know passwords matter. Awareness has not been the limiting factor in healthcare security for years.
The limiting factor is that specific, unglamorous changes never get assigned to anyone. So here are ten of them, each scoped to be finishable, and each chosen because it maps to something that actually shows up in breach data or enforcement findings. Work down the list in order; it is roughly sequenced by risk removed per hour spent.
1. Turn on MFA for remote access and email — today
Stolen credentials remain the most reliable way into a healthcare network, and remote access without a second factor is the single most exploited gap in ransomware cases. If you do only one item on this list, do this one. Then read why not all MFA is equal and plan an upgrade from SMS codes to app-based or hardware factors.
2. Find out who still has access who should not
Pull the user list from your EHR, your email, and your practice management system, and compare it against current staff. Nearly every practice finds at least one account belonging to someone who left. Departed-employee accounts are a standing finding in enforcement actions and a favorite path for intruders, because nobody notices the login.
3. Confirm your backups restore, not just that they run
A backup job reporting success is not evidence of a recoverable backup. Pick one file and one system, restore them, and write down that you did it with the date. Practices discover their backups were silently broken at the worst possible moment — after encryption, when it is the only remaining option.
4. Patch what is internet-facing first
Not everything, and not on a perfect schedule. Start with anything reachable from outside: the VPN appliance, the firewall, the remote desktop gateway, the patient portal. Our piece on the 14-day rule and the KEV catalog explains how to triage this when you cannot patch everything.
5. Encrypt the laptops
Full-disk encryption is built into current Windows and macOS and takes minutes per machine. An encrypted device that goes missing is generally not a reportable breach; an unencrypted one is a notification event with letters, a portal posting, and possibly an investigation. The cost difference is enormous and the effort difference is nearly zero.
6. Write down every vendor that touches PHI
One list, one owner, one afternoon. You will need it the day a vendor calls with bad news, and as we covered in the 2026 vendor breach numbers, that call is now the most likely way a breach reaches your patients.
7. Check where PHI is leaving by text and email
Ask three staff members how they send a referral, a result, or a question about a patient to a colleague after hours. The answers usually include a personal phone. Our list of 8 ways practices leak PHI over text and email covers the fixes, most of which involve giving people a sanctioned option rather than a rule.
8. Log the records requests
Date received, what was asked for, date fulfilled. Two minutes per request, and it is the entire defense in a Right of Access complaint — the most-settled category of HIPAA enforcement there is.
9. Look at your audit logs once
Not continuously. Once. Pick a week, open the EHR access log, and look for anything odd: access outside working hours, one account touching an unusual number of charts, a record viewed by someone with no treatment relationship. Reviewing logs is required, and as we noted in the requirement almost everyone logs and almost nobody reviews, generating logs is not the same as satisfying it.
10. Decide who to call before you need to
Write three names on one page: who leads your response, which outside IT or security firm you call, and which attorney. Tape it somewhere physical. In an actual incident the network may be the thing you cannot use, and the time spent deciding is time the incident keeps running.
Finish Three, Not Ten
If you assign all ten this month, most practices complete none. Pick the first three, give each one a name and a date, and confirm they are done before November. Three closed items is a materially better security position; ten open ones is the same position with a longer list.
And write down what you did. A dated record of remediation is exactly what regulators now look for — the work matters, and being able to show the work is what turns it into a defense.
Related Reading
- 10 HIPAA security tips you can implement this week
- 7 ransomware defenses, ranked by impact
- OCR now asks what you did about your risk analysis
- The 90-minute quarterly HIPAA mini-audit
Call to Action
Want these tracked with owners and dates instead of living in a blog post? Schedule a walkthrough of HIPAA Security Suite, or take the 3-minute readiness quiz to see which of the ten you most need.