My partner and I recently visited with a physician who runs a thriving primary care practice in an affluent retirement community to discuss the state of his practice’s IT security program. He reached out to us after receiving an inquiry about whether his practice was HIPAA compliant. The practice consists of himself, a small team of Family Nurse Practitioners and admin staff. He has been in the same location for over 30 years and is a well-known and trusted physician in the community.

We started the meeting by asking a series of questions about the security measures he had in place to protect his patient’s confidential data (ePHI). It became apparent to us that although he provided outstanding patient care, he had not invested the time to learn basic security principles to keep his patient’s data secure within the practice. When we asked him about the last HIPAA Security Risk Analysis he conducted, he looked at us with a blank stare and said, “I’m not sure what you are asking.” After explaining this was an annual requirement under the HIPAA Security Rule, he asked… and I quote,

“So… is this HIPAA Security thing a law?”

At first, my partner and I looked at each other thinking he was playing with us… or trying to test our knowledge of compliance in healthcare. Neither was true. He was sincerely uncertain whether or not HIPAA was a federal law. That was a sobering moment for him and me.

It was at that moment we realized just how uneducated small-midsize businesses (SMB) are when it comes to having basic IT security practices in place. It reinforced our decision that leaving the enterprise security world after many years to help SMBs with security and compliance issues was the right move to make and we had our work cut out for us.  The fact is, most IT security consulting firms are still trying to keep up with the demand for cybersecurity services from the enterprise world, which has left small-midsize businesses severely under served. GoldSky Security exists to serve SMBs, at rates they can afford.

As we were winding the down our visit, we suggested performing a HIPAA Security Risk Assessment to help identify threats and vulnerabilities within the practice. Then we would provide a list of remediation items that would reduce his risk of a data breach in the future.