Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A small medical practice should protect patient information by first identifying where electronic protected health information (ePHI) is stored and how it moves, then assessing risks before choosing safeguards. Build a written plan that covers access controls, remote connections, vendors, backups, recovery, emergency operations, and incident response. Test whether the practice can restore usable clinical data—not just whether a backup copy exists.
HIPAA requirements depend on the organization’s status and circumstances. HHS says small providers may take their size, capabilities, and costs into account when selecting security measures, but should assess risks and vulnerabilities first. A smaller budget can shape how safeguards are implemented; it is not a reason to skip risk analysis or contingency planning.
Start by establishing what the practice must protect
Cybersecurity planning is more manageable when it begins with the information and services needed to deliver care. A practice may depend on an electronic health record (EHR), billing and scheduling systems, email, imaging, staff computers, mobile devices, network equipment, cloud services, and vendors that support those services. Patient information can reside in more places than the main EHR, including scanned documents, email attachments, exports, backups, and devices used remotely.
Confirm HIPAA scope instead of assuming it
HHS describes health care providers that transmit health information electronically in connection with a transaction for which HHS has adopted a standard as covered entities. Whether a particular practice meets the definition is a fact-specific question; do not assume every organization that provides health care has identical obligations. Identify the entity’s status and the systems and vendors involved before deciding which requirements apply. When the answer is unclear, seek qualified compliance or legal advice.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Also identify business associates—organizations that handle ePHI for the practice in a covered role—and understand which services or data they handle. A vendor’s involvement does not remove the need for the practice to understand its own risks, responsibilities, and recovery dependencies. Record vendor contacts and the services each supports so staff know whom to reach during an outage or incident.
Assign an owner and define the care-critical services
Name a person responsible for coordinating the security program, even if that person relies on outside technical support. The owner should know who can approve changes, who maintains vendor relationships, and who can make operational decisions when the usual systems are unavailable. List the clinical and business functions that must continue during an interruption—such as accessing medication and allergy information, documenting encounters, communicating with patients, and submitting claims—and the systems each function depends on.
Perform a risk analysis before buying or configuring controls
HHS advises small providers to assess risks and vulnerabilities before deciding on additional safeguards. Its Security Risk Assessment Tool is intended to help small and medium practices. A useful analysis is not simply a checklist marked complete: it identifies ePHI, the threats and weaknesses that could affect it, the safeguards already in place, and the gaps that need decisions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Build a practical inventory
Document where ePHI is created, received, stored, transmitted, and backed up. Include devices, applications, locations, users, remote connections, and third parties. For each item, note who is responsible for it and what would happen to patient care if it were unavailable, altered, or disclosed. Include less obvious copies such as exported reports, email, removable media, and vendor-hosted data where applicable.
Then consider plausible threats and vulnerabilities in the practice’s actual environment. Examples to examine include stolen or shared credentials, an unattended device, an unpatched or unsupported system, a compromised remote connection, accidental deletion, equipment failure, or ransomware. These are prompts for assessment, not a claim that every practice faces the same level of risk.
Rank gaps and document decisions
Prioritize weaknesses by their potential effect on confidentiality, integrity, and availability of ePHI and on the ability to deliver care. For each significant gap, record the current safeguard, the change being considered, the person responsible, and how the practice will know the change works. If the practice chooses a different measure or accepts a residual risk, document the rationale and review it when systems, vendors, or operations change.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
HHS allows covered entities—including small providers—to use security measures that reasonably and appropriately implement the Security Rule standards. The practice can account for its size, capabilities, and costs, but should make those choices against the risks it identified rather than selecting controls solely because they are inexpensive or familiar.
Apply safeguards that match the risks
HHS 405(d) guidance for small organizations identifies practices to consider, including multifactor authentication (MFA), limiting remote desktop access, controlling authentication attempts, anti-malware, separating vulnerable systems, and maintaining an updated asset inventory. The appropriate combination depends on the practice’s risk analysis, existing technology, and vendor requirements. Confirm compatibility before changing systems that support clinical care.
Strengthen identity and account access
- Use strong, unique credentials for accounts that access ePHI; avoid shared logins where individual accounts can be used.
- Enable MFA for supported accounts, especially those used for remote access, email, administrative functions, and systems containing ePHI. A particular MFA method is suitable only if the service supports it and the practice can manage it reliably.
- Limit access to the information and functions each user needs for their role. Review accounts when staff responsibilities change and promptly disable access when it is no longer needed.
- Control repeated authentication attempts and have a process for responding to unusual sign-in activity, locked accounts, or suspected credential compromise.
Reduce exposure from remote access and endpoints
Inventory remote access methods and restrict them to approved users and business needs. HHS 405(d) specifically recommends limiting remote desktop access; do not leave remote services broadly reachable without evaluating the risk and applying appropriate protections. Make sure staff understand approved ways to connect and whom to contact if access stops working or seems unfamiliar.
Maintain anti-malware protection and keep an accurate inventory of computers, servers, mobile devices, and other relevant assets. Know which systems are vulnerable or difficult to update, and assess whether separation from other systems would reduce the consequences of compromise. Changes should be planned with the EHR and other vendors where dependencies or support conditions could affect clinical operations.
Make the controls part of ordinary operations
Assign responsibility for routine account changes, asset updates, and review of safeguards. Keep a simple record of the control, its owner, and the event that prompts reassessment—for example, adopting a new cloud service, changing remote access, adding a clinical device, or changing a vendor. A control that is not maintained can become ineffective as the practice changes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDesign backups around recovery, not just storage
HHS describes a data backup plan as a required element of the Security Rule contingency plan for covered entities and business associates. Its contingency-planning elements also include restoring data, continuing critical functions in emergency mode, analyzing criticality, and periodically testing the plan. The practical goal is to recover the information and applications needed for care while reducing the chance that the same incident disables both production systems and their backups.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Decide what must be recoverable and how quickly
List the data, applications, and configurations needed to resume priority functions. A copy of files alone may not be enough if the practice also needs the EHR application, a database, user access, or instructions for rebuilding the system. Work with relevant vendors to understand what they back up, what the practice must back up separately, and how restoration works.
Set backup frequency and retention according to the practice’s operational needs, the amount of data it can afford to lose, and how long it can function without a system. These are practice-specific decisions; HHS’s cited material does not establish one universal schedule. Decide who can initiate or approve a restore, how staff will access necessary information during recovery, and how restored data will be checked before normal workflows resume.
Separate backup access from the attack surface
HHS 405(d) ransomware guidance recommends that backups not be accessible on the network they protect. The practice should consider how backup copies are protected against unauthorized access, alteration, deletion, physical loss, and compromise of the production network. Account permissions, encryption, physical security, and separation from everyday network access all belong in the local design where appropriate.
An external drive can be one component of a separate copy, but buying a device alone does not establish a sound backup strategy or demonstrate compliance. The practice still needs to decide what is copied, how often, who controls the copy, how it is protected, and whether the data can actually be restored. Automation may reduce the chance that a backup is forgotten, while access restrictions and secure storage help protect it; evaluate these choices against the practice’s environment.
Test complete restores and keep evidence
Test restoration periodically, as part of the contingency plan, and after material changes to systems or backup arrangements. Check that restored information is readable and usable and that required applications or workflows can operate. A successful file copy is not proof that the practice can return to clinical operations.
Record the test date, scope, outcome, problems found, and corrective actions. If a restore fails or takes longer than the practice can tolerate, revise the process, responsibilities, or technical arrangement and test again. The plan should name the people authorized to restore data and identify how they obtain necessary credentials and vendor assistance when normal systems are unavailable.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Plan for outages and rehearse incident response
Backups are one part of continuity. The practice also needs an emergency mode plan for maintaining critical functions while systems are unavailable, a disaster recovery process for restoring systems and data, and a criticality analysis that helps prioritize recovery. Write procedures in terms staff can follow, including who makes decisions and where to find current vendor and internal contacts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare staff for the first response
Maintain incident procedures and rehearse them so that employees know how to report a suspected security event, whom to notify, and what not to do. Include internal contacts and relevant vendors. Staff should not independently erase devices, reinstall systems, or alter potentially affected evidence unless directed by the response lead; preserve information that may help determine what happened.
During an event, identify affected systems and the ePHI involved, coordinate with technical responders and vendors, and determine what services can safely continue. The recovery playbook should explain how to isolate affected systems when appropriate, prioritize restoration, validate recovered data, and communicate operational instructions to staff. The precise technical steps depend on the incident and environment, so define roles and decision authority in advance rather than relying on an improvised response.
Assess privacy and notification obligations separately
HHS treats ransomware as a security incident; depending on the circumstances, it may also involve an impermissible disclosure or breach. Restoring systems does not answer whether PHI was accessed, acquired, viewed, or exfiltrated, nor whether notifications are required. The practice should document its analysis and make required notifications when applicable.
HHS’s ransomware fact sheet identifies factors relevant to breach analysis, including the PHI involved, the unauthorized recipient or user, whether the PHI was actually acquired or viewed, and mitigation. The legal conclusion depends on the facts. Preserve evidence, document the investigation and reasoning, and involve qualified privacy or legal support as appropriate rather than assuming that encryption or successful recovery resolves the breach question.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteChoose outside support by the work it can actually do
A practice may use internal staff, vendors, or a combination of both to implement safeguards and maintain recovery capability. Evaluate prospective support against the practice’s needs rather than relying on a general claim of being “HIPAA compliant.” HHS does not endorse a particular security provider or backup product in the guidance described here.
- Can the provider help identify systems and ePHI, assess risks, and document the resulting decisions?
- Does the provider understand the practice’s EHR, clinical dependencies, and existing vendors?
- Can it explain how access controls, MFA, remote access, anti-malware, and asset inventory will be maintained?
- Who is available during an incident, what response role will that provider have, and how will evidence and privacy questions be handled?
- Will it help test restoration of usable data and applications, document results, and address failures?
- Who owns the data and backup copies, who can access them, and how will the practice recover if its relationship with the provider ends?
Ask for clear responsibilities and procedures, not just a product description. The practice remains responsible for understanding how its chosen arrangement supports its own risk management and continuity needs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
