What Should a Medical Practice Do to Protect Patient Data?

A medical practice collects some of the most sensitive personal information that exists. Patient records, imaging files, clinical notes, insurance data, and billing details all live inside systems that are actively targeted by attackers. Protecting that data is both a HIPAA obligation and an operational necessity. A breach does not just create regulatory exposure. It can shut down scheduling, interrupt care delivery, and damage patient trust in ways that take years to repair.

This checklist walks through the seven areas a Phoenix-area medical practice should have covered. Each one maps to a category of operational work, not just a product to purchase.

How to Use This Checklist

Each layer below describes a category of protection, what it guards against, and what operational responsibility it requires. A responsible Managed Service Provider (MSP) should be able to show you, in concrete terms, who is performing each of these functions and how it is being verified. If the answer is "we have a tool for that," ask what happens when the tool fires an alert at 2 a.m. on a Saturday.

One framing note before the checklist: your practice owns its HIPAA compliance program. No IT provider makes you compliant. What a well-run managed IT program does is implement, operate, monitor, and document the technical safeguards that your HIPAA program requires. That distinction matters when evaluating vendors and when responding to an audit.

Layer 1: Identity and Access Controls

Most breaches begin with a compromised account, not a smashed window. Controlling who can log in, from where, and with what credentials is the first line of defense.

• Multi-factor authentication (MFA) on every account. This applies to your EHR, Microsoft 365, billing portal, and any system that holds or connects to patient data. A password alone is not sufficient.
• Role-based access. Clinicians, front-desk staff, billing personnel, and administrators should only have access to the systems and data their role requires. Someone who schedules appointments does not need access to clinical documentation or financial records.
• Identity threat detection. Actively monitoring Microsoft 365 accounts for compromised logins, impossible-travel sign-ins, and unauthorized account changes catches an attacker who has stolen a password before they can do damage. This is an operational monitoring function, not a one-time configuration.
• Privileged access management. Administrative credentials used to manage systems should be stored and governed separately from everyday user accounts, with access logged and controlled.
• Prompt offboarding. A departing employee's access should be revoked the same day they leave. This is a process discipline issue as much as a technical one, and it requires a documented, repeatable procedure between HR and IT.

Layer 2: Endpoint Protection

Every laptop, desktop, tablet, and workstation that connects to patient data is a potential entry point. Endpoint protection is not a single product. It is a set of overlapping controls that collectively reduce the risk that any one device becomes the source of a broader incident.

• Endpoint Detection and Response (EDR). Continuously watches every device for the behaviors that signal an attack, including unexpected encryption activity and credential theft, not just known viruses. When something dangerous is found, it can isolate the device to stop a threat from spreading.
• Managed Detection and Response (MDR). Pairs detection technology with a live 24/7 Security Operations Center. Real analysts triage every alert, separate false alarms from genuine attacks, and take action the moment a real threat appears. A breach at 2 a.m. does not wait until morning to be addressed.
• Full-disk encryption. Every device that leaves the office or could be lost or stolen should have full-disk encryption enforced. If a laptop is stolen, encrypted storage turns a potential HIPAA breach into a lost piece of hardware.
• Application control. Only approved applications should be permitted to run on clinical and administrative workstations. This default-deny posture blocks unknown executables, malware, and unauthorized software from launching in the first place.
• Patching and updates. Most breaches exploit known vulnerabilities that already have fixes available. Operating systems and applications should be patched promptly and consistently, not on a "when someone remembers" schedule.
• Antivirus protection. A foundational layer: well-configured, continuously updated antivirus on every device, catching the high volume of known, commodity threats so more advanced detection layers can focus on sophisticated attacks.

Layer 3: Email and Web Protection

Email is the number-one attack route into any organization. For a medical practice, a staff member who clicks a convincing phishing link can hand an attacker access to the EHR, billing system, or Microsoft 365 environment. Protecting email and web browsing is not optional at any practice size.

• Advanced email protection. Goes beyond spam filtering to catch sophisticated phishing, impersonation attempts, business email compromise, and weaponized links and attachments before they reach a user's inbox.
• Web content filtering. Filters web traffic to keep users away from malicious, fraudulent, and inappropriate sites, including phishing pages, malware-hosting domains, and drive-by-download sites that are a primary way attacks enter through the browser.
• Security awareness training. People are the most-targeted part of any organization. Recurring training and realistic simulated phishing campaigns help staff recognize and report the scams that are behind most breaches. Training is not a one-time event; it is a recurring operational responsibility.

Layer 4: Data Protection and Loss Prevention

Protecting patient data means controlling where it goes, not just who can access it. Data Loss Prevention (DLP) keeps sensitive information from leaving the environment improperly, whether by accident or intent. It watches how data is shared, emailed, and copied, and blocks or flags movement that violates the rules configured for it.

• DLP policies in Microsoft 365. Configure policies that flag or block transmission of information matching patterns associated with patient records, Social Security numbers, financial data, and similar categories.
• Controlled external sharing. OneDrive and SharePoint external sharing settings should be locked down to business need. The default settings in Microsoft 365 are not configured for a HIPAA environment.
• Secure fax and messaging. Clinical communications that include patient information must travel over appropriate channels. Unsecured email and consumer messaging applications are not appropriate for patient data.
• USB and removable media control. Granular policy control over storage devices and removable media reduces the risk of intentional or accidental data removal from the practice environment.

Layer 5: Backup and Recovery

A ransomware attack or a catastrophic hardware failure that destroys patient records is not just a HIPAA problem. It stops your practice from seeing patients. Backup is the control that determines whether a serious incident becomes a recoverable disruption or a permanent loss.

• Separate, protected backups of workstation and server data. Backups must be isolated from the primary environment so that ransomware encrypting your workstations cannot also encrypt the backup. A backup stored on the same network share it protects is not a backup in any meaningful operational sense.
• Microsoft 365 backup. Microsoft does not provide a full backup of your email, OneDrive, SharePoint, or Teams data. If files are deleted, corrupted, or hit by ransomware, Microsoft's native retention is not a substitute for an independent backup with a tested restore process.
• Tested recovery, not just tested backup. The relevant question is not "are we backing up?" It is "how long does it take us to restore, and have we actually done it?" Recovery time matters when your scheduling system is down and patients are waiting.
• Documented retention aligned to HIPAA obligations. HIPAA requires audit log retention for six years. Your backup and retention program should be built around documented retention periods, not whatever the default settings happen to be.

Layer 6: Logging, Monitoring, and Audit Trails

HIPAA's technical safeguard requirements include audit controls: the ability to record and examine activity in systems that contain or use electronic protected health information (ePHI). Logging is also your primary tool for investigating what happened after an incident.

• Centralized log collection and retention. Activity logs from endpoints, Microsoft 365, and other systems should be gathered in one place and retained for the period your HIPAA program requires. Six years is the applicable HIPAA retention standard for audit logs.
• Active monitoring, not passive storage. Stored logs that no one reviews are an audit artifact, not a security control. Monitoring means someone is watching for patterns of attack, suspicious behavior, and policy violations on an ongoing basis.
• Incident documentation. When something happens, whether a phishing attempt, an unauthorized access event, or a full incident response, it should be documented in a ticketing system that creates a durable record. This is the evidence trail your HIPAA program will need if a breach or audit occurs.

Layer 7: Network and Physical Security

The network connecting your workstations, servers, EHR systems, and imaging equipment is the infrastructure that everything else runs on. Network security is a separate operational discipline from endpoint security, and it should be treated as one.

• Managed firewall. A properly configured and actively managed firewall controls what traffic enters and leaves the practice network. "Managed" means someone is responsible for reviewing rules, applying firmware updates, and responding when the firewall detects something. A firewall that was installed three years ago and never touched since is not a managed firewall.
• Segmented guest and clinical networks. Patient Wi-Fi should be completely separate from the network your clinical workstations, EHR, and imaging systems use. A patient connecting to guest Wi-Fi should have no path to clinical systems.
• Secure remote access. Physicians who work across locations or access records remotely should do so through secure, authenticated methods, not open remote desktop ports or consumer VPN products.
• Physical access controls. Server rooms and network equipment should be physically secured. Workstations in exam rooms and clinical areas should auto-lock when unattended. Physical security is part of the HIPAA Security Rule's physical safeguard requirements.

What This Work Costs for a Medical Practice

A properly managed IT and security program for a Phoenix medical practice runs approximately $200-$250 per user per month. That is planning guidance, not a guaranteed quote, and the actual figure for any practice depends on the size of the environment, the complexity of clinical workflows, the number of locations, and the specific tools required. Licensing for Microsoft 365, EHR systems, and other software is separate from the managed services fee.

That per-user figure covers the operational labor and security tooling required to implement, monitor, and maintain the controls described in this checklist. It does not cover one-time project work such as a new EHR migration, a network infrastructure upgrade, or an initial security assessment.

For comparison: a single HIPAA breach investigation, notification process, and potential regulatory response costs far more than a year of properly managed IT for most practices. The checklist above is not a compliance cost. It is the operational infrastructure that keeps care delivery running and keeps patient data where it belongs.

Who Is Responsible for Each Layer?

This is the question most practices do not ask clearly enough when evaluating an IT provider. Every item in this checklist represents ongoing operational work. That work does not disappear if it is not in scope. It either gets performed by your IT provider, performed by someone on your staff, or it does not get performed consistently. The last option is where breaches happen.

When reviewing a managed IT proposal for your practice, ask for each layer: who monitors it, who responds when something goes wrong, what the response process looks like, and how it is documented. A provider that answers those questions with specific operational descriptions is a different kind of partner than one that answers with a list of product names.

A Note on HIPAA Compliance

Your practice is responsible for its HIPAA compliance program. That includes your Notice of Privacy Practices, your Business Associate Agreements, your workforce training records, your risk analysis, and your policies and procedures. A managed IT program implements and operates the technical safeguards that support that program. Those are different things, and conflating them creates gaps.

What a well-run IT program contributes is a documented, verifiable record that the technical controls were in place, were monitored, and were maintained. That record becomes critical evidence if a breach occurs or an audit is initiated. Onsite Technical Services operates with that audit-trail discipline as part of standard healthcare IT engagements, not as an add-on.

Frequently Asked Questions

Does a small medical practice with fewer than 10 employees need all of these controls?

Yes. HIPAA's technical safeguard requirements apply regardless of practice size, and attackers do not filter targets by employee count. A small practice often has fewer internal resources to detect and respond to an incident, which makes a managed security program more important, not less. The controls in this checklist are scalable in cost, but not optional in scope.

Is Microsoft 365 enough to protect patient data on its own?

No. Microsoft operates the Microsoft 365 infrastructure reliably, but the configuration, security policies, monitoring, data loss prevention, backup, and identity oversight inside your tenant are your responsibility. The default settings in a standard Microsoft 365 tenant are not configured for a HIPAA environment. A managed IT program that includes Microsoft 365 Cloud Security and Administration closes that gap.

What is the difference between supporting a HIPAA program and making a practice HIPAA compliant?

Your practice owns its HIPAA compliance program, including the risk analysis, policies, workforce training records, Business Associate Agreements, and breach response procedures. A managed IT provider implements and operates the technical safeguards that your program requires, and documents that work in a way that supports your audit readiness. The IT provider supports your program. Compliance responsibility remains with the practice.

How much should a medical practice budget for managed IT and security?

A planning benchmark for a properly managed Phoenix-area medical practice runs approximately $200-$250 per user per month. This is planning guidance, not a quote, and the actual figure depends on practice size, locations, clinical workflow complexity, and the specific tools required. Microsoft 365 licensing and one-time project costs such as migrations or infrastructure upgrades are separate line items.

What happens if a staff member leaves and their accounts are not immediately deactivated?

An active account belonging to a former employee is an open door into your systems. That account can be used by the departing employee or, if the credentials were ever exposed, by an attacker who obtained them. Prompt offboarding requires a documented workflow between your HR process and your IT provider so that access is revoked on the day of departure, across every system the employee had access to, including your EHR, Microsoft 365, billing platforms, and any other connected application.

Book a Consult