Michael Bannach
There are two moments when a practice finds out whether its HIPAA program is real. One is a letter from the Office for Civil Rights after a complaint or a breach report. The other, far more common, is the cyber insurance renewal, when the application that used to be two pages of yes-or-no boxes comes back as six pages asking for proof.
In both cases the question is the same. Not “do you have multi-factor authentication?” but “show me.” Not “do you train staff?” but “show me the completion records for the last twelve months.” Practices that have done the work often fail this test anyway, because the work was done and never written down.
This article is about the folder you should already have. If you can open it and find what follows inside ten minutes, you are ready for either letter. If you cannot, you know what to build.
Why “we do that” is not an answer
Picture a dental group with encryption on every laptop, MFA on email, and a backup that runs nightly. Then the billing coordinator’s laptop, with a year of claim exports on it, walked out of a satellite office. The practice knows the drive was encrypted. What it cannot do is produce a record showing encryption had been enabled on that specific device before it went missing.
Without that record, the practice cannot demonstrate that the information on the laptop was unreadable, and under the breach rules that is the difference between “lost a laptop” and “notify every patient whose record was on it.” The control is fine. The evidence is missing, and the evidence is what the rule actually asks for.
What goes in the folder
Here is what an auditor, an insurer or a breach investigator will ask a practice for, in roughly the order they ask.
1. The risk analysis, dated. HIPAA requires an accurate and thorough assessment of risks to electronic patient information. For a practice, this is a document that lists where patient data lives (practice management server, imaging workstations, the cloud EHR, the phones, the backup), what could go wrong with each, and what you have done about it. It needs a date, and it needs to be newer than the last time you added a location or changed a major system. A risk analysis from the year you opened the second office, written before the second office existed, will not hold up.
2. Policies that match how the office actually works. Not a binder bought online and never opened. A short set of written rules on passwords and MFA, who can access what, how devices are handled, what staff do when something looks wrong, and how long records are kept. The test an investigator applies is simple: does the policy say what the staff really does? A policy that bans personal phones for email while the whole front desk reads the shared inbox on their phones is a bigger problem than no policy, because it proves you knew.
3. Training records with names and dates. Security awareness training for everyone who touches patient data is required, most practices run it annually because that is what auditors and insurers expect, and “we did a lunch and learn” does not satisfy it without a record of who was in the room. You need a record per employee: who completed what, and when. New hires need it before they touch patient data, not at the next annual cycle.
4. The access list, reviewed. A list of every account that can reach patient information, who it belongs to, what it can do, and a dated note showing someone looked at the list recently and removed the people who left. The hygienist who moved to another practice in March should not still have a login in October. This is the item most practices cannot produce on request, and it is one of the first things an investigator asks for.
5. Device and encryption inventory. Every workstation, laptop, server and phone that touches patient data, with a record of whether its storage is encrypted and when that was confirmed. This is the record the practice in the laptop story did not have.
6. Business associate agreements, in one place. Your IT provider, your cloud EHR, your backup vendor, your patient communication platform, the billing company, the shredding service. If they touch patient information, there should be a signed agreement, and you should be able to find it without emailing anyone.
7. Backup and restore records. Not just that backups run, but that someone has restored from them and how long it took. The log of a successful nightly backup is nice. The note that says “restored the practice management database to the spare server on June 12, took 38 minutes” is evidence.
8. The incident log, even if it is short. Every time something looked wrong and was investigated, there should be a line: what happened, who looked, what was found, what was done. A phishing email that got reported and deleted belongs here. So does the time the server was down for an afternoon. An empty log is a yellow flag; a short, honest one is exactly what a reviewer wants to see.
Why insurers now ask for the same things
Cyber insurance carriers learned, expensively, that the practices filing claims were often the ones that had answered “yes” on the application without the control being in place. So the applications changed. Many now require MFA on email and remote access as a condition of coverage, ask for the date of the last backup test, and want to know whether endpoint protection is managed and monitored. A carrier whose investigation finds the application said MFA was on when it was not has grounds to rescind the policy and walk away from the claim.
The useful side effect is that the folder above now does double duty. The same evidence that satisfies an auditor satisfies the renewal, and the practices that keep it current are not the ones scrambling for screenshots in the week before the deadline.
Three questions for whoever runs your IT
- Can you send me today the list of every account that can reach patient information, and the date someone last reviewed it?
- Which of the eight items above do you produce for us, where are they kept, and when was each last updated?
- If a laptop went missing tonight, what record would you hand me tomorrow morning showing its drive was encrypted?
A provider that keeps the folder answers all three without scheduling a meeting.
Who maintains the folder
This is the honest problem. In most practices nobody owns it. The office manager owns scheduling and billing, the dentist owns clinical care, and the IT provider owns “the computers.” The folder falls between them, which is why it is usually empty.
Our view is that the IT provider should own most of it, because most of the evidence comes out of the systems the provider runs. For Stealth RX practices, the HIPAA security baseline, the annual staff training with completion records, access reviews, encrypted backup and disaster recovery, and the documentation you can hand to an auditor or your carrier are part of the service, along with a Business Associate Agreement with us. The practice still owns the policies and the decisions. We make sure the proof exists.
Start with the one that hurts most
If you do not have the folder, do not try to build all eight items this month. Start with the access list, because it is the fastest to produce and the most embarrassing to be missing. Then the training records. Then ask whoever runs your backups for the date of the last restore test, and if there is no date, schedule one.
If you would like a plain read on where your practice stands, the three-minute IT and security scorecard sends you a written roadmap, and the conversation after it is free.
