Cybersecurity for New Jersey medical and dental offices
- If your practice handles patient information, HIPAA expects an accurate and thorough risk analysis of the risks to that electronic information.
- Breaches must be reported to patients without unreasonable delay and no later than 60 days after discovery.
- Small practices are targets too. HHS has settled ransomware cases with small practices.
- New Jersey's own breach law can apply on top of HIPAA.
Free 30-minute review
Tell us about your office. We tell you what we would fix first, in plain words, whether or not you hire us.
A medical or dental office holds some of the most private information there is. Names, birth dates, insurance IDs, treatment notes. That is exactly what attackers want.
Here is a plain-words starting point for New Jersey practices. It is not legal advice. For your own rules, talk to your compliance adviser.
What does HIPAA ask for?
Two pieces matter most for day to day IT.
1. A risk analysis. The HHS Office for Civil Rights says the Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to electronic patient information. HHS does not prescribe one method, because methods vary with your size and complexity. See HHS's guidance on risk analysis.
2. Breach notice. Patients must be told without unreasonable delay and no later than 60 days after you discover a breach. HHS says the clock starts when the incident is first known, not when the investigation is finished. See the Breach Notification Rule and how to report to HHS.
Is a small practice really at risk?
Yes. HHS announced a settlement with a small neurology practice over a ransomware incident and described it as its 12th ransomware enforcement action and 8th action in its Risk Analysis Initiative. Read the HHS press release. The lesson: regulators look for a risk analysis, and attackers do not care how small you are.
A starter checklist for a New Jersey practice
- Do a written risk analysis. HHS points small and medium practices to the HIPAA Security Risk Assessment tool.
- Turn on MFA for email, your practice management system and remote access.
- Encrypt laptops, tablets and phones that hold patient data.
- Back up your practice software and imaging, with one copy offline, and test a restore.
- Limit access. Front desk, hygienists, doctors and billing should see only what they need.
- Remove access the day someone leaves.
- Train the team to spot fake emails. Phishing is a common way in.
- Check your vendors. Billing, imaging, cloud and IT providers may be business associates.
- Write a breach plan. Who calls whom, in what order.
What about the New Jersey law?
HIPAA is not the only rule. New Jersey's own breach law also asks businesses to report to the State Police before telling customers. Read our plain-words guide to the NJ breach law. Ask your adviser how the two fit together for you.
What is a HIPAA security risk analysis?
It is a written review of where patient data lives, what could go wrong, and what you do about it. HHS explains what it expects in its guidance on risk analysis. Start by listing every system that holds patient data: the practice software, email, scanners, phones and backups.
Does HIPAA apply to a small dental office?
If you are a covered entity, size does not exempt you. Ask your adviser if your practice and your vendors are covered. Vendors who handle patient data for you may also have duties.
Simple habits that help every week
- Lock screens when staff step away.
- Use separate logins. No shared front desk password.
- Keep patient data out of personal email and texts.
- Remove access the day someone leaves.
- Update the practice software and computers on a schedule.
Staff training is a big piece. Many incidents begin with a fake email, so see the signs in our AkolagTech guide to spotting phishing. For the New Jersey side of the rules, read our breach law guide.
What does this cost you if you wait?
A breach in a practice means closed chairs, locked schedules and patients who lose trust. A few hours on a checklist is far cheaper.
How we can help
We work with New Jersey offices on MFA, backups, device protection and staff training. Book a free 30-minute review and we will go through the checklist with you. Learn about our cybersecurity service.
Common questions
Do small medical and dental practices have to follow HIPAA?
HIPAA applies to covered entities, such as health care providers that transmit health information electronically, and their business associates. Size does not remove the duty. Check with your compliance adviser.
What is a HIPAA security risk analysis?
It is an accurate and thorough look at the risks and weak points for the electronic patient information you hold. HHS says the rule does not set one method, because methods vary with size and complexity.
How soon must a breach be reported?
Individuals must be told without unreasonable delay and no later than 60 days after discovery. Reports to HHS depend on size: 500 or more people within 60 days, fewer than 500 within 60 days after the end of the calendar year.
Is there a free tool to help?
HHS points small and medium practices to the HIPAA Security Risk Assessment Tool from ONC and OCR.
What is a HIPAA security risk analysis?
A written review of where patient data lives, what could go wrong and what you do about it. HHS publishes guidance on what it expects.
Book a free 30-minute review
Tell us what is not working. We will look at your setup and tell you what we would change, whether or not you hire us.
Book the review ●●● ●●●-●●●●