HIPAA Security Rule: What Good Looks Like for Practices with 5 to 100 Staff
A practical picture of HIPAA Security Rule readiness for outpatient practices. Administrative, physical, and technical safeguards without enterprise theater.
The HIPAA Security Rule asks you to protect electronic protected health information with administrative, physical, and technical safeguards. For a large health system that can mean a big program office. For a practice with roughly 5 to 100 staff, good looks different. It looks like clear ownership, current documentation, and a small set of controls you can actually prove.
Harborline wrote this for practice admins and owner-physicians. Warm, direct, and sized for real clinics. Not for CISOs shopping enterprise frameworks.
The core idea
You do not need every possible control. You need an accurate picture of risk, reasonable safeguards for how you work, and evidence that matches your answers to brokers, payers, and regulators.
A flat-fee HIPAA / 360 Risk Assessment (fixed fee, scoped on a short call) is how Harborline builds that picture. The Annual Security Program is how many practices keep it current.
Administrative safeguards: what good looks like
- 1One named owner. Usually the practice admin or compliance lead. Not everyone, and not the MSP will handle it.
- 2A current security risk analysis. Written, dated, and tied to a remediation plan with owners and timing.
- 3Policies that match reality. Short and used beats long and ignored.
- 4Workforce training records that match today's roster.
- 5Vendor and business associate awareness. Inventory, BAAs on file, and a simple review rhythm.
- 6Incident response basics. Who gets called, where the plan lives, and how you notify counsel or your insurer when needed.
Physical safeguards: what good looks like
- 1Facility access that matches how the office actually runs. Locked areas for servers and records where those exist.
- 2Workstation placement and screen discipline in front-desk and clinical areas.
- 3Device inventory for laptops and tablets that leave the building, with encryption where PHI can live on the device.
- 4Media handling. A simple rule for drives, paper, and disposal that staff can follow.
You do not need a data center tour. You need controls that match your footprint and that you can describe in plain English.
Technical safeguards: what good looks like
- 1Unique user IDs. No shared front-desk passwords for systems that touch PHI.
- 2Multifactor authentication on email, EHR, VPN, and remote desktop where those apply.
- 3Access based on role, with offboarding when staff leave.
- 4Audit-friendly logging on critical systems (enough to investigate, not an unused SIEM hobby).
- 5Transmission and storage protections appropriate to your tools (for example, encrypted endpoints and secure messaging paths your staff actually use).
- 6Backups with a dated restore test, plus an offline or immutable copy ransomware cannot quietly encrypt.
See our short posts on MFA hardening for Google Workspace and Microsoft 365, and on immutable backups for insurance evidence, for deeper checklists.
What good is not
- 1A binder nobody opens until renewal week
- 2A free scanner report labeled as a HIPAA risk assessment
- 3A penetration test alone, with no Security Rule analysis
- 4Promises of a specific premium cut or a guaranteed OCR outcome
- 5Harborline replacing your MSP or your attorney
A sensible yearly rhythm
- 1Quarter-style check-ins on access, vendors, training, and open remediation items
- 2One thorough risk analysis refresh on a real calendar (the Harborline Annual Program includes one annual reassessment)
- 3Evidence pack ready before cyber insurance renewal and major payer questionnaires
- 4Tabletop or walkthrough of incident and continuity basics at least once a year
Exact Annual Program inclusions: one annual reassessment, four quarterly check-ins, and async Q&A capped at 4 hours per quarter, at a fixed fee, scoped on a short call.
How Harborline fits
- 1We lead the risk analysis and prioritization in plain English
- 2Your IT team or MSP keeps running the technology
- 3We verify evidence as agreed gaps close
- 4We work alongside counsel and brokers. We do not sign insurance applications for you, and we do not replace legal advice
Book a 30-minute scoping call
If you want a calm read on whether your Security Rule picture is defensible for a practice your size, book a 30-minute scoping call.
No SOW until fit is clear. Assessments are paid engagements. Educational content is free.
Harborline · Contact · harborlinesec.com
Related Harborline pages
How much does a HIPAA risk assessment cost?
One-time assessment vs Annual Security Program
Risk assessment vs penetration test
Cyber insurance renewal support
Cyber Insurance Renewal Readiness Checklist
Further reading
HIPAA Security Risk Analysis: What Practices Get Wrong
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
MFA Hardening for Practices: Google Workspace and Microsoft 365
Short MFA hardening checklists for Google Workspace and Microsoft 365 in medical and dental practices. Evidence carriers ask for, without enterprise theater.
Immutable Backups, Ransomware, and Insurance Evidence for Practices
Why cyber insurers ask for immutable or offline backups and a dated restore test. A practical evidence checklist for medical and dental practices.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.