HIPAA Security Risk Analysis for Dental and Medical Practices in Santa Barbara County

Why the risk analysis matters right now

The HHS Office for Civil Rights has an active Risk Analysis Initiative, and it reaches small and mid-size practices, not only hospitals. The initiative centers on one requirement: did the practice conduct an accurate and thorough assessment of the risks to its electronic protected health information (ePHI)?

You may have heard about the proposed 2025 overhaul of the Security Rule. That proposal is now targeted for around mid-2027 and is not a compliance deadline today. The current Security Rule is what OCR enforces. Waiting for the new rule is not a plan. A good analysis under today's rule, with an asset inventory and a map of how ePHI moves, is also useful groundwork if the proposal moves forward in some form.

Primary sources are on the HHS HIPAA site. Read them, and talk with your own counsel about legal questions.

What the written analysis covers

Keith Systems delivers a document your practice owns and can show when asked:

1. Scope and asset inventory. Workstations, servers, laptops, tablets, the practice management system, imaging, email and cloud services that store or touch ePHI.
2. ePHI flow map. How patient information moves: check-in, charting, imaging, claims, referrals, patient messages, backups.
3. Threats and vulnerabilities. Ransomware, phishing and business email compromise, lost devices, shared logins, vendor remote access, flat networks, power or internet outages.
4. Current safeguards. Administrative, physical and technical safeguards as they actually exist today, not as a policy binder says they should.
5. Risk ratings. Likelihood and impact for each risk, in plain levels a practice manager can follow.
6. Remediation plan. A prioritized list with an owner and target date for each item, set by the practice.
7. Policy templates. Starting templates for the security policies the practice adopts and edits as its own.
8. Optional staff training. A short, practical session for front desk and clinical staff on phishing, passwords and reporting.

For a fuller picture of what reviewers look for, read what OCR expects from small practices.

A person on site, beside your IT vendor and your SRA tool

Self-serve risk analysis software, including the free tool HHS publishes, asks good questions. The answers are only as good as the person filling them in. A questionnaire cannot notice the imaging workstation sitting on the guest Wi-Fi, the shared login on a sticky note, or the backup that has never been test-restored. Someone standing in the office can.

Your IT vendor knows your systems and keeps them running. The risk analysis is an independent look, and it works best with their help. Jacob interviews them, asks for configuration details, and writes findings they can act on. If you already use an SRA tool, the work can check it or feed results into it. Nobody gets replaced.

Jacob holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and has about six years of security compliance work on government systems, where written risk documentation is routine.

Practices this is built for

Census County Business Patterns (2023) counts about 240 dentist offices, 416 physician offices and 266 other health practitioner offices in Santa Barbara County, and about 154 dentist offices and 341 physician offices in San Luis Obispo County. Many are small practices with a handful of workstations and an outside IT provider.

Keith Systems offers on-site work for practices in Santa Barbara and Goleta, Santa Maria's large medical community, Lompoc, and South County offices in Arroyo Grande and Nipomo. Chiropractors, physical therapists, optometrists and counselors are covered entities too, and the same method fits them.

If ransomware is your biggest worry, start with the ransomware readiness guide for medical and dental offices.

Business associate agreement and how patient data is handled

When the work may expose Jacob to PHI, Keith Systems signs a business associate agreement before starting. The method is designed to avoid taking copies of PHI:

• Review happens on your screens, with your staff driving.
• Findings describe systems, settings and processes, never patient records.
• Screenshots are checked for patient information before they go into a report.
• The method is designed so Keith Systems does not export, email or store patient data.

How the engagement works

1. Free consult. About 30 minutes by phone or video, no obligation.
2. Written scope. Systems, locations and deliverables, with the fee stated in writing before any work begins.
3. On-site visit and interviews with the practice manager, a clinician and your IT vendor.
4. Draft analysis for your review and corrections.
5. Readout and final report, with remediation plan and templates.

Book a free security consult or call (805) 800-8163.