Our approach
Proportionate security, written down. The Security Rule doesn't ask a ten-person office to run a 24-hour security center. It asks for a documented, defensible decision about what you do instead.
Required versus addressable
Every Security Rule standard has implementation specifications marked required or addressable. Required means do it. Addressable does not mean optional — it means assess it, then implement it, implement an equivalent, or document why neither is reasonable.
For a small office with records in the cloud, the practical answer is to implement almost all of them. With the tools we use, doing it costs less than defending a written exception.
Recognized security practices
Under a 2021 amendment to the HITECH Act, HHS must consider whether a practice had recognized security practices in place for the prior twelve months when deciding fines and audit outcomes.
Our architecture maps onto the HHS 405(d) Health Industry Cybersecurity Practices for small organizations, and we document that mapping so you can claim the credit. Twelve months of evidence is the threshold — another reason to start the binder on day one.
Principles we work by
- Risk analysis before hardware. Nothing is ordered until the findings say what it is for.
- Every control leaves a record. The artifact is built with the system, not afterward.
- Honest dates. We never backdate a document. Good-faith remediation is recognized; reconstructed history is not.
- Open, standard tools. No proprietary lock-in. Your configurations are yours, in writing.
- The bus factor is a risk. Two people know how to get in, and a sealed break-glass envelope sits in the safe.
- Alerts a human reads. A short list worth acting on beats a dashboard nobody opens.
- Clinics come first. Cutovers happen after hours, with a rollback path.
- Plain language. The practice owner should understand every recommendation and its cost.
Looking ahead to the proposed rule
In January 2025, OCR proposed the largest Security Rule overhaul since 2013. It is not final, and its timeline has slipped repeatedly. If adopted as proposed, it would require MFA, encryption at rest and in transit, an asset inventory and network map, vulnerability scanning and penetration testing, segmentation, and restoration of critical systems within 72 hours.
We build all of that now, because it is what reasonable security looks like regardless of rulemaking. If the rule is finalized, you adjust documentation, not architecture.
Regulatory status changes. We verify it against the Federal Register and HHS before relying on any date.
If you'd rather do it yourself
Some practices have a capable staff member who wants to run the system. We can design, build alongside them, and remain on a small retainer so someone outside the office has seen your environment before the day you need help.
If nobody in the office is comfortable at a command line, can't commit several hours a month, has more than one location, or is working under a corrective action plan, we recommend handing the operation to us entirely.