Free printable checklist

Small-practice security checklist

35 plain-language checks for dental, medical, and veterinary practices, clinics, and independent insurance agencies. Work through it with your office manager or IT provider, check off what's done, and note what isn't.

This checklist is a starting point. It does not establish HIPAA or insurance-law compliance or replace a risk analysis.

Which rules apply depends on your situation. HIPAA duties depend on whether your practice is a covered entity or business associate. State insurance data-security laws depend on where your agency is licensed and, in some states, its size. Check with your advisors about what applies to you.

Accounts & sign-in

Turn on multifactor authentication (MFA) for email, remote access, online banking, and your practice-management or agency-management system.
Why: MFA adds a second check at sign-in, which reduces the risk from a stolen password.
Give each person their own login. No shared accounts on workstations or key software.
Why: You can see who did what, and remove one person’s access without disrupting everyone else.
Remove a departing employee’s access on their last day: email, remote access, cloud apps, and door or alarm codes.
Keep administrator accounts separate from everyday accounts, and limit who has them.
Why: Everyday browsing and email then run without admin rights.
Use a password manager instead of spreadsheets or sticky notes, and change any password that is reused on more than one site.

Email & payments (including wire changes)

Set up SPF, DKIM, and DMARC for your email domain.
Why: These records reduce the chance that someone can send email that appears to come from your practice or agency.
Verify any request to change bank, payment, or wire details by calling a phone number you already have on file — never the number in the email or text.
Why: A call to a number you already trust is much harder for a fraudster to fake than an email.
Insurance agencies: confirm premium-payment and claim-payout instructions with the client or carrier by a known phone number before any money moves.
Require a second person to approve wire transfers and new payees above an amount you set.
Turn on an “external sender” banner so staff can spot outside email that pretends to come from a coworker.

Devices & patching

Keep a current list of the computers, servers, phones, tablets, and network equipment that touch practice or client data, and who uses each one.
Why: You can’t update or protect a device you don’t know about.
Turn on automatic updates for operating systems and browsers, and check each month that the updates actually installed.
Replace or isolate software and devices the vendor no longer supports with security updates.
Run endpoint protection (antivirus or EDR) on all workstations and servers, and confirm someone is watching its alerts.
Turn on full-disk encryption for laptops and any computer that leaves the building.
Why: If a laptop is lost or stolen, encryption helps keep the data on it unreadable.
Set screens to lock automatically after a few minutes of inactivity, especially at front desks and in exam or treatment rooms.
Change default passwords on the router, firewall, Wi-Fi, and connected equipment such as imaging devices, and keep guest Wi-Fi separate from the office network.

Backups & recovery

Back up your practice-management or agency-management data, records and imaging, email, and shared files on a schedule, with at least one copy kept offline or offsite, separate from your office network.
Test a restore at least once a quarter: open the restored files and confirm they work.
Why: A backup that has never been restored is a guess, not a plan.
Write down how long you could run without each key system, and who you would call to bring it back.

Vendors & data

List the vendors that store or can access patient, client, or policyholder data: IT, software, billing, cloud services, and document shredding.
Where HIPAA applies, have a signed Business Associate Agreement (BAA) with each vendor that creates, receives, stores, or transmits protected health information for you.
Why: Your practice keeps its own HIPAA duties when a vendor handles PHI; the BAA sets out the vendor’s.
Ask key vendors how they protect your data — MFA, encryption, and how they would notify you of a breach — and keep their answers on file.
Know which systems and cloud services hold your data, and delete what you no longer need under your record-retention policy.

People & training

Give staff short security-awareness training when they start and at least once a year, including how to spot phishing.
Run occasional simulated phishing tests and follow up with coaching, not blame.
Tell staff exactly how to report a suspicious email, call, or text, and thank them when they do.
Why: Fast reports give you time to act before a mistake spreads.

Incident readiness

Write a one-page incident plan: who to call first (your IT provider, cyber insurer, and attorney) and who makes decisions.
Keep that contact list printed and stored offline.
Why: During an incident, email and shared files may be unavailable.
Read your cyber insurance policy’s notice requirements and any required vendors before you need them.
Know who on your side decides on breach notifications under HIPAA (if it applies) and your state’s law, and which advisors help make that call.

Records & documentation

Document your HIPAA risk analysis, and review and update it when your systems, staff, or services change.
Why: A risk analysis is a required part of the HIPAA Security Rule for covered entities and business associates.
Keep written security policies — access, passwords, devices, backups, and incident response — with the date each was last reviewed.
Insurance agencies: find out whether your state’s insurance data-security law applies to your agency. If it does, keep the written information security program it calls for, with a named person responsible.
Keep a dated log of training, access reviews, backup tests, and incidents.
Why: Dated records show the work was done, not just planned.

REAL People. REAL Experience. REAL Solutions.

Want a second set of eyes on your list?

Book a free 15-minute Cyber Risk Consult. We'll go through what you checked and what you didn't, and help you decide what to tackle first.

Book a Cyber Risk Consult Or take the free assessment