Technical Safeguards for Cybersecurity

April 10, 2020

HIPAA has been around for quite a while – since 1996, in fact – and part of HIPAA law has always included required safeguards to secure all aspects of a medical practice’s protected information. With the rapid adoption of technology within the healthcare industry, technical safeguards included in HIPAA law are some of the most important for practices of all sizes to implement. Technology has enabled businesses in the healthcare industry to move operations offsite. In light of the current public health emergency, allowing for access to all essential data without having to step foot into the office is vital to ensuring practices are ready to see patients after the social distancing rules are relaxed. While these advancements simplify and enhance your business operations, they have made a hacker’s job that much easier as well.

Technical safeguards are the documented strategies and solutions that practices implement to secure electronic protected health information and control access to it. These include: 

  • The policies and procedures allowing for only authorized access to PHI 
  • Implementing any special hardware or software to protect PHI 
  • The ability to trace system activity to a specific user accessing PHI
  • Policies and procedures to ensure that PHI will not be altered or disposed of improperly

When it comes to the question of which data actually needs to be safeguarded, the answer is pretty much all of it. Any data that is accessed by, sent to or received from other practices or authorized vendors need to be protected as well as any data that has traceable identification that can be linked to a patient. This sensitive data must be encrypted prior to sending or receiving. Encrypting data may seem like a daunting task, but at a basic level, it just means making PHI unreadable to anyone other than the intended parties.

Recent Cyber Threats Tied to COVID-19

While ensuring your practice is prepared for a cyber attack is always important, cyber threats have been headlining the news a lot lately along with the current COVID-19 health emergency. Hackers are taking advantage of this time of increased public vulnerability as well as increased use of technology from unsecured networks while many people are working from home. Read up on common tactics utilized in these threats in our recent article.

Over the past few weeks, including just yesterday, multiple government agencies have issued warnings regarding recent threats to cybersecurity. These attacks range from individuals posing as government officials seeking access to PHI to other various phishing and malware distribution schemes utilizing the current concern and fear around COVID-19 as hackers ticket into your sensitive data.  Further guidance can be found in the public service announcement released by the FBI and yesterday’s bulletin from the CISA.

Hackers aren’t just attempting to play the roles of OCR investigators, or focusing on sending you phishing emails – now your video-teleconferences are at risk too. Video chat apps have become increasingly popular whether it’s for telehealth appointments, office meetings, , or even just virtual happy hours with friends – it’s the best way to stay connected during this time of social distancing. Unfortunately, this added reliance on technology is just another way for scammers to attack. The FBI released additional guidance on defending against Video-teleconferencing (VTC) hijacking and “Zoom-bombing” which refers to attacks directly on the increasingly popular Zoom platform. Some noteworthy tips from this guidance include making sure your virtual meetings are private by requiring a password to gain access. Keeping these meetings private means keeping them off social media or other public-facing platforms so only provide meeting links directly to the individuals you want to be included.

These attacks on video chatting software are especially important for medical practices to be aware of as just a few weeks ago the OCR updated their telehealth service regulations allowing doctors to use various communication apps to diagnose and treat patients while maintaining a safe distance. 

Practicing Good Cyber Hygiene

When it comes to cybersecurity, it’s important to know what to look out for, how to report any potential threats, and most importantly how to keep your practice and your patient data safe. Just yesterday, CISA, the United States Department of Homeland Security (DHS), and the United Kingdom National Cyber Security Centre (NCSC) issued a joint release featuring additional guidance on how to spot potential threats. Important tips for safeguarding your practice’s security during this time of increased risk include:

  • Make it harder for attackers to gain access to your users.
  • Know how to identify and report any suspected threats.
  • Protect your organization from the effects of undetected scams
  • Respond quickly and effectively to any incidents that do occur

There’s a lot of good ‘cyber hygiene’ out there, but here are a few top tips to keep your practice operations clean:

  • Secure systems that enable remote access 
  • Ensure that employees have updated all anti-malware and antivirus software on their devices
  • Encrypt any emails that include PHI or any other personal or financial information
  • Properly dispose of any PHI both electronic and paper when working off-site
  • Remind employees of appropriate access to PHI and implement controls such as applying additional protections for COVID-19 health records 
  • Ensure that PHI is only accessed when necessary, especially on less secure wireless networks such as those used when working from home 

If you have questions about technical safeguard requirements, Abyde has a team of HIPAA compliance experts ready and willing to help navigate your practice through these recent changes. If your practice is interested in learning more, sign up for one of our complimentary HIPAA compliance webinars where we’ll discuss HIPAA & COVID-19 from the comfort of your current remote work location.

 

RECENT POSTS

Related posts

Dental Practice HIPAA Settlement
Abyde News, Fines, HIPAA

What Every Dental Practice Can Learn From the $140K Shen Smiles Settlement

October 9, 2026 No comments yet

October 9, 2026 The latest HIPAA settlement doesn’t involve a hospital system or a massive ransomware attack. It involves a practice that probably looks a lot like yours. Shen Smiles is a solo dental practice in Drums, Pennsylvania. It started with a former patient’s complaint about getting their health records. It led to a broader OCR investigation and a $140,000 settlement. The lesson? Every HIPAA-regulated organization, big or small, can face enforcement.   What happened? Under federal law, patients must be given access to their records within 30 days, with one possible 30-day extension if the patient is notified in writing within the first 30 days. In April 2020, a former patient’s attorney filed a complaint with the Office for Civil Rights (OCR). The complaint alleged that the patient had requested their records multiple times without receiving access. The public documents don’t say when the first request was made. OCR’s investigation went beyond the original complaint. According to the resolution agreement, OCR found that patient records weren’t properly maintained and that staff hadn’t received formal HIPAA Privacy Rule training. OCR also said the practice couldn’t produce evidence that it had HIPAA policies and procedures in place, including for patient access requests, or that it had reasonably safeguarded patient information. During the investigation, the practice stated that it couldn’t provide the records because a workforce member had stolen them. The public documents don’t address whether a breach assessment was done. As a general rule, though, HIPAA presumes that an impermissible acquisition, access, use, or disclosure of unsecured patient information is a breach. A breach can require notifying HHS and affected patients, including steps patients can take to protect themselves. These are baseline requirements every covered entity is expected to have in place. Policies and training give a team a HIPAA playbook. Without one, staff at any practice may not know what to do when a patient asks for records or records go missing. OCR proposed a $140,000 civil money penalty in July 2024. Shen Smiles requested a hearing before an administrative law judge, but the two sides reached a resolution agreement in August 2026, before the hearing took place. Under the agreement, the practice agreed to pay $140,000. The agreement is not an admission of liability.   The Takeaway for Practices Patient access has been an OCR priority for years through its HIPAA Right of Access Initiative, and this case marks its 56th Right of Access enforcement action. It also took more than six years from complaint to resolution. As this case shows, a single complaint can lead to a broader look at your compliance program. Now is the time to ask: Do we have written HIPAA policies our team can find? Do we have a process to answer every record request within 30 days? Can we prove every team member has completed HIPAA training? If any of those gave you pause, now’s the time to fix it, before OCR comes asking. Looking for the first step? Meet with one of our compliance experts to see where you currently stand. 

Ambry Phishing Settlement
Abyde News, Fines, HIPAA

$700K HIPAA Settlement: What the Ambry Genetics Phishing Breach Teaches Every Practice

September 21, 2026 No comments yet

September 21, 2026   The HHS Office for Civil Rights (OCR) has announced its biggest HIPAA settlement of the year, reaching nearly a million dollars.  Ambry, a genetic testing and clinical genomics provider based in Aliso Viejo, California is at the center of this enforcement. A settlement was reached over a 2020 phishing attack that exposed the Protected Health Information (PHI) of more than 225,000 individuals. This settlement is a clear reminder that even large organizations trip up on HIPAA requirements.    What happened In January 2020, an employee email account at Ambry was compromised through a phishing attack.  The breach potentially exposed a wide range of PHI, including names, addresses, dates of birth, Social Security Numbers, financial details, and more. Ambry reported the breach to OCR in March 2020, which kicked off the investigation.    Where OCR found gaps OCR’s investigation identified several HIPAA Security Rule gaps, including: No accurate, thorough risk analysis of risks and vulnerabilities to ePHI No process for cutting off access to ePHI when an employee left or no longer needed access No unique user IDs for tracking who was accessing ePHI systems These are baseline HIPAA requirements that every Covered Entity and Business Associate is expected to have in place.   The settlement terms Ambry paid $700,000 and agreed to a two-year corrective action plan, under which it must: Complete a thorough risk analysis of ePHI confidentiality, integrity, and availability Build and execute a risk management plan addressing what that analysis turns up Review and update Security Rule policies and procedures as needed Implement unique user identification across all ePHI systems Train the whole workforce on those updated policies The takeaway for practices When 90% of healthcare hacks start with a successful phishing attempt, it’s key your team is aware of the role they play to keep data safe. Every practice should ask; Do we know exactly where our ePHI lives and how it moves through our systems? Do we have a current, documented risk analysis? Would we catch it fast if a former employee’s access wasn’t revoked? Looking for the first step of addressing these gaps? Meet with one of our compliance experts to see where you currently stand. 

Azul Vision Right of Access
Abyde News, Fines, HIPAA

Right of Access Enforcement Hits Eye Care: Inside the Azul Vision Settlement

September 1, 2026 No comments yet

September 1, 2026   The Office for Civil Rights (OCR) announced its 55th settlement under the HIPAA Right of Access Initiative, and this one is a good reminder that “we’ll get to it” is an easy shortcut to a massive financial penalty.   What happened Azul Vision, Inc., a California optometry enterprise healthcare provider, took nearly two years to provide a patient her healthcare records failed to give a patient timely access to her health records. She requested her records in January 2023. She didn’t actually receive them until January 2025, or two years later, and only after OCR opened an investigation following her complaint in April 2023.   The importance of Right of Access The HIPAA Privacy Rule’s Right of Access is straightforward: patients are entitled to their healthcare records within 30 days of a request, with one possible 30-day extension if needed.    The cost Azul Vision agreed to a two-year, OCR-monitored corrective action plan and paid $50,000. The corrective action plan requires the practice to: Review and revise its written policies and procedures for Privacy Rule compliance.  Regularly report to HHS a log of every PHI access request it receives, including when it came in and when it was resolved, Train all workforce members on right of access requirements and the practice’s own procedures.   Practical takeaways Have a documented, assigned process for access requests: not an informal “someone will handle it” arrangement. Track every request against the 30-day (or extended 60-day) clock: If nothing is timestamping requests, nothing is catching the ones that slip. Train staff specifically on right of access: this is a distinct Privacy Rule obligation from general HIPAA awareness, and it’s clearly one OCR is actively enforcing.   The bottom line A single records request that went unanswered turned into a $50,000 penalty, two years of federal monitoring, and a detrimental hit to the organization’s reputation. That’s a steep price for what really comes down to a missing process. If your team can’t answer “what happens the moment a patient asks for their records?” right now, that’s the gap to close before your practice ends up as OCR’s next enforcement case. Want a streamlined way to close your compliance gaps? Meet with an Abyde expert today!