There’s a sentence that appears in almost every conversation we have with a small practice: we’re too small for anyone to bother with.
It’s an entirely reasonable thing to believe. A six-provider clinic in Amador County isn’t a hospital system. There’s no obvious reason anyone would go looking for it specifically.
And that’s the misunderstanding. Nobody is going looking. The overwhelming majority of attacks on practices this size aren’t chosen at all — they’re automated. Systems get scanned in bulk, phishing goes out in volume, and attention follows wherever something responds. Being small doesn’t remove you from that process. It often makes you a more useful result, because defenses tend to be lighter and there is rarely anyone watching.
HIPAA gets discussed as if it were a certificate you obtain. It isn’t. The Security Rule describes an ongoing obligation, and the distinction matters because it changes what “compliant” means.
The requirement is to conduct a risk analysis, act on what it finds, document the effort, and repeat the process as things change. Not once, at setup. Continuously, as the practice grows, as staff change, as software is replaced.
What HIPAA actually asks of you
This is why a practice can have reasonable protections in place and still be in a difficult position after an incident. The question that gets asked isn’t only whether you had safeguards. It’s whether you had identified your risks, addressed them, and recorded that you did. A practice that can produce that history is in a materially different situation from one that can only say things seemed fine.
For a small practice this sounds daunting, and it needn’t be. The documentation largely produces itself when the underlying work is being done properly — which is the point worth holding onto.
Why patient records are worth stealing
Understanding the economics helps explain why healthcare draws the attention it does.
A stolen credit card gets cancelled within hours of being noticed. Its useful life is short and its value reflects that. A medical record contains a name, date of birth, Social Security number, insurance details, address history, and clinical information — none of which can be cancelled, and most of which stays valid for years.
That combination supports identity theft, insurance fraud, and prescription fraud long after the breach itself. On criminal markets, health records consistently command higher prices than financial data, and the reason is simply that they last.
There’s a second factor specific to clinical settings. A practice with a full waiting room cannot pause operations the way a manufacturer can pause a production line. Attackers understand that pressure and price accordingly.
The way practices actually get compromised
The popular image of a technical intrusion bears little resemblance to what happens in practice, and the reality is considerably more preventable.
Nearly everything begins with email. A message that looks entirely ordinary — an insurer, a laboratory, a software vendor, a referring provider. The link goes to a page that replicates a Microsoft 365 login convincingly, and someone enters their credentials during a busy clinic without pausing. Nothing visible follows, which is precisely the design.
What comes next is patient. The attacker reads the mailbox, learns how the practice communicates, identifies who handles billing and payments, and quietly expands access. Some create mail rules so their activity stays hidden from the account’s real owner. Ransomware, when it arrives, usually comes through the same door — with encryption triggered over a weekend after weeks of mapping the network and locating the backup system.
The other common route is simpler. Unpatched software with a vulnerability the vendor fixed months ago, still sitting exploitable on a workstation nobody updated. Patch compliance is one of the most revealing indicators of overall security posture, and in small practices it routinely sits somewhere between 55% and 65% — usually accompanied by the entirely reasonable assumption that updates were happening automatically.
The controls that prevent most of this
The genuinely reassuring part is that a small number of measures address the substantial majority of risk.
Multi-Factor Authentication matters more than anything else on the list. Stolen credentials remain the most common entry point, and requiring a second factor stops the large majority of attempts before they begin. It needs to apply to every account without exception — and the exceptions are where practices most often go wrong. Physicians and practice managers frequently get exempted because MFA felt inconvenient during a busy clinic, and those are precisely the accounts with the broadest access.
Email threat filtering and DNS security remove a substantial proportion of malicious messages before anyone has to exercise judgment about them at four in the afternoon.
Endpoint detection and response addresses what traditional antivirus cannot. Antivirus recognises threats it already knows. EDR watches for suspicious behaviour, which is how ransomware gets caught during the mapping phase — in the window between an attacker being inside and encryption beginning.
Automated patch management holds compliance high without depending on anyone remembering. Imaging systems and connected medical devices need particular attention here, since they’re often overlooked precisely because they work reliably while running software that stopped receiving updates years ago. Where a device genuinely cannot be patched, it should be isolated on the network rather than left sitting alongside everything else.
Verified backups determine what happens on the worst day. Ransomware specifically hunts connected backup storage, so a backup drive reachable from an infected workstation will be encrypted alongside everything else. Copies need to live off-site, with enough recovery points to go back past the date an infection began. Our backup and disaster recovery service is built around that principle.
Our cybersecurity services operate these as a single coordinated layer, and our managed IT services keep them monitored — which matters, because MFA coverage drifts as staff join and leave, and a control nobody reviews stops being effective within months.
What an incident costs a practice
The ransom, when there is one, is rarely the largest figure.
Clinical disruption comes first. Charts inaccessible, imaging unavailable, scheduling gone. Appointments get cancelled and rescheduled, and the backlog persists for weeks after systems return. For a practice running full schedules on thin margins, lost clinical hours don’t come back.
Notification obligations follow. Depending on the number of records involved, requirements extend to affected individuals, to the Department of Health and Human Services, and in larger incidents to the media. California’s requirements are among the more demanding in the country, and the notification itself becomes a public record of what happened.
Then there’s the quieter cost. Patients rarely announce that they’re leaving because of a data breach. They simply don’t rebook, and the effect appears in the schedule months later, disconnected from its cause.
Against all of this, the preventive controls described above are modest. That asymmetry is the whole argument.
The Amador County reality
There’s a factor specific to practices in Jackson and the surrounding communities that deserves honest acknowledgment.
Specialist support is thinner here than in Sacramento or Stockton. Practices frequently rely on a general computer vendor, or on whichever staff member is most comfortable with technology, or on the EHR vendor for problems the EHR vendor doesn’t actually cover. Response times measured in days become normal simply because nothing else has been available.
The consequences extend beyond convenience. Deferred maintenance accumulates. Small problems become permanent conditions people work around. Security controls that need continuous attention drift, and nobody notices because nobody is watching.
None of this reflects on the practices involved. It reflects a genuine gap in available support — which is also why remote-first managed IT has changed the picture considerably for rural practices. Most issues are now resolved remotely within minutes regardless of distance, and continuous monitoring requires nobody to be nearby.
Where to start
Two questions will tell you most of what you need to know. Ask when the last actual restore test happened, and what the date was. Then ask whether MFA is enforced on every single account, including physicians.
If either answer is vague, that’s your starting point — and both are among the least expensive things to fix.
RJ PRO Tech Group works with medical and dental practices across Amador County to protect patient data with controls that are maintained and documented rather than assumed, backed by a Help Desk that answers in minutes.
