So you’ve got a cybersecurity problem (even if you don’t know it yet)

Let’s be real: most of us didn’t go into medicine thinking we’d have to become IT security experts. We’re running busy primary care practices, juggling patients, staffing, billing, and paperwork—cybersecurity feels like something for hospitals or banks to worry about.But here’s the truth: community clinics like ours are being targeted more and more. We’re soft targets. Our data is just as sensitive as what’s in the hospital, and often easier to steal. And when something goes wrong, we don’t have an in-house IT team or legal department to bail us out.So what do we actually need to do in our clinics to keep ourselves—and our patients—safe?Read: Dr. Darren Larsen: Doctor AI, I need your help . . . STAT!Here’s a straightforward guide to what every family practice or small clinic should be thinking about. Not everything needs to happen tomorrow. But every item on this list is doable, practical, and designed with your clinic in mind.Assign someone the jobCybersecurity is no one’s job in most clinics. That’s part of the problem. So start by picking one person on your team—maybe a clinic manager, a tech-savvy doc or even a lead nurse—who will own this file. Their job isn’t to fix everything, but to keep it on the radar and make sure the basics get done. Give them an hour a month to work on it.Make a list of everything that connects to your dataYou can’t protect what you don’t know. Take 30 minutes and jot down:What computers and tablets are in use?What software do you use? (EMR, eFax, virtual care, online booking, even AI scribes or reminders)Who else has access to your data? (billing company, IT support, shared care partners)This list is the foundation for everything that comes next. Don’t overthink it—start rough, then refine it.Focus on five simple things firstThese are the non-negotiables in 2025. If you do nothing else, get these in place:Multi-factor authentication (MFA)—on your email, EMR and anything with patient data. It’s that little code you get on your phone—it stops most attacks cold. This must happen for every member of your staff and they need to understand why.Strong passwords—and no password reuse between systems. Use a password manager like 1Password or Lastpass.Updates and patches—make sure your computers update automatically. Don’t ignore those little reminders.Antivirus software—on every machine, even Macs. Often these are licensed by your EMR provider, but if not, make sure they are there.Screen locks—set every clinic computer to lock after a few minutes. Encrypt laptops and portable devices. Think about quick unlock mechanisms that are private to make life less cumbersome for users but still make it hard for others to get in (facial recognition, fingerprint, fob security)That’s it. You don’t need a fancy IT system—just do these five things and you’ll already be ahead of most clinics.Backups: If you can’t restore it, it’s not a backupEvery clinic needs a good, secure backup of their EMR and key files. Ideally:Backups happen automatically (nightly or weekly).They are stored in at least one place that isn’t your main server.They are tested—can you restore from them? Don’t just assume.Talk to your EMR vendor or IT support about how they back you up, where that data lives, and if possible to a test “restore” periodically.What will you do if you get locked out?Most of us don’t think about this until it’s too late. But take 20 minutes and write out a short “what if” plan:Who do you call if your system goes down or you get a ransomware message?Do you have the phone number for your IT support written down outside the computer?Who decides what to do? (Doctor-owner, office manager?)How will you let patients know if phones or systems are down?Do you have cyber insurance? If not, should you? Many insurers have crisis hotline support.You’re not trying to build Fort Knox. Just know how you’d respond to an attack.Train your team (just a little, regularly)Most breaches happen because someone clicks a bad link or opens a sketchy file. Your staff—not just you—need to know what to watch for.Do a short talk at your next staff meeting: “Here’s what a phishing email might look like.”Print a one-pager and tape it up near the front desk: “If you see this . . . call this person.”Remind everyone not to reuse personal passwords or log into clinic accounts on personal devices.Vendors: Don’t just assume they’re secureYour EMR company, billing provider, virtual care platform—do they follow good security practices? Are these explicit?Start asking questions like:Do they use MFA?Are they storing data in Canada?Will they notify you if they get hacked?What are their specific security protocols to ensure that your patient’s health data and your business data are adequately protected. There are privacy laws like PIPEDA and PHIPPA that can be considered here, but what is your vendor doing to ensure that their compliance goes beyond privacy and really measures security.It’s OK not to know all the answers. But asking the questions signals that your clinic cares—and that you expect your partners to care too.Insurance might be worth itCyber insurance isn’t required, but it can help if something goes wrong. Some plans cover:Costs of a data breach investigationLegal advicePatient notification and supportLost income during clinic downtimeAsk your broker if they offer a “clinic cyber” add-on. If you can’t get insurance, consider having a basic plan for what you’d do if something goes wrong. Your business insurance provider may already have some of this built into their basic packages, but have a look. OMA Insurance offers robust plans that are not very expensive.Talk about it twice a yearEvery six months, bring cybersecurity up at your partner/clinic meeting. You don’t need a deep dive—just a 10-minute update:What’s working?Any new software or risks?Do we need to review our plan or update backups?Regular check-ins help normalize this work and keep it from slipping off the radar.You’re not alone—ask for helpSome trusted resources for Ontario clinics:OntarioMD—They’ve got privacy and security resources, and their Practice Advisors can help.OMA Insurance—For when the unthinkable happens, and with advice on how to prevent it.Your local OHT or hospital IT team—Some have cybersecurity capacity and are willing to partner.CMPA—Good information on privacy risks and how to respond.Conferences—this topic is presented at many digital health conferences. Attend a session, learn more and create a community!Final wordYou don’t need to do everything at once. Pick one of these steps and tackle it this month. Then pick another one next month. The goal isn’t perfection—it’s protection.Cybersecurity isn’t just about tech. It’s about keeping your clinic running, protecting patient trust and reducing the chance that a random Tuesday morning becomes the worst day of your career.You’ve got this—and you don’t have to do it alone.I would love to hear your thoughts on what I have written and the ideas I have shared. Please comment below.Dr. Darren Larsen is a health-tech consultant with more than three decades of experience in the medical and health information technology fields. This item originally appeared on his website.

So you’ve got a cybersecurity problem (even if you don’t know it yet)

Register for free access or login.

Related Topics