Click, Lock, Recover: Is your practice ready?

Could Your Practice Keep Running If Everything Went Down Tomorrow?

Last Friday, I spent most of the day watching Hurricane Isaias come ashore on the Florida Panhandle. As it moved in, I reached out to clients in its path. Not to sell anything. Just to make sure people were safe and to let them know we were here if their systems went down.

Those check-ins left me with a question, and Cybersecurity Awareness Month is a good time to answer it honestly: if your systems went down tomorrow, could your practice keep running? And could you stay compliant while it did?

A hurricane is the obvious example, but a ransomware attack, a dead server, or a cut internet line has the same effect. Your data goes dark, and your patients still need care.

What HIPAA Actually Requires

The HIPAA Security Rule covers this in the contingency plan standard, 45 CFR 164.308(a)(7). In plain English, you need policies and procedures for responding to an emergency that damages the systems holding your ePHI. The rule itself names fire, vandalism, system failure, and natural disaster.

Three plans are required:

• Data backup plan: exact, retrievable copies of your ePHI.

• Disaster recovery plan: how you restore any data you lose.

• Emergency mode operation plan: how you keep critical business going, and keep ePHI protected, while you are in crisis mode.

Two more pieces are addressable:

• Testing and revising your plans

• Applications and data criticality analysis: knowing which systems matter most and what comes back first

Addressable does not mean optional. You assess each one, then either implement it or document the reasonable alternative you chose.

This also lines up with CISA’s Cybersecurity Awareness Month guidance: back up your data, have an incident response plan, and be prepared for system disruptions.

Here is what worries me. A lot of these plans exist on paper only. They sit in a binder or a shared folder, and nobody has ever tested them.

Three Quick Self-Checks

1. When did you last test a restore? Not “the backup ran.” Did someone actually pull data back and confirm it works? If you cannot name the date, that is your answer.

2. Who has the offline contact list? If email and phones are down, how do you reach your staff, your IT vendor, your EHR vendor, and your patients? Is that list printed somewhere, or does it live in the system that just went down?

3. Could you run on paper for 48 hours? Check-ins, schedules, notes. Who does what, where are the forms, and how does that paper get secured and entered back in later?

If any of those made you pause, you are not alone, and it is fixable. Better to find the gaps on a calm Wednesday than in the middle of the next storm.

Let’s look at your plan together. In 30 minutes, we will walk through your contingency plan and tell you what to fix first.

Stay safe out there. And if you are along the Gulf Coast cleaning up this week, we are thinking of you.

Rob Van Buskirk
VanRein Compliance

October is Cybersecurity Awareness Month, and CISA's theme this year is Securing the Next 250. For a small practice, that big idea comes down to three everyday questions.

Click: Would your team spot the email?

Phishing is still the easiest way into a practice. One rushed click on a fake invoice or a "password reset" can expose patient data. Short, regular training and a simple "report it, don't click it" habit go a long way. Make reporting easy and never punish the person who speaks up.

Lock: Could you keep working if ransomware hit Monday?

Ransomware can stop scheduling, billing and charting all at once. Multi-factor authentication, patched systems and backups kept offline turn a crisis into an inconvenience. If you have never restored a backup, you do not know if it works.

Recover: Would your plan survive a hurricane?

Hurricane season is a reminder that disasters are not only digital. The HIPAA Security Rule already requires a contingency plan, including a data backup plan, a disaster recovery plan and an emergency mode operation plan. If yours lives in a binder nobody has opened, this is the month to test it.

What is Changing

The proposed HIPAA Security Rule update (RIN 0945-AA22) is slated for July 2027. It is still a proposal, and the current Security Rule remains in force today. In Congress, the Health Care Cybersecurity and Resiliency Act of 2026 (S.3315) passed the Senate by unanimous consent on September 30, 2026 and still needs the House. Build your proof against the rule you are under now.

Pick one this week

1. Run a five-minute phishing refresher at your next team huddle.

2. Turn on MFA for email and your practice management system.

3. Restore one backup and write down how long it took.

4. Pull out your contingency plan and confirm who calls whom if the power or network goes down.

Want a second set of eyes? Book a free 30-minute compliance review. No deck, just a punch list you can use this quarter.