Cybersecurity for healthcare and mental health practices
HIPAA expects you to protect your patients’ health information, and to document how you do it. I sign a Business Associate Agreement with you, run your security risk analysis, write your policies, train your staff, and serve as your Security Officer, so you can focus on your patients.
The rules you face
HIPAA Security Rule: a written risk analysis, safeguards for every device and system that touches patient data, a named Security Officer, staff training, and written policies you keep for six years.
HIPAA Breach Notification Rule: if patient data is exposed, you notify the patients and HHS. If 500 or more people are affected, you notify the media too.
Business Associates: your EHR, billing company and IT provider each need a signed BAA, and you need to check that they protect your data.
Substance use disorder records: if you run a Part 2 program, 42 CFR Part 2 adds stricter confidentiality rules on top of HIPAA.
Learn more: HIPAA · Which rules apply to you?
What you get
A signed Business Associate Agreement: I sign one with you before I handle anything.
A security risk analysis: the document HHS asks for first, built from your inventory.
HIPAA policies and procedures: written for your practice and ready for an audit.
A named Security Officer: I take that role by contract, track what's due, and keep the paperwork current. You keep every decision.
Vendor management: a simple process for checking and monitoring every vendor that handles patient data, with BAAs in place.
Monitored protection: 24/7 protection on your devices and email, set up with you.
Staff training: everyone who touches patient data completes it, with records kept.
An incident response plan: who to call, and how to notify patients and HHS if something happens.
A yearly review: we update your risk analysis, devices, vendors and access together.
Want to see the full process? See How It Works.
What clients say
-
“Todd is always thinking about how to help his healthcare clients become more secure while building long lasting personal relationships. He also has an extensive referral network worth exploring. Highly recommend Todd and CyberSecurity4biz!”
Christopher Kreis, MD, ASP.MD Inc
-
“I highly recommend Todd Mitchell and CyberSecurity4biz for your cybersecurity needs. As a dedicated Service-Disabled Veteran, Todd brings over 15 years of expert experience and a genuine passion for protecting small businesses. He champions a step-by-step, client-focused approach, ensuring compliance and peace of mind without overwhelming you with technical jargon. Todd's commitment to exceptional customer service means you'll never face a cybersecurity challenge alone, making him an invaluable partner for safeguarding your business's information.”
Travis Walker, Continuum Dental Solutions LLC
Common questions
Will you sign a BAA?
Yes. I sign a Business Associate Agreement with every healthcare client before I start.
My EHR is HIPAA compliant. Doesn't that cover me?
It covers the EHR company's servers. Your risk analysis, devices, passwords, policies and staff training are still on you.
What does HHS ask for first after a complaint or breach?
Your security risk analysis. A missing or outdated one is the most common gap HHS cites.