A Privacy Primer for the Small Practice
By Michael Woo-Ming, MD, MPH
When people think about a data breach, they picture some faceless hospital system with a hundred thousand records walking out the door. But a lot of the real trouble happens in small offices — the two-doctor practice, the solo clinic, the little cash-pay shop run out of a converted suite. Not because those places are careless, but because they're busy, and privacy is the kind of thing that quietly falls to the bottom of the list until the day it doesn't.
I'll be honest with you: this isn't the fun part of running a practice. Nobody got into medicine because they were excited about laptop encryption. But protecting patient information is part of protecting your patients, and it's part of protecting you. So let me walk you through how I'd think about it if you're a small operation without a dedicated IT team.
Know what you actually hold
You can't protect what you can't see. Most small practices have patient data scattered in more places than they realize — the EHR, sure, but also the billing software, the appointment texts, the email inbox where a patient sent a photo of a rash, the front desk's sticky notes, the old laptop in the closet nobody's wiped.
Take an afternoon and map it. Where does patient information live, who can reach it, and does it really need to be in all those spots? Half the risk in a small office isn't sophisticated hacking. It's the fact that sensitive information is sitting in ten casual places when it only needs to be in two locked ones. Fewer copies, fewer doors, less to worry about.
The boring basics do most of the work
Here's the thing about security that nobody wants to hear: the unglamorous stuff prevents the vast majority of problems. Strong, unique passwords. A password manager so your team isn't reusing "clinic2024" across every login. Two-factor authentication turned on everywhere it's offered. Devices that lock themselves and are encrypted, so a stolen laptop is a lost laptop and not a lost patient database.
None of that requires a consultant. It requires an afternoon and the discipline to actually do it. Don't get me wrong — there are advanced threats that need real expertise. But if you skip the basics chasing the fancy stuff, you've locked the vault and left the front door open.
Your people are the front line
The most common way information leaks out of a small practice isn't a hacker in a hoodie. It's a well-meaning employee clicking a link in an email that looked just real enough. Your staff are your security system, and they're only as good as what they've been taught.
You don't need a formal program. You need a habit of talking about it. Show your team what a phishing email looks like. Make it normal to pause and ask "does this seem off?" before clicking or sending. Create a culture where someone who almost fell for something tells you about it instead of hiding it, because that near-miss is exactly the warning you want. A team that's a little skeptical of its own inbox is worth more than any software you can buy.
Vet the companies you hand data to
Your practice doesn't operate alone. Your EHR vendor, your billing service, your scheduling tool, that new AI scribe everyone's talking about — every one of them touches patient information, which means every one of them is part of your risk whether you think about them or not.
Before you hand a company access to your patients' data, ask the plain questions. Where does the information live? Who at their end can see it? What happens to it if you cancel? Do they have the paperwork in place that a healthcare vendor is supposed to have? You don't need to be a technical person to ask a partner to explain, in normal English, how they protect the information you're trusting them with. If they can't or won't, that tells you something.
Have a plan for the bad day
Nobody likes to imagine the laptop getting stolen or the wrong file getting emailed to the wrong patient. But the practices that handle those moments well are the ones that thought about them beforehand, calmly, when nothing was on fire.
Keep it simple. Who do you call? How do you figure out what was exposed? What are you obligated to do, and by when? Even a one-page sketch of "here's what we do if something goes wrong" turns a panicked scramble into a set of steps. And back up your data regularly, stored somewhere separate, because the fastest way to turn a bad day into a catastrophe is to lose the records entirely.
Small doesn't mean exposed
I know this can feel like a lot when you're already wearing every hat in the building. But here's the encouraging part: privacy in a small practice mostly comes down to a handful of steady habits, not a giant budget. Know where the data lives. Lock the obvious doors. Train the people who use it. Choose your vendors with your eyes open. Keep a simple plan for when something slips.
Do those things, revisit them once or twice a year, and you've handled more risk than most practices your size. Your patients trust you with more than their health — they trust you with the details of their lives. Guarding that well is just another way of taking good care of them.
Dr. Michael Woo-Ming is a Mayo Clinic-trained physician, practice owner, and founder of BootstrapMD. He's the author of The Positioned Physician: Earn More, Work Smart, Love Medicine Again. Learn more at michaelwooming.com.
This is general educational information, not legal, compliance, or professional advice.
