Cybersecurity Awareness Month: A quick checklist for your practice
1. Conduct a security risk assessment
- Map how patient data move through your systems.
- Identify weak points in devices, vendors and staff workflows.
- Document risks and create an action plan.
2. Keep systems patched and current
- Enable automatic updates for your electronic health record, routers and software.
- Retire unsupported devices and applications.
3. Require strong passwords and multifactor authentication
- Enforce multifactor authentication for all remote and administrative logins.
- Use a password manager to generate unique, complex credentials.
4. Encrypt data everywhere
- Encrypt laptops, drives and mobile devices.
- Use secure, encrypted email and messaging for patient communications.
5. Segment your network
- Separate clinical systems from guest Wi-Fi and administrative networks.
- Limit access using “least privilege” permissions.
6. Back up your data — and test it
- Follow the 3-2-1 rule: three copies, two media types, one offsite.
- Test restores quarterly to ensure backups work.
7. Train staff regularly
- Conduct phishing simulations and refresher sessions.
- Emphasize safe email, password hygiene and device use.
8. Monitor for suspicious activity
- Enable system logging and alerts.
- Review access attempts and data transfers routinely.
9. Create and rehearse an incident response plan
- Assign roles, define communication steps and run tabletop drills.
- Include Health Insurance Portability and Accountability Act breach-notification procedures.
10. Stay informed
- Subscribe to CISA cybersecurity alerts at cisa.gov.
- Follow new threat updates from Medical Economics and Physicians Practice.
