The 10-Point Cybersecurity Checklist for Medical Offices

Here is your checklist — we also sent it to your email.

1. Multi-factor authentication (MFA) is on for email, EHR/practice software and remote access.
2. Every person has their own login — no shared passwords at the front desk.
3. Computers and phones update automatically (Windows, macOS, browsers, apps).
4. Endpoint protection (antivirus/EDR) is installed and monitored on every device.
5. Backups follow the 3-2-1 rule and you have tested a restore in the last 90 days.
6. Guest WiFi is separate from the network your office computers use.
7. Laptops and phones are encrypted and can be wiped remotely if lost.
8. Staff can recognize phishing and know who to call before clicking or paying.
9. Former employees lose access the same day they leave.
10. You have a written plan for what to do if you suspect a breach — and know who your IT contact is.

Your score: 9–10 — great start · 6–8 — a few gaps worth fixing · 0–5 — let’s talk: these are the gaps attackers look for.

This checklist covers common technical safeguards. It is not legal advice and does not certify HIPAA compliance; compliance is the responsibility of each covered entity.

Want a second pair of eyes? Book a free 30-minute meeting