Attacks arrive through people, not firewalls.
Nobody breaks into a practice through the perimeter. They send an email that looks like a refund notice, a fax, or a portal login — to a provider, a biller or the front office — and wait for someone on a busy morning to be helpful.
Health records are worth more, and practices are easier
A medical record contains everything a financial record does plus a clinical history that cannot be cancelled or reissued. And an independent practice has a fraction of a hospital’s defenses.
The other reason is operational: a practice that cannot see patients is losing money by the hour and cannot simply pause. That combination — valuable data and urgent pressure to restore — is precisely what ransomware operators look for.
Layers, in the order they earn their cost
We do not sell a package. We sequence controls by what actually reduces risk for a practice of your size, and we tell you where the sequence stops being worth it.
1. Identity
MFA everywhere it can go — email, EHR, remote access, admin accounts. The single highest-value control, and the one most practices have only half-done.
2. Email
Filtering, impersonation and domain protection, and the banner that marks external mail. Most attacks arrive here, so most of the defense belongs here.
3. Endpoints
Managed detection on every workstation and server, with someone actually watching the alerts rather than a console nobody opens.
4. Network
Segmentation that separates clinical systems, staff devices, guest wi-fi and medical equipment, so one compromised laptop is not the whole practice.
5. People
Security awareness training and phishing simulation with completion records you can produce. The training is graded, not attended.
6. Recovery
The assumption that something will get through eventually, and a tested restore that makes that survivable rather than fatal.
The part nobody wants to talk about
Networked clinical equipment is often the weakest thing in a practice. It runs an operating system the manufacturer will not let you patch, it cannot take an endpoint agent, and its support contract may forbid changes. It is also frequently sitting on the same flat network as everything else.
You usually cannot fix the device. You can put it behind segmentation, restrict what it is allowed to talk to, monitor it from the network side, and document the compensating controls — which is exactly what a risk analysis expects you to do when a safeguard cannot be applied directly. We inventory this equipment specifically, because generic IT assessments miss it.
Find out how a practice like yours would be attacked
The assessment includes a review of your identity, email, endpoint and network posture against a healthcare threat model.