Advisory Alert — HIPAA Security Rule
Most six-person practices assume HIPAA enforcement targets hospital networks and large regional health systems. That assumption has always been wrong. The 2026 Security Rule updates make it more expensive to hold.
The updated HIPAA Security Rule eliminates the "addressable" category that allowed small covered entities to defer controls like multi-factor authentication and encryption. Every practice—regardless of headcount—must implement the same baseline technical safeguards, document the work, and keep that documentation available for audit. Penalties are tiered by culpability and assessed per violation category per calendar year.
What changed—and why a six-person office is affected
The original HIPAA Security Rule, written in 2003, divided safeguards into two categories: required and addressable. Addressable meant a covered entity could skip a control if it documented a reasonable alternative or concluded the control did not apply to its environment. Many small offices used that language to defer encryption, multi-factor authentication, and formal vulnerability management for the better part of two decades.
HHS's 2025 rulemaking removes that distinction, with compliance obligations running into 2026. Every covered entity—a six-person dental practice, a solo physician's office, a small behavioral health group—must implement the same baseline controls as a large hospital network. Practice size may shape how you implement a control. It no longer determines whether you must.
The six things your office must complete
1. Conduct and document a formal risk analysis
A written risk analysis has always been a required element of the Security Rule. The updated rule adds specificity. You must inventory every system that creates, receives, maintains, or transmits electronic protected health information (ePHI), map how that data moves through your environment, identify threats and vulnerabilities, and assign documented risk ratings. This is a recurring obligation—update it whenever your technology or workflows change materially, not only when an audit is approaching.
2. Deploy multi-factor authentication
MFA is a baseline requirement for any user account with access to ePHI. In a Microsoft 365 Business Premium environment, this means enabling MFA for every Microsoft account and for any third-party application connected to patient data. Business Premium includes Conditional Access policies through Microsoft Entra ID that can enforce MFA at every sign-in. The capability is included in your license. It is not enabled by default.
3. Encrypt ePHI at rest and in transit
Encryption moves from addressable to required. ePHI must be encrypted wherever it is stored—on workstations, laptops, mobile devices, and in cloud storage—and protected in transit across any network. Business Premium includes BitLocker for device encryption and TLS for email and file transfer. The gap most small offices miss: workstations and laptops that are not enrolled in Microsoft Intune device management and therefore have BitLocker disabled or in an unverified state.
4. Maintain tested, restorable backups
The updated rule requires documented backup procedures and evidence that backups can actually be restored. A note that data is synced to OneDrive does not satisfy this requirement if your office has never run a recovery test. A compliant backup strategy includes at least one copy that a ransomware event cannot alter or delete—commonly called an immutable or offline copy. Business Premium's built-in cloud storage is a starting point, not a complete solution, for most small practices.
5. Audit every business associate agreement
Any vendor that handles ePHI on your behalf must have a signed business associate agreement (BAA) on file before that relationship begins. Pull your current vendor list and match it against signed BAAs. Common gaps: billing platforms, EHR vendors, cloud fax services, appointment scheduling applications, and your IT or cybersecurity provider if they can access systems containing patient data. A vendor processing ePHI without a signed BAA creates direct regulatory exposure for your practice. Make this an annual review, not a one-time exercise.
6. Build and maintain a documentation trail
Regulators do not assume compliance; they require proof. Maintain written policies covering access control, device management, breach response, and workforce training. Log who reviewed those policies and when. Record your risk analysis dates, backup test results, and BAA review cycles. If OCR contacts your practice, documentation is what separates a correction plan from a civil monetary penalty.
What are the penalties for a small practice that ignores this?
HIPAA civil monetary penalties are tiered by culpability. Violations caused by willful neglect—where a practice knew about a requirement and took no action—carry the highest penalty levels, assessed per violation category per calendar year. A practice that has simultaneously neglected MFA, encryption, and documentation faces multiple penalty categories running concurrently. State attorneys general also hold independent authority to pursue HIPAA enforcement actions, which means two separate enforcement channels apply to your office regardless of its size or revenue.