Ask most practice owners about ransomware and you'll hear some version of "we're too small for anyone to bother with." The uncomfortable truth is the opposite: attackers target small medical and dental practices because they're small — big enough to pay, too busy to be hardened, and holding the most valuable records criminals can steal.
A patient chart sells for many times what a stolen credit card does, because it can't be cancelled. And a practice with a full schedule has almost no tolerance for downtime — which is exactly the pressure ransomware is built to exploit. When the practice management system is encrypted and the waiting room is full, "just pay it" starts sounding reasonable. Attackers know this. Their business model depends on it.
How it usually starts
Not with hacking in any cinematic sense. The typical entry point is an email: a fake invoice to the office manager, a "voicemail notification," a login page that looks exactly like your patient portal or email provider. One click, one password typed into the wrong box, and the attacker is inside — often quietly, for weeks, mapping your systems and finding your backups before encrypting everything at once, usually on a Friday night.
The five controls that matter most
Security vendors will happily sell you fifty things. For a small practice, the overwhelming majority of real-world protection comes from five:
- Multi-factor authentication everywhere — email, remote access, and every system that touches patient data. A stolen password with MFA in place is a dead end instead of a breach.
- Real endpoint protection with a human response — modern detection and response (EDR) watched 24/7, not a consumer antivirus checking a box. Attacks happen at 2 a.m.; someone has to be awake.
- Backups that are separated and test-restored — attackers hunt for backups first. Yours need to live off your network, encrypted, and be restored on a schedule to prove they work. A backup nobody has tested is a hope.
- Hardened email — advanced filtering that catches impersonation and credential-harvest pages before your front desk ever sees them.
- Trained, unashamed staff — short, regular awareness training and a culture where reporting a suspicious click is praised, not punished. Speed of reporting is what turns an incident into a non-event.
You'll notice these are the same controls your cyber-insurance carrier now requires — that's not a coincidence. The insurance industry has quietly become the small practice's security regulator, and its checklist is a good one.
The HIPAA layer on top
For a covered entity, an incident isn't only an operational crisis — it's a compliance event with notification duties and, potentially, an OCR investigation that opens with one request: your security risk assessment. The five controls above, documented in a current risk assessment, are simultaneously your best defense and your best paperwork.
Score yourself honestly against the five controls this week. Anything you can't confidently check off — or can't prove with documentation — is the priority. Our free practice IT assessment tests all five and hands you the findings in plain English, whether or not we ever work together.
You can't make your practice a smaller target. You can make it a harder one — and attackers, like water, follow the path of least resistance. The goal is simple: be the practice they skip.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →