The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A small medical practice should protect patient information by first identifying where electronic protected health information (ePHI) is stored and how it moves, then assessing risks, choosing safeguards that fit those risks, and preparing to restore care after an incident. Backups are essential, but a copy that attackers can reach or that the practice has never restored is not a dependable recovery plan.
Start by establishing which HIPAA obligations apply
HIPAA requirements depend on the organization and the way it handles health information; a small practice should not assume that every provider has identical obligations. The U.S. Department of Health and Human Services (HHS) describes health care providers as covered entities when they transmit health information electronically in connection with a transaction for which HHS has adopted a standard. Confirm the practice’s status rather than relying on its size, specialty, or the fact that it uses an electronic health record (EHR).
As an Amazon Associate I earn from qualifying purchases.
Identify business associates and other vendors that handle ePHI or support systems used to deliver care. That may include the EHR provider, billing services, IT support, or other service providers, depending on the practice’s actual arrangements. Make a record of who is responsible for each system and who to contact if access, data integrity, or availability is affected. HHS’s guidance for small providers says size, capabilities, and costs can be considered when selecting security measures, but those considerations come after assessing risks and vulnerabilities.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMap the information and systems the practice depends on
A risk analysis is more useful when it reflects the way the practice actually works, not just the equipment listed on an invoice. Map where ePHI is created, viewed, stored, transmitted, and backed up. Include the systems that support clinical operations and the people or vendors who can access them.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Build a practical inventory
For each relevant system, device, or service, record what it does, what information it handles, who uses it, how it connects to other systems, and who maintains it. Consider:
- EHRs, practice-management and billing systems, file storage, and any systems that support clinical workflows.
- Workstations, laptops, mobile devices, servers, network equipment, and removable storage used to handle or access ePHI.
- Locations where paper records or equipment are kept, along with remote-work arrangements and remote access.
- User accounts, administrative accounts, service accounts, and vendor access, including who approves and reviews them.
- Connections between systems, data-sharing arrangements, and the vendors that store, transmit, or support ePHI.
- Existing security measures, backups, recovery procedures, and any known gaps or prior disruptions.
An inventory is not merely a list of hardware. It should help the practice see what could be affected if a device, account, vendor, or essential application became unavailable or was compromised. Keep it current as systems, vendors, staff roles, and workflows change.
Assess risks before choosing new safeguards
Identify plausible threats and vulnerabilities, review the safeguards already in place, and evaluate how a gap could affect the confidentiality, integrity, or availability of ePHI. Rank findings by their likely effect on patients and operations, not by how easy a product is to buy. For example, a system that is necessary to access clinical information may deserve more attention than a device with no role in care delivery, while a rarely used account with broad access may still create meaningful exposure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Document what the practice found, which risks it will address, who is responsible, and why the selected safeguards are appropriate. HHS provides a Security Risk Assessment Tool intended to assist small and medium practices, as well as guidance for small providers. A tool can help structure the work; it does not replace a practice-specific assessment or the decisions needed to act on its findings.
Choose layered protections that address identified risks
No single security measure protects every account, device, vendor connection, and workflow. HHS 405(d) small-organization materials identify practices to consider, including strong or unique credentials, multifactor authentication (MFA), limits on remote desktop access, controls on authentication attempts, anti-malware, separation of vulnerable systems, and an updated asset inventory. These are considerations for a risk-based plan, not a universal checklist that guarantees compliance.
Protect accounts and remote access
Use strong, unique credentials for accounts that access practice systems, and enable MFA where the relevant service supports it. MFA adds a verification step beyond a password; its value depends on correct setup and on the accounts and systems it covers. Review who has remote access and whether that access is necessary. HHS 405(d) recommends limiting remote desktop access and controlling authentication attempts. The practice should review these settings with its IT support and vendors so that safeguards do not unintentionally block required clinical or administrative work.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Check that access matches each user’s role and that administrative access is not casually shared. When staff responsibilities change, include account and access review in the transition. A practice should know who can approve access changes and where to report a suspected account compromise.
Maintain visibility and reduce avoidable exposure
Keep the asset inventory updated and consider anti-malware and separation of vulnerable systems in light of the practice’s environment. An inventory helps staff and support providers identify which devices and applications may need attention during a security event or recovery. System separation can limit how easily a problem in one area affects others, but the right configuration depends on how the practice’s technology and vendors work together.
Before changing a control, check dependencies with the relevant support provider. A measure that is sensible in principle can disrupt access to an EHR or another clinical application if implemented without understanding its connections. Record the decision, the system it affects, and who will verify that essential functions still work.
Make backups a recoverable part of continuity planning
HHS describes a data backup plan as a Security Rule requirement for covered entities and business associates as part of an overall contingency plan. That plan also includes restoring data, continuing critical functions in emergency mode, and periodic testing. Backups are therefore one part of a larger effort to keep care and essential operations going when systems are disrupted.
Decide what must be recoverable and how quickly
Identify the data and applications the practice would need to resume critical work. A usable recovery may depend on more than patient files: applications and their supporting systems may also matter. Consider which records and functions are essential, how much recent information the practice could tolerate losing, and how long it could operate without each system. These answers help determine backup frequency, retention, and restoration priorities. HHS does not specify one backup schedule that suits every practice, so set a schedule based on operational needs and document the reasoning.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchProtect copies from the incident affecting production systems
HHS 405(d) ransomware material recommends that backups not be accessible on the network they protect. The aim is to avoid having the same network compromise or attack reach both the working systems and the copies needed for recovery. Protect backup access against unauthorized use, and consider encryption, physical security, automation, data volume, and retention in the local plan. Decide who can access the copies and who is authorized to restore them.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
An external drive may provide one separate copy, but purchasing a storage device alone does not establish a sound backup strategy or demonstrate that HIPAA obligations have been met. The practice needs to know what is copied, whether the copy is protected, how often it is updated, where it is kept, and how to restore usable information from it. HHS does not endorse a particular drive or prescribe a universal configuration.
Compare approaches using recovery needs, not labels
There is no source-supported ranking of backup devices or vendors. Compare the practice’s options against the same operational questions:
| Decision point | Question to answer | Why it matters |
|---|---|---|
| Isolation | Can an incident on the production network also reach or alter this copy? | A backup that is accessible to the same compromised environment may not be available when recovery is needed. |
| Access protection | Who can access, change, or delete the copy, and how is that access controlled? | Only authorized access should be part of the practice’s plan. |
| Recovery speed and tolerable data loss | How long can the practice wait to resume a function, and how much recent information could it lose? | These operational needs inform backup frequency, retention, and restoration priorities. |
| Applications as well as files | Does the recovery plan account for the applications and supporting systems needed to use the restored information? | Files alone may not be sufficient to resume a clinical workflow. |
| Administration | Who is responsible for maintaining copies, checking failures, and initiating restoration? | A plan needs an accountable owner and workable procedures. |
| Restore testing | Has the practice restored usable data and recorded the result? | A copy’s existence does not prove that it can be used in recovery. |
Test restoration and plan for emergency operations
A backup plan should include actual restoration tests, with results documented. Define who performs a test, what data or functions it checks, and how the practice records problems and follow-up. The test should establish whether the practice can retrieve usable information and whether the people responsible understand the restoration process. HHS calls for periodic testing as part of contingency planning; it does not set a universal testing interval in the guidance described here.
Recommended Free Tools
Include recovery of critical functions and emergency operations in the plan, not just the technical steps for copying files. Decide which roles coordinate the response, where staff find current procedures, and how the practice will handle essential work if normal access is interrupted. Keep recovery instructions available in a way that does not depend entirely on the systems that might be unavailable.
When a test fails, treat that as a finding to resolve: identify whether the issue is missing data, access, application dependencies, unclear ownership, or another obstacle. Assign responsibility and confirm that the correction works in a later test. Record enough detail for the practice to understand what was tested and what remains unresolved.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prepare for ransomware and other security incidents
Maintain incident procedures that staff can follow and rehearse them. Establish who should be contacted inside the practice and at relevant vendors, who coordinates technical response, and who evaluates privacy and notification obligations. During an incident, preserve relevant evidence and determine which systems and PHI may be affected. The response should not assume that restoring systems answers every privacy question.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
HHS says ransomware is a security incident and may also constitute an impermissible disclosure or breach, depending on the circumstances. The breach analysis is fact-specific and considers the PHI involved, the unauthorized recipient or user, whether PHI was actually acquired or viewed, and mitigation. Document the analysis and make required notifications when applicable. Technical recovery and breach assessment are related workstreams, but completing one does not automatically resolve the other.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Evaluate outside support without outsourcing accountability
A small practice may need help assessing risks, implementing safeguards, or restoring systems, but the fit of a service matters more than a general claim of healthcare expertise or security. Ask prospective support providers how they would help the practice document its risk analysis, understand existing EHR and vendor dependencies, test backup restoration, and respond when an incident occurs. Clarify what the provider will do, what remains the practice’s responsibility, who is available during an incident, and how decisions and test results will be documented.
Review compatibility with existing systems before adopting a new tool or changing a control. A provider should be able to explain how its recommendations fit the practice’s workflows and identified risks rather than promising that a product or service alone makes the practice compliant. Keep ownership of the risk decisions, contingency plan, and follow-up actions clear even when outside specialists perform technical work.
Turn the plan into assigned work
A manageable first pass can produce concrete actions without pretending that a checklist replaces risk analysis. Assign a practice lead to coordinate the following work and track each item to completion:
- Confirm scope: determine whether the practice is a covered entity and list vendors and business associates that handle ePHI.
- Map dependencies: inventory relevant data, systems, devices, users, remote access, locations, and support providers.
- Record risks: assess threats, vulnerabilities, and current safeguards; rank gaps by their likely effect on confidentiality, integrity, and availability.
- Select safeguards: document the controls chosen for the identified risks and verify compatibility with clinical systems and vendors.
- Define recovery: identify essential information and functions, set backup and retention decisions based on operational needs, restrict access to copies, and assign restoration responsibility.
- Exercise the plan: test restoration and emergency procedures periodically, record results, and assign follow-up for failures.
- Rehearse response: make sure staff know whom to contact and that the practice can investigate affected systems and PHI, preserve evidence, and conduct a fact-specific breach analysis.
HHS’s small-provider FAQ expresses the flexibility behind this approach: “The Security Rule standards allow any covered entity (including small providers) to use any security measures that help the covered entity to reasonably and appropriately implement the standards to protect electronic health information.” Flexibility does not mean skipping the assessment; it means selecting and documenting safeguards suited to the practice’s risks, capabilities, and circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
