01
Staff using free chatbots
Staff paste visit notes into free AI tools to save time. Those tools may keep the text, and nobody records the disclosure.
The sprint checks
Which tools staff use, and gives you a one-page rule they sign.
Common risks
How small practices get exposed.
Rarely through an elite hacker. Usually through an ordinary gap. These are the six I see most.
02
AI features from vendors
Your phone, messaging, and EHR vendors add AI in routine updates. The BAA you signed two years ago doesn't mention it.
The sprint checks
Every AI feature against your contracts, with a question ready for each vendor.
03
Email fraud
Phishing and fake "new bank account" emails are two of the most common ways in. One click at the front desk can expose an inbox of patient messages.
The sprint checks
Your email security settings (SPF, DKIM, DMARC) and MFA coverage.
04
Old accounts nobody closed
A former contractor, an old MSP admin, a shared front-desk login. Nobody notices them until something goes wrong, and auditors ask about them first.
The sprint checks
Who can reach each system and which accounts should be closed.
05
Untested backups
"We back up to the cloud" isn't a recovery plan. Surviving ransomware depends on whether anyone has ever restored from those backups. Usually nobody has.
The sprint checks
How you'd recover, through a one-hour downtime tabletop.
06
Patient data outside the EHR
Web forms, billing exports, texts, shared drives, and phones. When data is spread everywhere, nobody can say what was exposed.
The sprint checks
Where patient data enters, moves, rests, and leaves, with an owner for each flow.
The pattern
Each of these is a gap between systems.
Your EHR vendor secures the EHR. Your MSP runs the network. Nobody owns the space in between. The sprint does.
How to spot a gap
- You hear yourself say "I'd have to ask our IT guy."
- The answer lives in one person's memory.
- Nobody knows who approved a tool.