HIPAA does not require the most expensive security tools. It requires reasonable precautions and a record of what you did and why.
If you run a small dental or professional office, you have probably heard some version of this pitch: HIPAA is scary, the fines are huge, and the only safe move is to buy the newest, most expensive security package on the market.
Here is the good news. That is not what the law says.
The HIPAA Security Rule was written to fit practices of every size, including a four-chair dental office in Glenwood Springs. It does not require the latest and greatest technology. It requires reasonable precautions, and it requires you to write down what you did and why. Do both, and compliance is well within reach for a small practice.
Here is what that looks like in plain terms.
The Security Rule includes a section titled “Flexibility of approach.” It says a practice may use any security measures that let it reasonably and appropriately meet the standards. When deciding which measures to use, a practice must consider four things: its size, complexity, and capabilities; its technical setup; the cost of the security measures; and how likely and how serious the risks are.?45 CFR 164.306(b), Flexibility of approach.
Cost is written right into the regulation. HHS’s own risk analysis guidance makes the same point: the right safeguards for a small organization may differ from those for a large one.?HHS OCR, Guidance on Risk Analysis.
That does not mean “anything goes.” It means the rule expects a small office to make sensible choices that fit a small office.
Each part of the Security Rule is labeled either Required or Addressable.?45 CFR 164.306(d), Implementation specifications.
That second step, writing down your reasoning, is where a lot of small practices fall short. They may have made perfectly good decisions, but there is no record of them.
The single most important document is your risk analysis. The rule requires “an accurate and thorough assessment” of the risks to the electronic patient information you hold, followed by risk management: putting safeguards in place that bring those risks down to a reasonable level.?45 CFR 164.308, Administrative safeguards.
HHS calls risk analysis “the first step” in Security Rule compliance and says it should be ongoing, not a one-time project. It does not require a specific format or method. HHS even offers a free Security Risk Assessment Tool designed for small and medium practices.?ONC / HHS, Security Risk Assessment Tool.
Since 2024, HHS’s Office for Civil Rights (OCR) has run a Risk Analysis Initiative that focuses investigations on this one requirement. A few recent examples:
Notice the pattern. In each case, the core finding was a missing risk analysis or missing policies and procedures. None of these announcements faults the practice for failing to buy a particular product. The corrective action plans ask for the basics: a real risk analysis, a risk management plan, written policies, and staff training.
This is where we want to be straight with you. Paperwork alone is not compliance.
A binder that says “all laptops are encrypted” when they are not is worse than no binder at all. Your documentation has to describe what is actually happening in your office, and you have to keep it current. The rule requires written policies, written records of required activities, review and updates as things change, and retention for six years from the date a document was created or last in effect, whichever is later.?45 CFR 164.316, Policies and procedures and documentation requirements.
And some safeguards are real work that has to be done, not just described:
None of this requires premium technology. Most of it is careful setup, consistent habits, and good records.
Encryption is technically “addressable” under today’s rule.?HHS FAQ: Is encryption mandatory? In practice, it is one of the most valuable things a small office can do, and it is usually built into the computers and software you already own.
Here is why it matters. HIPAA’s breach notification requirements apply to unsecured patient information. HHS guidance says information encrypted to its standard, with the key kept safe, is not “unsecured.” So if an encrypted laptop is stolen from a car, that generally is not the reportable breach it would be if the laptop were unencrypted.
One more note: HHS proposed an update to the Security Rule in January 2025 that would make encryption and several other safeguards mandatory. As of this writing it has not been finalized, and the federal regulatory agenda now lists final action for July 2027. Doing these things now is simply good preparation.
A 2021 amendment to the HITECH Act (Public Law 116-321) tells HHS to consider whether a practice had recognized security practices in place for at least the previous 12 months when deciding fines, audits, and settlement terms. One of the frameworks named in that law is the HHS 405(d) program, which publishes free guidance written specifically for small healthcare organizations. That guidance compares good cyber hygiene to hand washing and says it “does not have to be complicated or expensive.”
The law does not create a get-out-of-jail-free card. It does mean that steady, documented, reasonable practices are recognized.
At Roaring Fork Valley IT, we work with independent dental and professional offices from Aspen to Rifle. We put the precautions in place, and we keep the documentation that shows it: the risk analysis, the risk management plan, policies that match how your office actually runs, training records, BAAs, and regular reviews to keep it all current.
You get the protection and the paper trail, sized for your practice.
If you would like to talk through where your office stands, reach us at help@rfvit.com or (970) 670-9726. No pressure, just a straight conversation.
This article is general information, not legal advice. For questions about your specific obligations under HIPAA, please consult a qualified healthcare attorney.
