Health Clinics
Your Clinic Closes at Six. The Monitoring on Patient Data Does Not.
Attacks on a clinic tend to run when the lights are off. Our managed detection and response watches endpoints, accounts, cloud and network around the clock, and acts on what it sees.
For clinics that hold patient records and have no security team watching them after hours.
Managed Security Monitoring (MDR and SOC) for Health Clinics
What Does the HIPAA Security Rule Say About Logs?
It requires audit controls: hardware, software or procedures that record and examine activity in systems that contain or use ePHI (45 CFR 164.312(b)). It also lists log-in monitoring, procedures to monitor log-in attempts and report discrepancies, as an addressable safeguard (164.308(a)(5)(ii)(C)).
Recording activity is the easy half. Examining it is where clinics fall short, and that is what a security operations center does.
What Does the SOC Watch in a Clinic?
Logs and alerts from exam room and front desk workstations, servers, Microsoft 365 and the network, collected in a managed SIEM and watched 24/7. Analysts investigate what looks wrong, such as a sign-in to a provider's account from another country at 2 a.m. or a new mailbox rule forwarding mail outside the clinic, and act on it: isolating a device, disabling an account, stopping a process.
Why Does Detection Speed Matter for Breach Notification?
Because the clock starts at discovery. Under the Breach Notification Rule, a breach is treated as discovered on the first day it is known, or would have been known by exercising reasonable diligence (164.404(a)(2)), and notice to affected individuals is due without unreasonable delay and no later than 60 calendar days after (164.404(b)). Breaches affecting 500 or more people also mean notice to HHS at the same time, and more than 500 residents of a state means notice to the media (164.406, 164.408).
Monitoring cannot decide whether an incident is a reportable breach; that is for you and your counsel. It does give you the facts early, while there is still time to act on them.
What Happens When There Is an Incident?
You hear from us, and the response has already started. The Security Rule requires a clinic to identify and respond to suspected or known security incidents and document them (164.308(a)(6)). Your incident response plan is formalized ahead of time, so everyone knows who decides what, including who calls the EHR vendor and who calls counsel.
What Is Included
6 PARTS24/7 SOC Monitoring
Logs and alerts from clinic workstations, servers, Microsoft 365 and the network, watched around the clock.
Managed Detection and Response
Analysts who investigate and act, not just forward an alert.
Incident Response
A formal plan, and a team that runs it with you.
Threat Detection on Accounts
Suspicious sign-ins and mailbox rules on staff accounts flagged and acted on.
Reporting
What we saw and what we did, in plain language.
Ransomware and Phishing Defense
Detection tuned to the attacks small practices see most.
How Managed Security Monitoring (MDR and SOC) Works for Every Client
Frequently Asked Questions
4 QUESTIONSDoes HIPAA require 24/7 monitoring?
The Security Rule requires audit controls that record and examine activity in systems holding ePHI (45 CFR 164.312(b)) and does not set an hours requirement. Around the clock monitoring is how we examine that activity, including nights and weekends when the clinic is closed.
How long do we have to notify patients after a breach?
Without unreasonable delay and no later than 60 calendar days after the breach is discovered, under 45 CFR 164.404(b). Whether an incident is a reportable breach of unsecured protected health information is a determination to make with your counsel.
Will you tell us about every alert?
No. Most alerts are investigated and closed by our team. You get a report of what we saw and are called when a decision is yours.
Is monitoring enough on its own?
No. Monitoring works best on top of the basics: multi-factor authentication, endpoint detection and response, patching, tested backups and trained staff.
More for Health Clinics
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Health Clinics
Managed IT and security for medical clinics, with the HIPAA Security Rule safeguards run every day.
Talk Through Your Clinic's Security.
Pick a time. Tell us which systems hold patient data and who watches them after hours.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.