A Pediatric Practice's First Security Risk Analysis Found 34 Gaps — and Closed the Critical 12 in 90 Days
Eleven years in practice and no Security Risk Analysis on file — the single most common finding in OCR enforcement. The assessment found 34 gaps; the remediation plan closed the critical ones in a quarter.
At a glance
1 location · 5 providers · 22 staff
The challenge
The practice had never completed a Security Risk Analysis. Their prior IT vendor had supplied a one-page 'HIPAA compliant' attestation, which is not a risk analysis and would not have survived an OCR review. Leadership wanted to know their real exposure before their cyber liability renewal.
- No Security Risk Analysis in 11 years of operation
- Shared clinical logins on three exam-room workstations
- Local backups only, on a NAS in the same closet as the server
- Cyber liability application asked questions leadership could not truthfully answer
What we did
- 1
Full ePHI inventory and data-flow map
Every system touching ePHI — EHR, practice management, immunisation registry uploads, patient texting, backups — mapped to where data lives, moves, and leaves the practice.
- 2
Threat and vulnerability register
34 findings scored on likelihood × impact, of which 12 were high severity. Each finding was written with the specific 45 CFR citation it implicates.
- 3
Prioritised remediation roadmap with costs
Findings were sequenced by risk reduction per dollar, not by ease, so the practice spent its first quarter of budget on the twelve items that actually mattered.
- 4
Named accounts and MFA
Shared clinical logins were replaced with named accounts and MFA, which also made the EHR audit log meaningful for the first time.
- 5
Backup rebuild and restore test
Immutable off-site backup with a documented, witnessed restore test — evidence the cyber carrier accepted at renewal.
The outcome
The practice now holds a current, dated Security Risk Analysis with a documented remediation history — the exact evidence trail OCR looks for. The remaining 22 moderate and low findings are tracked on a rolling 12-month plan.
We thought a vendor attestation was a risk analysis. Finding out it wasn't — before OCR told us — was worth the engagement on its own.
Services used in this engagement
More case studies
Client identities are protected under our Business Associate Agreements. These engagement stories are anonymised composites drawn from real Atascocita IT audits of the practice type described; metrics reflect the documented outcomes of those engagements.