Why Your Cloud EHR Doesn't Make Your Practice HIPAA Compliant

"We use SimplePractice, so we're HIPAA compliant."

We hear this every week. It's dangerously wrong.

What Your EHR Vendor Actually Guarantees

When SimplePractice, TherapyNotes, Jane App, or any cloud EHR says they're "HIPAA compliant," they mean:

Their servers:

1. Encrypted at rest
2. Encrypted in transit
3. Access controlled
4. Audit logged
5. Regularly assessed

Their responsibility:

1. Their data centers
2. Their application code
3. Their employees
4. Their backup systems

Not their responsibility:

1. Your laptop
2. Your WiFi
3. Your passwords
4. Your staff
5. Your phone
6. Your home office

The Shared Responsibility Model

Think of it like renting a secure office building:

Building owner provides:

1. Locked exterior doors
2. Security cameras in hallways
3. Fire suppression
4. Secure server room

You're responsible for:

1. Locking your office door
2. Not propping open the fire exit
3. Shredding sensitive documents
4. Controlling who has your keys

Your EHR vendor secured the building. Everything inside your "unit" is on you.

What Cloud EHRs Don't Protect

1. The device you use to access it

Your laptop could be:

1. Unencrypted (data exposed if stolen)
2. Running outdated software (vulnerable to exploits)
3. Infected with malware (keyloggers capturing passwords)
4. Shared with family members (kids installing games with malware)

2. The network you connect from

Your WiFi could be:

1. Using weak encryption (WPA2-Personal or worse)
2. Shared with neighbors (apartment building)
3. Running on a compromised router (default passwords)
4. Monitored by attackers (coffee shop)

3. The credentials you use

Your login could be:

1. A password you use everywhere (credential stuffing)
2. Written on a sticky note (physical access)
3. Shared with staff (no accountability)
4. Missing MFA (one password away from breach)

4. The other software on your device

Your computer might have:

1. Browser extensions harvesting data
2. Personal email with phishing links
3. Pirated software with backdoors
4. Outdated plugins with known vulnerabilities

Real Breach Scenarios

Scenario 1: Stolen laptop

1. Therapist's laptop stolen from car
2. EHR password saved in browser
3. Disk not encrypted
4. Attacker accesses all patient records
5. EHR vendor not liable. Practice is.

Scenario 2: Phishing attack

1. Front desk clicks email link
2. Enters EHR credentials on fake site
3. Attacker logs in from overseas
4. Downloads entire patient database
5. EHR vendor not liable. Practice is.

Scenario 3: Home WiFi compromise

1. Dentist works from home
2. Uses same network as teenager
3. Teen downloads infected game
4. Malware captures EHR session
5. EHR vendor not liable. Practice is.

What HIPAA Actually Requires (Beyond the EHR)

Access Controls (§164.312(a)):

☐ Unique login for every user

☐ Auto-logout after inactivity

☐ Role-based access (not everyone sees everything)

☐ Emergency access procedures documented

Audit Controls (§164.312(b)):

☐ Logging on your devices (not just EHR)

☐ Network access logs

☐ Review process for suspicious activity

☐ 6-year retention

Integrity Controls (§164.312(c)):

☐ Verification that data isn't altered

☐ Backup verification

☐ Malware protection

Transmission Security (§164.312(e)):

☐ Encrypted email for PHI

☐ Secure file sharing

☐ VPN for remote access

Device Security:

☐ Full disk encryption

☐ Endpoint protection (modern antivirus)

☐ Mobile device management

☐ Patch management

The Documentation Problem

Even if you do everything right technically, HIPAA requires:

1. Risk assessment - Annual, documented, comprehensive
2. Policies and procedures - Written, reviewed, acknowledged
3. Training records - Who was trained, when, on what
4. Incident response plan - What to do when things go wrong
5. Business associate agreements - With everyone who touches PHI

Your EHR vendor provides their BAA. They don't write your policies, train your staff, or document your risk assessment.

The Audit Scenario

OCR shows up and asks for:

1. Your most recent risk assessment
2. Evidence of staff HIPAA training
3. Audit logs from the last 6 months
4. Your incident response plan
5. Device encryption verification

Can you produce all of this? Your EHR can't help you.

What Smart Practices Do

1. Treat the EHR as one layer

1. Compliant EHR + insecure devices = not compliant
2. All layers must be secured

2. Encrypt everything

1. Laptops: BitLocker (Windows) or FileVault (Mac)
2. Phones: Usually default, verify
3. Tablets: MDM with encryption requirement

3. Enable MFA everywhere

1. EHR (if available)
2. Email (absolutely required)
3. Any cloud service with PHI

4. Secure the network

1. Business-class router/firewall
2. Separate guest WiFi
3. VPN for remote access

5. Document everything

1. Annual risk assessment
2. Written policies
3. Training records
4. Incident response tested

The Cost Comparison

"We're cloud-based, we're fine" approach:

1. $0/month on security
2. $100,000+ when breach occurs
3. $50,000+ in fines
4. Reputation: destroyed

Proper security approach:

1. $200-300/user/month
2. Breach likelihood reduced 90%+
3. Audit-ready documentation
4. Sleep at night: priceless

Bottom Line

Your cloud EHR is a secure filing cabinet. But if you leave the office door unlocked, the cabinet doesn't matter.

HIPAA compliance requires:

1. Secure EHR ✓ (you have this)
2. Secure devices (probably not)
3. Secure network (probably not)
4. Secure credentials (maybe not)
5. Documentation (definitely not)

One out of five isn't compliant.

Think your practice is covered because you use a cloud EHR? Let us show you what's actually exposed. Get Free Assessment

Need Help With Your Practice’s Security?

Free assessment, no obligation, real answers.

Get Free Assessment

(469) 306-9520 • Serving Dallas-Fort Worth