Illustrative Example
A Small Dental Practice Builds Its HIPAA Evidence
How a small office would move from the free Quick Check and binder, to the kit, to a professional risk analysis. The practice is fictional and invented for teaching.
Illustrative scenario only. Quillfeather Cove Family Dentistry is a fictional practice invented for teaching. This page is not a client story and not a testimonial. No real practice, person, or result is described.
The situation
Quillfeather Cove Family Dentistry has 8 staff and one office. In the same month, five things come up:
- The cyber insurance renewal questionnaire asks whether the practice has a current risk analysis.
- Staff security training took place last spring, but there are no sign-off records or dates to show it.
- A staff member clicked a phishing link and reported it to the office manager. The practice had no written incident procedure and no log to record what happened.
- The nightly backup reports success, but nobody has ever test-restored it.
- The vendor list shows two vendors that handle patient information with no signed business associate agreement (BAA) on file.
The office manager became the Security Official by default and also has a full day job.
Week 1: Find where the evidence is thin (free)
Take the free Quick Check, which has 21 yes, no, or not sure questions. Treat each Not sure as a No until a document proves otherwise. In this scenario, the questions on risk analysis, training, incident procedures, backup testing, and agreements all come back No or Not sure.
Then download the free HIPAA Evidence Binder guide and its starter tracker. Set up the binder folder, name the custodian and the Security Official on the cover sheet, and save the dated Quick Check result in Tab 1.
Weeks 2 to 4: Put the kit to work
The HIPAA Evidence Binder Kit is a $197 one-time purchase. File 01 Read Me First holds the week-by-week plan. For this practice, the files line up with the problems like this:
| Problem | Kit files | What the practice does |
|---|---|---|
| No current risk analysis | 07 Risk Analysis Workbook (Template); 08 Risk Analysis Workbook (Worked Example) | Inventory systems and vendors, score each risk, assign an owner and date, then sign and date the result. File 08 shows what finished entries look like. |
| Training with no records | 05 Workforce Forms (Form 6, Training acknowledgment, with the group sign-in sheet); 09 HIPAA Evidence Tracker (Complete), Training Roster | Record each person's training date and topics, collect signed acknowledgments, and keep the roster current. |
| Phishing click with no incident record | 04 Incident Response and Breach Assessment; 09 HIPAA Evidence Tracker (Complete), Incident and Breach Log | Adopt the written incident procedure, complete the incident report form and the four-factor assessment for the event, and enter it in the log. |
| Backups never restored | 03 Contingency and Disaster Recovery Plan | Restore a sample, then record the date, who did it, what failed, and what changed. |
| Two vendors without agreements | 06 Business Associate Toolkit | List every vendor, request the agreements, review them with the checklist, and file them. |
| Keeping track | 09 HIPAA Evidence Tracker (Complete); 02 Security Policies and Procedures | Give each item a status and an owner, and review the tracker on a set schedule. |
Where a professional risk analysis fits
Some practices prefer to have a credentialed person perform the analysis, or review one done in-house. Adams Cloud performs HIPAA Security Rule risk analyses for small practices. The engagement produces the practice's own written risk analysis, signed and dated, ready to file in Tab 1 of the binder. Details are on the HIPAA assessment page.
For this practice, the register would hold entries such as these (ratings are illustrative):
| Risk | Rating | Planned safeguard | Owner | Target |
|---|---|---|---|---|
| Training not documented | Medium | Collect signed acknowledgments and fill in the training roster | Office manager | 30 days |
| No incident procedure or log | High | Adopt the written procedure and start the incident log | Office manager | 14 days |
| Backups not restore-tested | High | Test restore and record result | Information technology (IT) contact | 60 days |
The practice still carries out the fixes. The analysis tells it what to fix first.
What the practice would have at the end
- Dated Quick Check results.
- A signed, dated risk analysis with an inventory, a risk register, and a risk management plan.
- A training roster with dates, topics, and signed acknowledgments.
- A written incident procedure, plus a completed incident report and four-factor assessment for the phishing event, entered in the incident log.
- A restore test record.
- A vendor inventory with signed agreements filed, or a written plan for each one still missing.
- An evidence tracker showing the status and owner of each item.
This is evidence the practice can show to an insurer, a partner, or the Office for Civil Rights (OCR). It is not a claim that the practice is compliant. Those decisions belong to the insurer and to OCR.
Honest limits
- The kit does not do the work. The practice fills in its details, changes each procedure to match what it really does, collects the proof, and signs.
- The U.S. Department of Health and Human Services (HHS) does not require certification of HIPAA compliance and does not endorse or recognize private HIPAA certifications.
- Everything here is a planning aid. It is not legal advice, a risk analysis of your practice, or a compliance determination. Please have qualified counsel review the documents you adopt.
Next steps
- Take the free Quick Check: adamscloudcyber.com/hipaa-security-quick-check.html
- Get the free binder and starter tracker: adamscloudcyber.com/hipaa-evidence-binder.html
- See the kit: adamscloudcyber.com/hipaa-evidence-binder-kit.html
- Book a free consultation: (619) 289-8064 or thabiti@adamscloudcyber.com
Illustrative scenario only. Quillfeather Cove Family Dentistry is fictional. This is not a client story or a testimonial, and it describes no real result.
Start Where It Costs Nothing
Take the free Quick Check, download the free binder, and move up to the kit or a professional risk analysis only when you need to.