Is Your Practice Ready for a Cyberattack?

When most of us think about cybersecurity, we picture large hospital systems getting hit with ransomware and making the evening news. We tell ourselves, "Nobody's coming after my small O&P practice." That thinking is exactly what makes small practices attractive targets. 

LevelBlue's 2025 Spotlight Report on Cyber Resilience in Healthcare makes something very clear: cybersecurity is no longer an IT problem sitting in the corner of your operations. It's a core business risk — right alongside billing compliance, accreditation, and payer audits. And the data shows that most healthcare organizations, regardless of size, are underprepared. 

Small Practices Are Actually at Greater Risk 

Large health systems have dedicated IT security teams, incident response plans, and cyber insurance with real teeth. Most small O&P practices have one person who handles "the computers," a decent antivirus subscription, and a password policy that nobody follows consistently. 

Cybercriminals know this. They also know that O&P practices hold exactly the kind of data they want — protected health information (PHI), insurance details, social security numbers, Medicare IDs, and financial records. A patient record on the dark web can sell for far more than a stolen credit card number. You are not too small to be a target. You are small enough to be an easy one. 

The LevelBlue report found that healthcare organizations consistently underestimate both the likelihood and the business impact of a breach. The fallout isn't just a fine from HHS. It's days or weeks of operational disruption, patient notification costs, potential litigation, and — perhaps most damaging for a small practice — the erosion of trust with your referral sources and patients. 

What a Breach Actually Looks Like in a Small O&P Practice 

A front office staff member gets an email that looks like it's from your clearinghouse. She clicks a link, enters her credentials, and goes back to work. Three weeks later, you find out your entire patient database has been sitting in someone else's hands — and you have no idea how long it's been there. 

This isn't hypothetical. Phishing attacks are the number one entry point for healthcare breaches, and they don't require a sophisticated hacker. They require one busy, well-meaning employee having a distracted moment. That happens in every practice, every day. 

The operational ripple effect is significant. Your systems go down or get locked. You can't access critical programs, communications can be impacted, deliveries get delayed. Your team is scrambling, your patients are frustrated, and you're on the phone with a breach response attorney trying to figure out your HIPAA notification obligations — all at the same time. 

Where to Start Without Overwhelming Yourself 

Reducing your risk doesn't require a massive IT budget. It requires consistent habits and a basic plan. Start here: 

• Train your team, not just once. Phishing simulations and brief quarterly reminders do more than a one-time annual module. Make it part of your regular team meetings. 

• Don’t reuse Passwords. Reusing passwords across systems is one of the most common security mistakes. Browser-based password tools are not built for a clinical business environment. A dedicated password manager keeps credentials unique, secure, and accessible to the right people on your team. 

• Use multi-factor authentication (MFA) everywhere. Email, EHR login, your clearinghouse portal — everywhere. This single step blocks the vast majority of credential-based attacks. 

• Choose phishing-resistant MFA when you can - Not all multi-factor authentication is equal. A hardware security key is the most secure option, followed by an authenticator app like Google Authenticator or Microsoft Authenticator. Text message or email codes are better than nothing, but they're the easiest to compromise — so treat them as a last resort. 

• Know where your data lives. Can you name every place patient PHI is stored or transmitted? Cloud backups, fax services, scheduling tools, and text messaging platforms all count. 

• Have a written incident response plan. It doesn't need to be long. It needs to answer: Who do we call? What do we shut down first? Who notifies patients? What are our HIPAA reporting timelines? 

• Review your cyber insurance. Many small practices either don't have it or have coverage that won't actually cover a real incident. Read the policy. Talk to your broker. 

• Back up your data — and test the backup. An untested backup is not a backup. Make sure you can actually restore from it. 

Your Team Takes Its Cues From You 

The LevelBlue report frames cyber resilience as a business continuity issue, and that framing matters. If your practice couldn't operate for five days, what would that cost you? In revenue, in relationships, in reputation? That's the real question — and the answer should drive how seriously you treat this. 

As the person running or leading your practice, cybersecurity posture starts with you. If you're not asking about it, your team isn't prioritizing it. If you don't have a plan, your staff has no idea what to do when something goes wrong. 

You don't have to become a cybersecurity expert. But you do have to stop assuming it won't happen to you.