Medical, dental and allied health practices carry some of the most sensitive information any small business handles, usually without an in-house IT team. When an audit or a privacy review arrives, the questions are consistent and the evidence is either there or it is not.
Who has access, and how do you know?
Not a list of logins. A record of who has access to what, when it was last reviewed, and what happens on the day somebody leaves. Reception staff turnover is normal; accounts that outlive the person are not.
Where does the data actually live?
Practice management systems, imaging, backups and any cloud service in use. The awkward answers are usually the ones nobody catalogued: a scanner writing to a share, images on a workstation, a spreadsheet on somebody’s laptop.
Can you restore, and have you tried?
- A backup that includes the practice management database, not only the file server
- A restore that has been performed, with the date and the time it took
- Copies that ransomware on the network cannot reach
What happened the last time something went wrong?
Auditors are less interested in perfection than in whether you notice, record and respond. An incident log with three entries and clear outcomes reads better than an empty one, which usually means nothing is being detected.
The evidence for all of this is the same evidence good IT management produces anyway. The practices that struggle at audit are rarely the ones with bad technology. They are the ones where nobody was responsible for writing any of it down.