Practice (sample)

Cedar Lane Family Dental

Location

Columbia, MD

Scope

4 operatories · 9 workstations · 1 server

Framework

HIPAA Security Rule · NIST SP 800-30

Assessment date

Q2 2026

Prepared by

Sentoria

1 · Executive summary

Cedar Lane Family Dental maintains a functional, modern environment and a clearly capable team. However, the practice has no current Security Risk Analysis on file and several controls expected by the HIPAA Security Rule are absent or undocumented. We identified 11 findings: 3 high, 5 medium, 3 low. None require major capital expense; most are configuration and documentation gaps that can be closed within 90 days.

3
High risk
5
Medium risk
3
Low risk

2 · Scope & methodology

This analysis followed the HIPAA Security Rule's risk-analysis requirement (45 CFR § 164.308(a)(1)(ii)(A)), structured against NIST SP 800-30. We inventoried systems that create, receive, store, or transmit ePHI; reviewed administrative, physical, and technical safeguards; interviewed staff; and rated each finding by likelihood × impact. The full engagement also includes policy templates and a remediation tracker (omitted from this sample).

3 · Findings & recommendations

FindingRiskRecommendation
No documented Security Risk Analysis on fileHighConduct and document this SRA; review annually and after material changes.
Front-desk & operatory workstations are not encryptedHighEnable BitLocker on all Windows endpoints; record recovery keys securely.
No MFA on email or the practice-management remote loginHighEnforce MFA on Microsoft 365 and all remote/admin access.
Backups exist but have never been test-restoredMediumMove to encrypted offsite backup; run and log a quarterly restore test.
No signed BAA with current IT vendor or copier-lease vendorMediumObtain signed BAAs from every vendor with potential PHI access.
Staff share a single Windows login at the front deskMediumIssue individual accounts; enable audit logging for accountability.
Workstation patching is manual and inconsistentMediumDeploy managed patching on a documented monthly cadence.
No security-awareness training in the last 12 monthsMediumRun annual HIPAA security-awareness training; keep completion records.
Former employee accounts not disabled at terminationLowAdd account de-provisioning to the offboarding checklist.
No written incident-response / breach-notification planLowAdopt a one-page IR plan; assign roles and a notification path.
Guest Wi-Fi shares the clinical networkLowSeparate guest traffic onto its own VLAN/SSID.

4 · Remediation roadmap

First 30 days (highs): encrypt all endpoints, enforce MFA, and execute the SRA documentation itself.
31–60 days (mediums): migrate to tested offsite backups, collect outstanding BAAs, individual logins, managed patching.
61–90 days (lows + hardening): staff training, written incident-response plan, network segmentation, and an offboarding checklist.

The point of an SRA isn't a grade — it's a plan. A healthy practice usually sees a short, fixable list like this one. The value is having the document, the ratings, and the roadmap on file — so that if a patient complaint, a breach, or an OCR inquiry ever lands, you can show exactly what you assessed and what you did about it.