If your office couldn’t access its patient records tomorrow, would your team know what to do?
The October 2026 cybersecurity newsletter from the HHS Office for Civil Rights highlights steps healthcare practices can take to protect electronic patient information and prepare for disruptions. For chiropractic offices, these six questions offer a practical starting point.
1. Can your staff recognize and report suspicious messages?
Unexpected attachments, urgent payment requests, and messages asking someone to verify a password deserve a closer look. Remind staff to verify questionable requests through a trusted contact method and make sure everyone knows whom to notify.
2. Are your accounts adequately protected?
Use strong, unique passwords and enable multifactor authentication wherever available, particularly for email and remote access. This adds another identity check beyond a password. Ask your IT provider about phishing-resistant options.
3. Who handles security updates?
Confirm who is responsible for updating your computers, software, and network equipment. Check that updates are actually being installed and identify systems that no longer receive security support.
4. Could you restore your patient records?
Ask when your backups last completed successfully and when someone last tested a restoration. Also confirm how backups are protected from an attack affecting your primary systems.
5. Is someone checking for unusual activity?
Ask your EHR vendor or IT provider how access to patient information is recorded, who reviews those records, and how suspicious activity is brought to your attention. Discuss encryption for stored and transmitted patient information as well.
6. Does your team have a disruption plan?
Keep clear instructions for reporting a suspected incident, contacting technical support, and continuing essential operations when systems are unavailable. Review the plan with staff before you need it.
Put this into practice
Bring these questions to your next staff meeting and share the technical items with your IT provider or EHR vendor. Assign responsibility for any follow-up and document the steps taken.
These questions support an ongoing security program. They do not replace your practice’s HIPAA security risk analysis or other applicable obligations.
Keep your practice informed with NYSCA
Members can visit NYSCA’s Member Resources section for additional practice guidance and tools. Make NYSCA.com your starting point, and share relevant practice alerts with your team.
Source: HHS Office for Civil Rights, October 2026 Cybersecurity Newsletter.