UpsiteGroup

10/12/2026

A Florida eye care practice just notified 13,652 patients and employees that their names, Social Security numbers, driver's license numbers, and medical records were exposed after a network breach discovered this January.

Here's the detail that should get every small practice's attention: the exposed data included employee records sitting right alongside patient charts, on the same network, with the same protections (or lack of them). Most practice owners build their entire security mental model around the EHR. Attackers don't care which folder they're in — only whether it's reachable.

IBM's latest report puts the average healthcare breach at $6.64 million. Healthcare has now been the costliest industry to get breached for 13 years running.

We broke down what happened and the concrete, no-six-figure-budget steps every small specialty practice should check this month. Link in our bio/website.

10/09/2026

Ask most small practice owners who their "HIPAA Security Officer" is, and you'll get a pause, then a guess. Ask to see the written designation, and the pause gets longer.

That's not a technicality — HIPAA requires every covered entity (even a solo practice) to designate both a Privacy Officer and a Security Officer, in writing. One person can hold both roles, and it's standard in practices under 50 staff. What actually matters to OCR is documentation: who holds the role, what authority and time they've been given, and who backs them up.

Search interest in "HIPAA compliance officer" is up roughly 70% in Florida over the past few months. We broke down what OCR actually checks for and how to document it correctly — link in our bio/website.

10/05/2026

A dental software vendor just got hit by the same OCR enforcement initiative as a multi-state hospital network. What decided both cases wasn't how sophisticated the attack was — it was whether they could produce a current risk analysis.

HHS just settled with Ambry Genetics for $700,000 over a single 2020 phishing email. OCR's investigation didn't center on the email — it cited no accurate risk analysis, no process for cutting off a former employee's access, and no unique logins to track who touched patient data. This is now one of more than a dozen OCR settlements built on the same first question investigators ask after any breach: do you have a current risk analysis on file?

If your practice can't produce one dated within the last year, that's your most urgent compliance gap today — not a theoretical future rule. We broke down what OCR's Risk Analysis Initiative actually checks for and what to do about it: https://upsitegroup.com/blog/ocr-risk-analysis-initiative-ambry-genetics-hipaa-settlement?utm_source=facebook&utm_medium=social&utm_campaign=blog_promo

OCR just settled a $700K HIPAA case over a single phishing email — and the real violation was a missing risk analysis. What South Florida medical practices need to check now.

10/02/2026

October is Cybersecurity Awareness Month — and a breach notice out of a Jupiter, FL hospital just gave small practices a case study in why that's about more than passwords.

Jupiter Medical Center sent patients a breach letter in January 2026 — for an incident that actually happened back in January 2025. The 11-month gap wasn't negligence: it involved their EHR vendor Cerner (now Oracle Health) and a law-enforcement-requested delay under federal breach notification rules.

The real question for your practice: does your EHR or billing vendor's contract actually say when THEY have to tell YOU about a breach? Most BAAs are vague on this by design, and vagueness favors the vendor, not you.

We broke down what happened, the specific regulation that allows a notification delay, and what to ask your vendors this month: https://upsitegroup.com/blog/cybersecurity-awareness-month-vendor-breach-notification-jupiter?utm_source=facebook&utm_medium=social&utm_campaign=blog_promo

HIPAA-compliant IT support and managed services for small medical offices across Palm Beach, Broward & Miami-Dade counties. Fast, secure, and reliable.

09/30/2026

No malware. No phishing email. Just a spoofed caller ID. That's how attackers got into Astrana Health's systems this month — impersonating company staff and faking the caller ID on the company's own main corporate number to trick employees into granting access. The SEC filing (Sept 22) confirms patient data, employee records, and confidential business records were accessed. This runs the opposite direction from the McKesson/Baxter story we covered a few weeks ago: instead of calling INTO a help desk, attackers called OUT to employees wearing a trusted number as a disguise. If your staff would grant access to a call that "looks right" on caller ID, you have the same exposure — just at a smaller scale. We break down what actually happened and the callback-verification policy every practice should have in place. Read the full breakdown on our blog. Link in our bio/website.

09/28/2026

29% of physicians are now using an AI scribe to write their patient notes — up from 20% just nine months ago. If your practice hasn't been pitched one yet, it will be soon, and the sales demo won't walk you through the HIPAA questions that actually matter: is it covered under your EHR's BAA or does it need its own? Do patients know they're being recorded, and can they opt out? Who reviews the AI-generated note before it's signed? We broke down the vendor checklist every South Florida practice should run through before signing an AI scribe contract. Read the full breakdown on our blog. Link in our bio/website.

09/26/2026

Your staff is probably already using ChatGPT or Claude. The question is which account they're using - because the free/personal tiers of both are NOT covered by a Business Associate Agreement, per Anthropic's and OpenAI's own published terms. That means no patient information belongs in them, full stop.

We broke down exactly where the line is: what's fine on any account, what needs a business-tier account with a signed BAA, and how a HIPAA-focused IT partner should be managing this alongside your EHR.

Read the full breakdown on our blog. Link in our bio/website.

09/26/2026

"Which EHR is right for my practice?" isn't a top-10 list question - it's a certification question first. If you bill Medicare, your EHR needs to be ONC-certified (CEHRT), verifiable yourself through the ONC's public Certified Health IT Product List, before you even look at features.

We work with practices on athenahealth, Tebra, and eClinicalWorks, and broke down what each vendor actually says about its own small-practice fit - plus the 4 questions about your BAA, migration costs, and support that matter more than any demo.

Read the full breakdown on our blog. Link in our bio/website.

09/25/2026

Ransomware attacks on U.S. healthcare hit 460+ in 2025 — more than any other critical infrastructure sector — with an average of 17 days of downtime per attack (2025 Ponemon Healthcare Cybersecurity Report, via the Florida Hospital Association).

Here's the part that matters even if your practice is never breached: nearly 90% of healthcare orgs say a cyberattack on a supply chain partner — a hospital, lab, or vendor — disrupted patient care. Nearly half saw increased complications, and over half had procedures delayed.

If your practice refers into the same regional hospital systems and labs everyone else in South Florida uses, a breach three counties away can still land on your schedule. We break down what that means for a practice that didn't cause the disruption, and how to build enough slack that it doesn't become your problem too. Link in our bio/website.