Cybersecurity self-audit: A checklist for your practice

Accountability and oversight

• We know who is responsible for privacy and cybersecurity in our practice.
• These responsibilities have been clearly defined, including password and software updates, audits and incident response.
• We have up-to-date contact information for key staff and vendors in case systems go down or a cyber incident occurs.

Vendors and third-party support

• We know which security responsibilities belong to our clinic and which belong to our vendors.
• We keep vendor contact information up to date.
• We have reviewed security safeguards, backup processes and points of vulnerability with our vendors.

Training and awareness

• All physicians and staff complete annual privacy and cybersecurity training.
• All staff are regularly reminded how to recognize and report suspicious emails, messages and other requests.

Technical safeguards

• Strong passwords and multi-factor authentication are enabled across our systems.
• Our devices and software are regularly updated and patched.
• We maintain and regularly test secure backups of critical data.

Recovery and incident response

• We know how long it would take to restore our systems after an outage or ransomware attack.
• We have a documented plan for responding to a cyber incident, including who to contact.
• Key contact information is readily accessible, even if systems are unavailable.