Small Practices Are Finding Out the Hard Way
The next wave of healthcare data breaches will not hit State-level hospital systems. It will hit small practices with no security team.
In April 2025, the HHS Office for Civil Rights (OCR), which enforces HIPAA, settled with a small neurology practice after a ransomware attack. A month later, OCR settled with another small provider whose server had been broken into, exposing the medical information of 21,778 people. The settlement cost was $5,000 plus considerable reputational damage and two years of monitoring.
When your practice gets hit, the first question insurers, lawyers, and regulators will ask is: What cybersecurity protocols do you have in place? Can you prove you did your best to protect your clients’ medical data? Did you do enough?
For years, small practices assumed that hackers had bigger fish to fry; they were too small to matter. But smaller practices hold the same patient data and use the same connected technology as larger ones. The only difference is that smaller ones have less protection. Cybercriminals have noticed.
Seventeen years of patient data, gone
In the first quarter of 2026, ComplianceJunction began working with a healthcare practice of around 50 people following a serious cyberattack. Seventeen years of patient data were stolen. The practice rebuilt its compliance program, including rigorous HIPAA and Cybersecurity training for every member of staff.
If the training had come earlier, this company could have fended off the cyberattack.
Cyberattack experts are saying the same thing
“Do not make the mistake of thinking that your practice, no matter how small, is not a target for indiscriminate cyber-attacks,” warns retired Army General Paul Nakasone, the former leader of the U.S. Cyber Command.
At the March 2025 HIMSS healthcare technology conference, former head of the NSA and U.S. Cyber Command, retired General Paul Nakasone, noted that “rural hospitals have limited funds, have limited capabilities, and they are often the target of ransomware actors.”
As cyberattacks affect more of the industry, HIPAA compliance and HIPAA training become even more crucial to an organization’s success.
Your staff are the front line, but they might not know it
Staff make security decisions all day: do I click this, can I send this record here, is it fine to paste this into an AI tool, and who do I tell if I think I have made a mistake?
Most data breaches stem from human error. For example, Verizon’s 2026 Data Breach Investigations Report attributed 62% of breaches to human error. No firewall can stop a receptionist taking a convincing call from “the IT provider.” However, learning to recognize scam calls can.
Every practice needs to work out where it is exposed, limit who can get into what, keep backups, use two-factor authentication, and have a plan for that worst-case scenario.
Training builds on those foundations. That is why the quality of training matters as much as the fact of it. Verizon’s figure for human-caused data breaches was 60% last year and 62% this year, despite an entire industry hawking click-through courses. For the healthcare industry, HIPAA compliance training needs an upgrade, one built specifically for the industry covering how attacks happen, how to avoid them, and how to report a breach, so that crises can be mitigated in minutes, not days.
After an attack, someone will ask what you had in place
The technical investigation is only one thread in the resolution process. There are insurers, lawyers, and patients to notify. Depending on the facts, regulators can become involved. Small practices rely on the trust of their communities. News about stolen patient records travels fast; some of those patients will not return to the practice.
The question is no longer why anyone would attack a small practice. Instead, if a practice is attacked, could it show that it took reasonable steps to prepare its organization, staff, and patients? A practice with a proper training program and records can reply from a report. A practice without one builds its program while managing the fallout.
How ComplianceJunction can help
ComplianceJunction delivers AHIMA-approved HIPAA training and healthcare-specific Cybersecurity training.
We designed the 15-module cybersecurity course for healthcare staff. Narrated instructions and a knowledge check in every module cover the ways in which attacks arise through AI-generated phishing, voice cloning, ransomware, and compromised business email. There is also a full module on case studies from real breaches.
Our HIPAA + AI Guardrails course covers the newest decisions on what is safe to put into an AI tool.
For small and mid-sized organizations without a compliance department, ComplianceJunction’s HIPAA training is a straightforward way to train staff, to keep up with annual and new-starter training, and to maintain records showing who completed what and when.
Where to learn more
Cybersecurity protection starts before an attack happens. ComplianceJunction provides AHIMA-accredited HIPAA and Cybersecurity training designed to help staff recognize threats, protect patient information and respond appropriately when something goes wrong.
Explore our training for healthcare organizations, including HIPAA, cybersecurity, and other compliance requirements.
