Practice Technology & Cyber Risk Snapshot — Beech Tree Technology Advisors
September 28, 2026
ILLUSTRATIVE SAMPLE · FICTIONAL PRACTICE
Where you stand — practice and household together
Your practice systems are strong. Your biggest exposure is uncertainty: on 31 of 104 questions, no one in the room could say yes or no. That is usually a bigger risk than a single missing control, because you can't manage what no one has checked.
How to read 54%: we asked 136 questions covering your practice, home network, remote work, AI habits, and household devices; 104 applied to you (32 did not — for example, questions about children in the household). A full "yes" counts fully, "partial" counts half. This is a conversation guide, not an audit score.
The same picture, by area
What is working well
- ✓Sign-in protectionMFA on email, admin accounts, and key apps. Admins use stronger, phishing-resistant sign-in.
- ✓Devices kept currentAutomatic patching and endpoint protection on all devices. Old systems retired or isolated.
- ✓Email defensesSpam and phishing filtering, spoofing protection, and office macros blocked.
- ✓BackupsEncrypted, with one copy kept offline. Restores have been tested, not just assumed.
- ✓Access controlStaff are added and removed promptly, daily accounts have no admin rights, and a password manager is used.
Your next steps
Pick one person, ideally Marcus, and write down their name. They coordinate vendors and keep a short list of rules for passwords, devices, and patient data.
There is no policy on which AI tools staff may use with patient data, and no shared habit for verifying an unexpected urgent call or voice message before acting on it. The same verification habit protects a wire transfer at the office and a family emergency call at home.
No staff training has run, and no simulated phishing emails have been sent. A short yearly session plus quarterly test emails is a solid start.
Home smart-home devices share the same network as work devices, and the office VPN isn't used consistently on every network a device connects to. A guest network at home, and a rule to always use the VPN off-site, close both gaps.
Nobody could confirm the practice's Microsoft 365 security configuration, or whether home routers used for remote charting have current firmware and a changed default password.
Phone numbers for your IT provider, EHR vendor, cyber insurer, and attorney on one sheet, plus who decides what, and who watches for trouble after hours.
Why this Snapshot also looks at home and family
- Voice and video scam verification (dunno — both at home and at work): the same channel-verification habit that stops a deepfaked "urgent wire transfer" call also stops a deepfaked family emergency call. Neither is in place yet.
- Financial account alerts (dunno, 5 of 5): transaction alerts on personal bank and payment accounts weren't confirmed. The same instinct — know immediately when money moves — applies to practice accounts.
- Connected devices at home (no, 2 of 5; dunno, several more): a car and a few smart-home products share data with third parties by default, unreviewed. Not urgent, but worth a look once the items above are handled.
Questions to ask your vendors (6 areas)
| Area | Ask this | Who to ask |
|---|---|---|
| EHR and clinical systems | "Who backs up our patient data, how often, and when did you last test a restore for us? What is your outage plan?" | EHR vendor |
| Microsoft 365 and email | "Can you show me who has admin access, and which mailboxes forward outside the practice? Who sees a suspicious sign-in?" | Managed IT provider |
| Office network and remote access | "What is exposed to the internet from our office, and who is watching it at 2 a.m. on a Saturday?" | Managed IT provider |
| Backups | "Show me the last file you restored from our backup, and how long a full recovery would take." | IT provider and EHR vendor |
| Home networks used for remote work | "What is the rule for the router firmware, guest network, and VPN when someone charts from home?" | Practice leadership, with IT provider |
| AI tools and scam verification | "What can staff put into an AI tool, and what is our rule for verifying an unexpected urgent call before acting on it?" | Dr. Ruiz and Marcus |