Office networks: guest wifi, the router password, and the audit

Does office Wi-Fi matter for HIPAA?

Yes — the moment electronic patient information moves across it. The Security Rule does not name Wi-Fi by word, but it requires administrative, physical, and technical safeguards for electronic protected health information, scaled to the size and resources of the practice, and anchored in a risk analysis 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires administrative, physical, and technical safeguards for ePHI, scaled to the practice and anchored in a risk analysis.. Your network is part of that environment whether you have one exam room or ten, so it belongs in the analysis.

ePHI is any protected health information your systems create, store, or transmit — the scheduling app, the EHR sync, the email that quotes a chart note. Wi-Fi is the road all of it travels, which is why the setup is not a purely technical afterthought. Whether you sublease a room or run a home office, the office options for a solo determine how much of the network you actually control, but the duty to secure the part you use does not change.

Start with the risk analysis, not the router

Before buying anything, run the risk analysis the Security Rule requires — it is the step that decides which network controls you actually need 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative rule text for the risk-analysis obligation and the six-year documentation-retention requirement.. A solo practice does not need a consultant for this. The free Security Risk Assessment Tool from ONC and OCR is sized for small offices and walks you through the network questions in plain language 3Ref 3Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.The free ONC/OCR Security Risk Assessment Tool a small practice can use to conduct the required risk analysis.. The document it produces is also the record an investigator asks for first.

The analysis is where you inventory what is actually on the network. Networked devices count too: a smart speaker, a printer with onboard storage, or cameras on the practice Wi-Fi are all endpoints the analysis should list and rate.

Split the network: a guest SSID and a clinical one

Run two separate networks from the same router: a clinical network for your EHR, printer, and work devices, and a guest network for patients and visitors. Almost every business-grade router offers this in a few taps. Segmentation means a visitor's compromised phone never shares a subnet with the machine holding your charts — a reasonable, low-cost safeguard, exactly the kind the Security Rule expects a small practice to adopt 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires administrative, physical, and technical safeguards for ePHI, scaled to the practice and anchored in a risk analysis..

• Name the guest network so it is obviously the visitor one, and rename or hide the clinical SSID.
• Turn on client isolation on the guest side so guest devices cannot see each other.
• Never print, scan, or sync ePHI over the guest network.

The wireless split is the network half of a larger habit: a screen angled toward the waiting room or a shared printer tray creates incidental disclosures that no amount of encryption fixes.

The router itself: five controls

The router is where most small-practice network exposure actually lives, and five controls close most of it: the admin password, the encryption standard, the Wi-Fi passphrase, the firmware, and remote management. None requires a vendor. Work down this list the day you set the network up, then re-check it whenever you replace hardware or once a year, whichever comes first.

When the network is the breach: ransomware

If ransomware encrypts ePHI reachable from your Wi-Fi, OCR treats that as a presumed reportable breach unless a documented risk assessment shows a low probability that the data was compromised 4Ref 4HHS Office for Civil Rights (2016).FACT SHEET: Ransomware and HIPAA.That a ransomware encryption of ePHI is a presumed reportable breach absent a documented low-probability risk assessment.. That single rule is why the unglamorous controls matter: the risk assessment you can point to afterward, and the backups that let you refuse a ransom, both begin with a secured, segmented network and a current firmware baseline.

This is where the contingency plan earns its place — the Security Rule's required backup and disaster-recovery piece is what turns a network compromise into a bad week instead of a practice-ending event. Keep offline or immutable backups, and keep the audit logs that show what an intruder could and could not reach.

Telehealth and your office Wi-Fi

If you see patients over video, the network carrying that session is in scope too. Since the pandemic enforcement discretion ended, telehealth must run on HIPAA-compliant arrangements, which OCR spells out for both video and audio-only visits 5Ref 5HHS Office for Civil Rights (2026).HIPAA and Telehealth.That telehealth must run on HIPAA-compliant arrangements after the end of the enforcement discretion, including audio-only guidance.. On your side that means the same secured, encrypted network — not a coffee-shop hotspot — plus a business associate agreement with the platform.

Configure the telehealth platforms deliberately rather than trusting their defaults: waiting rooms on, session encryption on, recording off unless you have a reason and a consent. The vendor secures its servers; the last mile — your Wi-Fi and your settings — is yours.

What an investigator actually asks for

OCR does not inspect your router; it asks for documents. When a complaint or a breach brings an investigation, the office wants your risk analysis, your policies, and evidence that you acted on what the analysis found 6Ref 6HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces the rules through investigations, resolution agreements, and civil money penalties, including against very small practices.. Small practices are not exempt — OCR has resolved cases against solo and very small offices 6Ref 6HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces the rules through investigations, resolution agreements, and civil money penalties, including against very small practices.. Keep the Security Rule documentation for the required six years, and store it where you can produce it within a day 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative rule text for the risk-analysis obligation and the six-year documentation-retention requirement..

The practical takeaway: the Wi-Fi controls are cheap and the documentation is free, but an investigator measures both by what you can show, not by what you did. Write down the analysis, write down the decisions, and date them. Then revisit the whole setup on a schedule — a new device, a new app, or a moved office each changes the picture, and the analysis is only as trustworthy as its last date.