Guide

Device setup: encryption on, auto-lock short, backups tested

Summary

Set up practice devices in this order: turn on full-disk encryption (FileVault or BitLocker) before any patient data touches the device, set auto-lock to a short timeout with a real password or biometric, configure automated backups and actually test a restore, and confirm every vendor with device access — email, fax, EHR, video — has signed a business associate agreement. A documented risk analysis ties the choices together and is what OCR asks for first.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What device setup means before the first patient

Device setup for a solo practice means four things done in order, before any patient data touches the machine: full-disk encryption turned on, auto-lock set short, backups configured and actually tested, and every vendor that can reach the device under a signed contract. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI, scaled to the size of the practice and anchored in a documented risk analysis — not a fixed list of brand-name products 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires administrative, physical, and technical safeguards for ePHI, scalable to practice size and anchored in a risk analysis rather than a fixed product list..

That scaling matters for a solo practice: a one-person operation doesn't need an IT department's toolset, but it does need to make and record the same four decisions a larger practice makes, in a form that survives an audit request. The rest of this page walks each one in the order a new device should actually be configured.

Full-disk encryption, turned on first

Full-disk encryption scrambles everything on a device's storage so the drive is unreadable without the login credentials — the single highest-value control for a laptop or desktop that will ever leave the office, and it should be the first thing turned on on a new machine, before an EHR client or any patient file is installed. Both major operating systems ship it free: FileVault on macOS, BitLocker on Windows Pro and Enterprise editions, both toggled on in a few minutes from system settings rather than purchased separately.

The same logic extends past the desktop. Your phone is a HIPAA device the moment it holds practice email, a scheduling app, or a secure-messaging client, and it needs the same encryption-at-rest and passcode discipline as the office computer, not a lighter version because it's "just a phone." Mobile OS encryption is on by default on current iOS and Android as long as a passcode is set — skipping the passcode effectively turns the encryption off.

Auto-lock: short enough that a missed step is not a breach

Auto-lock closes the gap between a clinician stepping away from a device and someone else being able to read what's open on the screen — set it to the shortest interval that doesn't interrupt a session (commonly a few minutes of inactivity), require a real password or biometric to wake it, and disable any "remember me" setting on the EHR or email login screen. A device that never locks makes the encryption underneath it nearly irrelevant, since anyone who picks it up while it's awake is already past that protection.

This is also the control that determines how a lost or stolen device actually plays out. An unlocked, unencrypted laptop left in a car is a straightforward reportable breach; a properly locked, encrypted one is a very different conversation with a much lower probability of compromise — which is the entire premise behind the lost laptop scenario every practice eventually has to plan for.

Backups tested, not just scheduled

A backup that has never been restored is a hope, not a backup — schedule automated backups to run daily or continuously, keep at least one copy that ransomware on the primary device can't also encrypt (a cloud backup with version history, or offline media rotated out of the office), and actually run a test restore on a schedule, not only after something has already gone wrong. This is a practice norm rather than a specific numeric requirement: what matters is that the restore has been proven to work before the day it's needed.

A solo practice with no IT staff is the setup most likely to discover a backup gap at the worst possible moment — during an actual failure — because nobody checked it earlier. Building a quarterly restore test into a calendar, the same way license renewals get calendared, closes that gap cheaply.

Every vendor with device access needs a signed BAA

Any vendor that creates, receives, maintains, or transmits PHI on the practice's behalf is a business associate and needs a signed business associate agreement before its software touches a practice device — that covers the EHR, a cloud backup provider, an email host if practice email carries PHI, and an e-fax service, not just the obvious clinical software 2Ref 2HHS Office for Civil Rights (2026).Business Associates.That any vendor creating, receiving, maintaining, or transmitting PHI on the practice's behalf — EHR, backup, email, e-fax — is a business associate requiring a signed BAA.. A consumer email or file-sync account with no BAA on file is a common gap: convenient, familiar, and outside the contract the Security Rule requires for anything handling PHI.

Faxing in 2026 is a useful test case for this rule, since it still runs through the same practice devices and the same BAA requirement as everything else on this list — an e-fax service is a business associate like any other vendor, and the fax number itself doesn't change that. Building a short vendor list with a BAA column next to each one, checked at setup rather than discovered later, is the cheapest version of this control.

Telehealth runs through the same devices, and the same checklist

A telehealth session runs on the same practice device as everything else, so the platform it uses needs a signed BAA and a HIPAA-compliant configuration — the COVID-era enforcement discretion that let clinicians use ordinary consumer video apps has ended, and OCR now expects a platform selected and configured for compliance, including guidance covering audio-only visits 3Ref 3HHS Office for Civil Rights (2026).HIPAA and Telehealth.That telehealth must run on HIPAA-compliant, BAA-covered arrangements now that COVID-era enforcement discretion has ended, including guidance on audio-only visits.. Setting up a device for telehealth is not a separate project from setting it up for everything else; it's the same encryption, the same auto-lock, and one more vendor added to the BAA list.

A device used for telehealth from outside the office — a home office, a second location — carries the same requirements as one that never leaves the building; location doesn't loosen the standard, only the physical-safeguard details around it.

The risk analysis is what ties the checklist together

A documented risk analysis is the record that connects every choice above to an actual assessment of the practice's specific devices and vendors, and it's the first document OCR asks for in almost any investigation — not a one-time form but a living record updated when a device, vendor, or workflow changes. ONC and OCR publish a free Security Risk Assessment tool built for small practices specifically so a solo clinician can complete this without hiring a consultant 4Ref 4Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices to conduct the risk analysis the Security Rule requires..

HHS's 405(d) program goes a step further for a practice that wants a structured baseline rather than a blank risk-analysis template: its Health Industry Cybersecurity Practices guidance includes a volume sized specifically for small organizations, translating the Security Rule's safeguards into a concrete small-practice checklist 5Ref 5HHS 405(d) Program (2026).HHS 405(d) — Aligning Health Care Industry Security Approaches.That HHS's 405(d) program publishes Health Industry Cybersecurity Practices with a small-practice volume translating the Security Rule into a concrete baseline.. Running the SRA tool once at setup and re-running it after any material change is the difference between a checklist followed once and a program that holds up under review.

If it still goes wrong: what ransomware means for a solo device

A ransomware attack that encrypts ePHI on a practice device is presumed to be a reportable breach unless a documented risk assessment shows a low probability that the data was actually compromised — which means the response isn't just restoring from backup, it's also producing the assessment that determines whether notification is required 6Ref 6HHS Office for Civil Rights (2016).FACT SHEET: Ransomware and HIPAA.That a ransomware encryption of ePHI is presumed a reportable breach unless a documented risk assessment shows low probability of compromise.. This is the practical payoff of everything earlier on this page: a device that was already encrypted, backed up, and risk-assessed gives a much stronger case for a low-probability finding than one that wasn't.

The response sequence that matters in the moment is isolate the affected device from the network, restore from the tested backup rather than paying the ransom, and document the incident and the resulting risk assessment before deciding on notification — in that order, with the documentation step never skipped even when the restore goes smoothly.

Common questions

A password alone doesn't protect data if the drive is removed from the device or the operating system is bypassed; full-disk encryption protects the data itself, not just the login screen. Both FileVault and BitLocker are free, built into the operating system, and take only minutes to enable, so there's no cost tradeoff that would justify skipping it.

There's no single numeric requirement in the Security Rule; the standard is a safeguard reasonable and appropriate to the practice's risk analysis. A short interval — commonly a few minutes — paired with a real password or biometric is the common practice-norm answer, since a device that stays unlocked for long stretches undermines the encryption sitting beneath it.

It can, but the moment it does, that phone becomes a HIPAA device and needs the same encryption, passcode, and auto-lock discipline as any office computer — plus a plan for remotely wiping it if it's lost. Many solo clinicians choose to keep practice communications inside apps with their own encryption and remote-wipe controls rather than relying on general phone settings alone.

Yes, if the backup includes PHI — a cloud backup service that stores encrypted patient data on the practice's behalf is a business associate under HIPAA regardless of how the marketing describes the product. Confirming a signed BAA is on file belongs on the same vendor checklist as the EHR and email provider, checked before the service goes live, not after.

There's no fixed HIPAA schedule, but a quarterly test restore is a common practice norm for a solo operation with no IT staff to catch a failure otherwise. The point is proving the backup works before the day an actual failure makes that the only way back into the practice's records.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Summary of the HIPAA Security Rule. U.S. Department of Health and Human Services. linkThat the Security Rule requires administrative, physical, and technical safeguards for ePHI, scalable to practice size and anchored in a risk analysis rather than a fixed product list.
2.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat any vendor creating, receiving, maintaining, or transmitting PHI on the practice's behalf — EHR, backup, email, e-fax — is a business associate requiring a signed BAA.
3.HHS Office for Civil Rights (2026). HIPAA and Telehealth. U.S. Department of Health and Human Services. linkThat telehealth must run on HIPAA-compliant, BAA-covered arrangements now that COVID-era enforcement discretion has ended, including guidance on audio-only visits.
4.Office of the National Coordinator / ASTP (2026). Security Risk Assessment Tool. HealthIT.gov. link ✓That ONC/OCR publish a free Security Risk Assessment tool sized for small practices to conduct the risk analysis the Security Rule requires.
5.HHS 405(d) Program (2026). HHS 405(d) — Aligning Health Care Industry Security Approaches. U.S. Department of Health and Human Services. linkThat HHS's 405(d) program publishes Health Industry Cybersecurity Practices with a small-practice volume translating the Security Rule into a concrete baseline.
6.HHS Office for Civil Rights (2016). FACT SHEET: Ransomware and HIPAA. U.S. Department of Health and Human Services. link ✓That a ransomware encryption of ePHI is presumed a reportable breach unless a documented risk assessment shows low probability of compromise.

https://www.gale.care/for-providers/spc-device-setup-encryption · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers