HIPAA ePHI Hosting,BAA Library & Breach Playbook

Days 0 to 14. Discovery and Risk Analysis baseline. Asset inventory across endpoints, servers, network gear, biomedical devices, EHR and PM platforms, cloud tenants, and SaaS. Initial Risk Analysis pass identifying threat-vulnerability pairs and ratings. BAA inventory pulled from vendor list, contracts repository, and accounts payable. Output: baseline Risk Analysis report draft and BAA library v1, with an immediate gap list ranked by clinical impact.

Days 15 to 30. Identity and endpoint hardening. Tier 0 and Tier 1 stand up. Phishing-resistant MFA rolled out to clinical and administrative staff in waves so the front desk and providers are not all blocked at once. EDR agents deployed to endpoints, full-disk encryption verified, DLP rules tuned for healthcare workflows (block ePHI to USB and unmanaged sync, allow approved patient-record exports through the EHR). Output: identity coverage report and EDR coverage attestation.

Days 31 to 50. Network segmentation and SOC stand-up. Tier 2 segmentation: clinical, administrative, biomedical, and guest VLANs separated. Medical-device VLAN deny-by-default with allow-list for known manufacturer endpoints. Tier 6 SOC ingest goes live: identity, EDR, network, EHR access logs, and email gateway feeding the SIEM with healthcare-tuned use cases enabled. Output: network diagram, segmentation policy, SOC ingest attestation, and first weekly threat-hunt report.

Days 51 to 70. Backup, audit log, and contingency plan. Tier 4 backup to immutable storage with 3-2-1-1-0 pattern. First full restore drill to a clean isolated environment. Tier 5 audit-log retention policy moves to WORM with 6-year window. Contingency plan documented in operational runbook form, tabletop exercise scheduled. Output: backup configuration documentation, first restore-test record, and audit-log retention attestation.

Days 71 to 90. Breach playbook, training, and evidence package. 60-day breach playbook documented with NC-aware notification paths (federal HIPAA, NC AG, FTC where applicable, payer notice clauses, media notice criteria). Workforce security awareness training rolled out, simulated phishing campaign baselined for billing and front-desk targets. Final Risk Analysis report locked, evidence package compiled and indexed for OCR or carrier review on demand. Output: incident response runbook, training completion report, phishing baseline, and a turnkey audit evidence stack.

Day 90 forward. Operate and improve. Quarterly access reviews. Quarterly restore drills. Annual Risk Analysis refresh. Continuous SIEM tuning as threat actor techniques evolve. BAA library hygiene every quarter. Tabletop exercises annually with after-action reports. Cyber insurance renewal questionnaire becomes a 30-minute exercise instead of a 30-day project.

Solo Physician or Dental Practice. Lean configuration. Identity and endpoint heavy, SOC operates on a smaller telemetry footprint, BAA library typically 10 to 30 vendors. EHR integration limited to SSO and audit-log forwarding where the platform supports it. Risk Analysis scoped to a single location and a small workforce.

Multi-Location Physician Group or DSO. Network segmentation across sites with consistent VLAN policy. Identity unified across locations under a single tenant. SOC ingest scaled to total endpoint count. BAA library typically 30 to 80 vendors. Risk Analysis covers all locations and a typical workforce of 50 to 300.

Ambulatory Surgery Center. Biomedical VLAN gets serious attention because anesthesia and OR systems live there. Backup RTO tightened on scheduling and EHR systems because of the immediate revenue impact of OR slate cancellation. Cyber insurance carrier questionnaires often more demanding for surgical environments.

Behavioral Health and Telehealth. Identity and endpoint hardening lean heavily on home-clinician scenarios. DLP rules tuned for the higher sensitivity of behavioral health records. 42 CFR Part 2 substance-use record handling layered on top of standard HIPAA where applicable. Telehealth video vendors get extra BAA scrutiny.

CRO or Biotech. Tier 5 audit logging extended to FDA 21 CFR Part 11 expectations for regulated systems. IP protection adds insider-risk monitoring patterns to the SOC. Sponsor due-diligence packages prepared so security questionnaires from pharma sponsors are answered from the evidence stack rather than rebuilt each time.

Critical Access or Rural Hospital. Stack scoped to grant funding and 340B-funded program timelines where applicable. SOC use cases extended to inpatient telemetry and ED workflow indicators. Tabletop exercises include downtime procedure drills with clinical leadership present.