Affiliate disclosure: a few links in this post go to Amazon. If you buy through them, HenkTek may earn a small commission at no extra cost to you.
If you run a dental or medical office in Fort Myers, you’ve probably gotten at least one email this year saying the “new HIPAA rules” are here and you need to buy something right now. Some of that is true and a lot of it isn’t. So here’s a plain HIPAA IT checklist for small practices in Fort Myers, Cape Coral and the rest of Southwest Florida, split into what the rules require today and what’s still only proposed.
One thing up front. We’re an IT company, not a law firm, so treat this as the tech side of HIPAA. Your compliance officer or attorney still owns the policies.
Where the HIPAA Security Rule stands in October 2026
The big Security Rule overhaul everyone keeps mentioning was proposed by HHS and published in the Federal Register on January 6, 2025. It still isn’t final. The original target was May 2026, that date came and went, and the current federal regulatory agenda pencils in a final rule around July 2027 (HIPAA Journal has the timeline). Even then, the proposal itself allows a compliance period after it takes effect, so nobody is getting fined under the new rule this year.
But the rule that’s already on the books asks for more than most small offices are doing. A written risk analysis, reasonable safeguards on anything holding patient data, and a plan for getting systems back after an outage are all required now. And the proposed rule (HHS fact sheet here) is a pretty clear preview of what a good setup looks like: MFA, encryption, an asset inventory, regular vulnerability scans, and being able to restore systems within 72 hours. Cyber insurance carriers are already asking for most of that whether HHS finalizes anything or not.
The HIPAA IT checklist for Fort Myers practices
This is the order we’d work through it in. The first two items do more than everything else on the list combined.
- Get a real risk analysis on paper. It’s required under the current rule, and it’s the first thing anyone asks for after a breach. It doesn’t have to be fancy, but it has to be written down, specific to your office, and updated when something changes (a new server, a new practice management system, a move). Our risk assessment checklist is a decent starting point.
- Turn on multi-factor authentication for email, the practice management or EHR system, and any remote access. For the front desk and anyone who logs into the insurance portals all day, a hardware key is faster than waiting on a text code.
- Encrypt every laptop and every backup drive that leaves the building. A stolen laptop with encryption turned on is usually an annoyance. Without it, it can turn into a breach report. BitLocker is built into Windows Pro, and we wrote up how to turn it on in our laptop encryption post.
- Get off unsupported Windows. Windows 10 stopped getting regular security updates on October 14, 2025, and Windows Server 2016 hits end of support on January 12, 2027. Check the imaging and X-ray PCs too, since imaging software sometimes lags behind new Windows versions and those machines get forgotten.
- Back up patient data and actually test a restore. One copy on site for fast recovery, one copy off site in case the building floods (this is Southwest Florida, plan for it). Then pick a random Tuesday and restore a file. The proposed rule’s 72 hour restore window is a good gut check for whether your setup would hold up today.
That last one gets skipped a lot. A backup that runs every night and has never been restored isn’t a plan, it’s a guess. More on how we set these up on our backup and recovery page.
- Have a signed business associate agreement with every vendor that touches patient data. That includes your IT company, cloud backup, email provider, practice management software and any billing service. If a vendor won’t sign one, that tells you something.
- Give everyone their own login. Shared front desk passwords make your audit logs useless. Set screens to lock after a few minutes, and turn off a departing employee’s access the day they leave, not the following week.
- Keep a list of every device and where patient data lives. Computers, servers, the NAS in the closet, the cloud apps. You can’t protect what you don’t know you have, and the proposed rule would make this inventory a yearly requirement.
- Don’t forget paper. Old intake forms, EOBs and printed schedules go in a cross cut or micro cut shredder, not the recycling bin out back.
- Update your Notice of Privacy Practices if you haven’t. The rule aligning substance use disorder records (42 CFR Part 2) with HIPAA set a February 16, 2026 deadline for updated notices, and it applies to covered practices even if you don’t treat SUD patients. That one’s a paperwork fix, but it’s a real deadline that already passed.
If you only do two things this month
Do the risk analysis and turn on MFA. Seriously, those two cover more ground than the rest of the HIPAA IT checklist put together, and neither costs much beyond a few hours. Encryption and a tested backup come next. The shredder can wait until Friday.
For the on site copy of your backups, a small two bay NAS works well for a two or three chair office. It sits in the closet, takes nightly copies of the server and workstations, and lets you restore a file in minutes instead of waiting on a cloud download. Pair it with an off site copy and you’ve covered both halves of item five.
Common questions about HIPAA IT for small practices
Is the new HIPAA Security Rule final yet?
No. HHS published the proposed rule in the Federal Register on January 6, 2025, and as of October 2026 it still isn’t final. The federal regulatory agenda points to a final rule around July 2027, and the proposal allows a compliance period after that.
What does HIPAA require from a small practice’s IT right now?
Under the rule already in effect: a written risk analysis, reasonable safeguards on anything that holds patient data, and a plan for getting systems back after an outage.
Does our IT company need to sign a business associate agreement?
Yes. Any vendor that touches patient data should sign one, and that includes your IT company, cloud backup and any billing service.
Can we keep running Windows 10 on the front desk or imaging PCs?
Windows 10 stopped getting regular security updates on October 14, 2025, so those machines should be upgraded or replaced. Check imaging and X-ray PCs too, since imaging software sometimes lags behind new Windows versions.
Running Dentrix, Eaglesoft, Open Dental or Dexis? Our dental practice software support page covers the server, backups and imaging side of those systems.
Need help with the IT side of HIPAA in Fort Myers?
HenkTek works with dental and medical offices across Fort Myers, Cape Coral, Bonita Springs and Naples, and most of this list is the work we do every week: MFA, encryption, patching, backups and keeping track of what’s on the network. See our dental IT support and medical IT support pages for how that works, or call (239) 234-2334. If you’d rather start with a quick conversation about where your office stands, reach out here.