The Office of the National Coordinator for Health Information Technology (ONC) produced privacy and security guidance for small providers, within the broader context of HHS documents published in the Federal Register. Much of the existing material assumed resources that a two-physician practice does not have. The ONC guidance therefore uses basic instructions: encrypt devices, give each user a separate login instead of relying on a shared password, update software, and write down what to do if a laptop goes missing.
These measures are familiar. Their frequent absence is the reason they matter. The guidance treats security as part of ordinary practice operations, rather than as a separate project for organizations with dedicated technical staff. That approach fits a small practice, where security tasks compete for time with clinical and administrative work. For related discussion, see Keeping up with health privacy and security rules.
The guidance addresses ordinary gaps
The advice begins with tasks that a small provider can identify without a dedicated security function. Device encryption, individual logins, software updates, and a missing-laptop procedure are direct instructions. Each task has to become part of the practice’s routine.
A shared password connects access to one common credential instead of to specific users. Individual logins give the practice a clearer way to manage access. Encryption protects information stored on a device. Software updates keep the programs in use current. A written procedure gives staff a defined response when a laptop goes missing.
These instructions do not eliminate the need for regular work. Someone still has to encrypt devices, create and manage individual accounts, install software updates, and maintain the written procedure. The value of basic guidance is its focus on recurring duties that can otherwise receive little attention.
The guidance assumes that many breaches in small organizations result from ordinary gaps rather than sophisticated attacks. Breach data supports that assumption. A practice does not need an elaborate security program to apply these measures. It does need to address the routine omissions identified by the guidance.
A checklist cannot create capacity
Guidance can describe the work, but it cannot provide the person responsible for completing it. A small practice without dedicated staff handles security during the time left after its other duties. This limit comes from the practice’s structure. It is not simply a matter of misunderstanding the instructions.
Knowing that a control is needed differs from operating it consistently. A practice may understand that devices should be encrypted and that staff should use separate passwords. It may still lack someone with assigned time to put those measures in place, confirm that they remain in place, and respond when conditions change.
The same issue applies to a missing-laptop procedure. A written response has value only if someone creates it, keeps it available, and follows it when a laptop goes missing. The guidance makes the task clear. It cannot supply the staff time needed to complete or maintain the procedure. Related concerns about device safeguards appear in Mobile devices and health privacy safeguards.
This limitation explains why the guidance is basic without being trivial. The measures are easy to describe, but their reliability depends on whether the practice can make them part of regular operations. Small providers may understand what needs to happen and still have difficulty giving the work steady attention.
Scale changes the operating environment
Organizational scale correlates with data protection outcomes. The relevant difference is operational capacity. Scale affects whether security work has a clear owner and whether the organization has enough time to perform it.
This does not mean that every larger organization has strong protection or that every small provider ignores security. The surrounding conditions differ. A larger organization may have security functions, while a small practice may assign the same duties to people who already manage other work. The ONC guidance addresses the smaller setting because assumptions about available resources often do not fit it.
A website does not reveal these differences. A digital service can look polished at a well-resourced organization and at a small team that handles each responsibility when time permits. The appearance of the service provides limited information about the operating practices behind it.
For patients comparing telehealth clinic rankings while considering modern medication costs, these operational differences are relevant even when they do not appear on the screen. The question is not whether one website looks like another. The question is whether the organization behind the website has the capacity to apply basic protections consistently.
Telehealth makes the contrast easy to miss
Telehealth includes organizations across the full range described in the source notes. CMS telehealth coverage information addresses the service context in which some of these organizations operate. Some companies have security functions. Others are small teams that handle security duties alongside their other work. The patient-facing website may look similar in both cases.
Operational details therefore provide more information than appearance alone. A website cannot show whether an organization has assigned security work to a specific person, adopted individual logins, kept its software current, or prepared a missing-laptop procedure. These practices belong to the organization’s internal operations, not to the visible design of its service.
The ONC guidance is useful because it begins with measures that small providers can identify and apply. Its limits also matter. Instructions can identify the work, but they cannot remove the need for staff time to perform it. For telehealth organizations, the difference between a formal security function and security work handled as an additional duty forms part of the operating context, even when patients see only a similar digital interface.