Notes from the field.

Most small practices touched Change Healthcare without realizing it — through their clearinghouse, their EHR's billing module, or a pharmacy benefit lookup buried in e-prescribing. When the platform went dark in early 2024, claims pipelines stalled for weeks. Cash flow, not PHI exposure, was the first crisis.

The lesson for small practices is that vendor concentration is a quiet risk. The fix is not paranoia — it is documentation. Know which BA touches which workflow, and what your BAA says about downtime credits and breach notification timing.

If your clearinghouse is down again tomorrow: file the BI claim within 72 hours, keep a written downtime log with timestamps, and switch to manual eligibility for high-cost services. Your cyber policy almost certainly covers vendor outage if you document it.

OCR is not a random auditor. Investigations almost always begin from one of three signals: a breach the practice self-reported (the Wall of Shame), a complaint from a patient or former employee, or a referral from CMS after a MIPS Promoting Interoperability audit flagged a missing Security Risk Analysis.

Self-reports you cannot avoid — the law requires them. But complaint-driven investigations correlate strongly with how staff are off-boarded. A disgruntled biller who knows there is no documented sanction policy and no training records is a high-percentage complainant.

MIPS-referred investigations are the most preventable. The Security Risk Analysis is one document. Filing it annually closes the most common door OCR uses to find small practices.

Pull the OCR resolution agreements for any small practice fine over the last decade and one finding shows up over and over: no current Security Risk Analysis on file. The settlement letter often calls this out by name as the proximate failure.

A defensible SRA for a small practice is not a 100-page binder. It is an inventory of the systems that touch PHI, a written analysis of the threats to each, a documented mitigation for each material risk, and a date. The NIST 800-66r2 outline and the HHS SRA Tool are both free.

The single most expensive mistake is doing one once, three years ago. The Security Rule requires it to be ongoing — read that as annual at minimum, plus after any material change (new EHR, new location, new MSP, a real incident).