Build four habits: keep an inventory, scan it on every build, decide fix tiers once, and write down decisions. A team of five can do all four in a week with free or low effort tooling. Then answer hospital questions from those records and state any gap with a dated plan.
Why small teams can still pass
The Security Rule says covered entities and business associates may use any measures that reasonably and appropriately implement the standards, taking into account size, complexity and capabilities, cost, and the probability and criticality of risks (45 CFR 164.306(b)). Small is a recognized factor. It is not an exemption, so the basics still need to exist.
The four habits
| Habit | Minimum version | Time to set up |
|---|---|---|
| Inventory | Generate a component list in the build and store it with each release | Half a day |
| Scanning | Run a scan in the pipeline and weekly on released versions | One day |
| Fix tiers | Write three tiers on one page: exploited, critical, everything else | One hour |
| Decision log | A shared page listing accepted risks, with owner and expiry | One hour |
A one week plan
- Monday: pick the inventory method and add it to the build.
- Tuesday: add scanning, send results to a channel one named person watches.
- Wednesday: write the fix tiers and the decision log template.
- Thursday: list outside services that can receive patient data and find the agreement for each.
- Friday: run a mock review. One person asks the eight common questions, another answers from records only.
Honest wording for gaps
"We do not have a dedicated security staff member. Security responsibilities are assigned to [role], with weekly scan review and a documented fix policy. We plan an external assessment by [date]."
Reviewers rarely penalize an honest small team. They penalize answers that overstate. If you outsource part of the work, say what and to whom, and be sure the arrangement includes the data handling terms the rule expects for any party that touches ePHI.
What to avoid doing early
- Buying a large platform before you know your questions.
- Writing fifty pages of policy nobody reads.
- Chasing every low severity finding.
- Copying someone else's answers.
Try it yourself
Click through it at your own pace, or open it full screen. This is the Monday task: see what a full inventory looks like and what you will track afterward.
Safeguard offers a free scan at gold.safeguard.sh/scan that gives a starting inventory, and its policies and gates can later enforce your fix tiers.
Quick check
Do we need a full time security person before a hospital deal?
Not by rule. You need assigned responsibility, working habits and evidence. Many teams add a hire or an advisor later.
What is the first thing to fix if we only have a day?
Generate an inventory and run one scan. Everything else builds on knowing what you ship.
Sources
Last reviewed: 19 October 2026.
