A stolen clinic computer used to mean a stolen patient list. Then it did not.
For a long time, the fastest way for a clinic to lose its patient records was not a hacker. It was a thief with a van. A computer walks out of a broken-into office over a weekend, and every history, every X-ray, every phone number on it walks out too.
This was not a rare edge case. For years it was the single biggest way medical records leaked. Looking at the large healthcare breaches in the United States, where this is tracked closely, lost and stolen devices were behind roughly half of them in the mid-2010s, and going back a little further, closer to eighty percent. Not clever attacks. Just hardware going missing with readable files on it.
Then that number fell off a cliff. By the early 2020s device theft accounted for under a tenth of breaches, and in the first half of this year essentially none were reported at all. The locks did not get better. Offices did not stop getting broken into. One thing changed: the data on the disks got encrypted.
That is the whole trick, and it is worth understanding because it is easy to assume you already have it. Encryption at rest means the records on the drive are stored scrambled, and without the key they are noise. A thief who takes an encrypted computer gets a computer. The files are useless to them. The event stops being a data breach and becomes an insurance claim for a piece of hardware.
Here is the part that catches clinics out. A Windows login is not encryption. It feels like protection, because the machine asks for a password before it shows you the desktop. But that password guards the session, not the files. Pull the drive out, plug it into another machine, and the records are sitting there in plain text, login screen or not. The same is true of most software that simply stores its database as an ordinary file on the disk. If that file is not encrypted, the login on the app is a curtain, not a wall.
So the honest question for any clinic is not "Do we have a password?" It is "If someone took this computer right now and pulled the hard drive, could they read our patients' records?" For a lot of practices the real answer is yes, and nobody has ever said it out loud.
This is one reason HM Praxis stores the clinical database encrypted at rest, on the clinic's own machine. The records live locally, which already means they are not sitting on someone else's server waiting to be breached, and they are stored encrypted, so a stolen or lost computer is a hardware problem, not a patient problem. You replace the machine, you restore from your backup, and the person who took it has a paperweight full of noise.
None of this requires a security team or a compliance consultant. It requires the data to be encrypted where it sits, and it requires you to actually check that it is, instead of assuming the login screen has been doing that job all along.
Learn more