Protecting patient and customer data: a simple checklist for small healthcare businesses

Labs, pharmacies and clinics hold sensitive information about real people. You do not need a security team to protect it. A few steady habits do most of the work.

1. Give each person their own login

Shared logins mean nobody can say who changed a bill or opened a report. Create one account per staff member, and switch off the account the day someone leaves.

2. Give people only what they need

A receptionist does not need to edit results and a cashier does not need supplier prices. Use roles to limit each account to its job. Limiting access also limits the damage of a stolen password.

3. Use strong, private passwords

Use long passwords that are not reused on other sites, and never write them on a note stuck to the monitor. A password manager makes this easy.

4. Back up, and test the restore

A backup you have never restored is only a hope. Choose a system that backs up automatically and ask how a restore works. Keep at least one copy away from the shop computer.

5. Look after the devices

• Keep the operating system and the app updated.
• Lock the screen when the counter is unattended.
• Do not let staff install random software on the billing computer.

Keep an audit trail

A log of who did what and when is the quickest way to find out what happened after a mistake, and it discourages misuse in the first place.

Know what you hold

Collect only what you need from patients and customers, keep it only as long as you need it, and be able to export it if they or the law ask for it.

These are general good practices and not legal advice. Check the rules that apply to your business and your country.