Veterinary Clinics: Not Covered by HIPAA, Still Worth Protecting

A common question from veterinary practice owners is whether HIPAA applies to them. In almost every case, the answer is no. HIPAA applies to covered entities, which are health plans, health care clearinghouses, and health care providers who conduct certain electronic transactions, along with their business associates. Animal patients are not individuals under HIPAA, and a veterinary clinic is not the kind of provider the rule was written for.

That answer sometimes lands as relief. It should not. A veterinary clinic holds a lot of information that criminals want, runs on practice management software with the same weaknesses we see in medical and dental offices, and takes card payments all day. The absence of HIPAA does not mean the absence of risk or obligation.

What a clinic actually holds

Walk through a typical clinic and you will find:

• Client names, home addresses, phone numbers, and email addresses
• Payment card data at the front desk and in stored payment profiles
• Financing and payment plan applications, sometimes with income and identity details
• Driver's license copies for controlled substance pickups or payment plans
• Prescription and controlled substance records
• Staff payroll and HR files
• Login credentials to labs, pharmacies, insurance carriers, and distributors

Much of that is personal information that state law protects, and the card data falls under the payment card industry's rules.

The rules that do apply

PCI DSS. If the clinic accepts payment cards, its processor agreement almost always requires compliance with the Payment Card Industry Data Security Standard. The scope depends on how cards are taken. A clinic that uses a validated point to point encryption terminal and never stores card numbers has a much smaller scope than one that keys numbers into the practice software. Ask your processor which self assessment questionnaire applies, and make sure someone in the practice understands what was attested.

State breach notification law. Ohio, like every state, requires businesses to notify affected residents (Ohio Revised Code 1349.19) when certain personal information is breached. A clinic that loses client names along with card numbers or driver's license numbers is in that territory.

Controlled substance rules. DEA recordkeeping for controlled substances applies to veterinary practitioners. That is mostly an operational requirement, but those records live on the same systems, and losing them to ransomware creates a separate problem.

Why we use CIS Controls for clinics

Without HIPAA giving a structure, clinics need some other yardstick. We use the CIS Critical Security Controls, specifically Implementation Group 1. IG1 is the set of safeguards CIS describes as the minimum for every organization, written for businesses with limited IT staff. It fits a single location or small group practice well.

There is also an Ohio reason. Under the Ohio Data Protection Act, Ohio Revised Code 1354.02, a business that creates, maintains, and complies with a written cybersecurity program that reasonably conforms to an industry recognized framework can claim an affirmative defense to certain tort claims after a data breach. Section 1354.03 lists the CIS Critical Security Controls as one of the qualifying frameworks, and it also allows a program that complies with PCI DSS together with one of the listed frameworks. A clinic that builds its program on CIS IG1 and keeps its PCI obligations current is building toward that defense at the same time. We are not lawyers, and this is not a promise about how a court will rule, but it is a sound reason to write things down.

Where clinics are usually exposed

These are common weak spots in clinic networks:

The practice management server. Many clinics still run their practice software on a server in a back room. It often has no tested backup, runs an older operating system because the software vendor has not certified a newer one, and is reachable from every workstation. Ransomware that lands on any front desk computer can reach it.

Shared logins. Front desk and treatment room computers are frequently logged in under one shared account that never logs out. That makes it impossible to tell who did what, and anyone walking by has access.

Vendor remote access. The practice software vendor, the imaging vendor, and the lab interface vendor may all have remote access tools installed. Those tools are often always on and protected only by a password. Our vendor management policy guide covers how to keep that list under control.

Email. Clinics receive a high volume of email from clients, distributors, and labs. That makes them good targets for invoice fraud and credential phishing.

Imaging and lab equipment. Digital radiography and in house lab analyzers sit on the network and are often managed by the equipment vendor, with operating systems the clinic cannot patch.

A practical IG1 starting list

You do not need to implement every IG1 safeguard in the first month. Start here:

1. Inventory. List every computer, server, piece of networked equipment, and cloud service. CIS Controls 1 and 2 begin with knowing what you have.
2. Backups. Make sure the practice management data is backed up, that at least one copy is offline or immutable, and that you have actually restored from it. CIS Control 11 covers this.
3. Unique accounts. Give each staff member their own login, even on shared workstations, and use fast user switching or tap badges if speed is a concern. CIS Control 5.
4. MFA. Turn on multi factor authentication for email, the practice software if it supports it, and every remote access tool. CIS Control 6.
5. Patching. Keep operating systems and browsers updated, and plan for systems that cannot be. CIS Control 7.
6. Separate the card terminal. Keep payment terminals off the general network if your processor and terminal support it, which also helps with PCI scope.
7. Vendor access. List every vendor that can connect remotely and switch tools to on demand access where possible.
8. Training. Short, regular training on phishing and payment fraud for front desk and management. CIS Control 14.

Write each of these down as you go. The written record is what turns a set of good habits into a program.

A note on business associate style requests

Some clinics that are part of larger groups, or that work with human medical research, may receive contracts that reference HIPAA. Read those carefully. If you are asked to sign something, understand what it commits you to. In most ordinary veterinary practice, HIPAA does not apply, but a contract can create obligations of its own.

Next steps

If you own or manage a clinic, start with the inventory and the backup test. Those two items expose most of the serious gaps quickly. Our healthcare page describes how we support clinical practices, and the compliance checklist is a quick way to see where you stand. If you also run a human medical or dental practice, our dental practice post covers the HIPAA side. When you want a second set of eyes on your setup, book your free risk review.