Practice Scenario, Not An Actual Client

Keystone Family
Dental

A sample engagement built to demonstrate how I approach a small practice's HIPAA exposure: exposed patient data, no access controls, and zero security policy. Here's how I'd approach fixing it.

Keystone Family Dental is a fictional business used to walk through a realistic audit and remediation process. It is not a completed client engagement.

Industry
Healthcare / Dental
Location
Philadelphia, PA
Team Size
7 Employees
Learning Focus
HIPAA Concepts · M365 Security · Policy Planning
Sample Pricing
$3,500
01 // Situation

The Problem

Keystone Family Dental had been operating for several years with a Microsoft 365 environment that was never properly configured from a security standpoint. Like most small practices, they set it up to get email working and never looked back.

With 7 staff members, including front desk, dental assistants, and the practice owner, everyone was using shared login credentials, had no multi-factor authentication, and had unrestricted access to every file in the practice including patient records, billing data, and insurance information.

In this scenario, the practice owner reaches out after receiving a notice from their malpractice insurance provider that policy renewal will require documented evidence of HIPAA security compliance. They have no policies, no controls, and no documentation, and 60 days to fix it.

02 // Hypothetical Findings

What I Would Assess

In this fictional scenario, a review of the Microsoft 365 environment, access controls, and internal practices would identify four high-priority areas to investigate. The findings below are illustrative, not results from a real assessment.

// FINDING 01
No Multi-Factor Authentication
All 7 staff accounts were accessible with a username and password only. A single compromised credential would give an attacker full access to patient records, billing data, and internal communications with no additional barrier.
CRITICAL
// FINDING 02
Shared Login Credentials
Front desk staff were sharing a single login account for the scheduling and billing system. This made it impossible to audit who accessed what, directly violating HIPAA's requirement for unique user identification and access tracking.
CRITICAL
// FINDING 03
Overprivileged Access Controls
Every employee has admin-level or near-admin access to the Microsoft 365 environment including SharePoint, OneDrive, and Exchange. Dental assistants have access to financial records they have no business reason to view.
CRITICAL
// FINDING 04
Zero HIPAA Security Policies
The practice has no written security policies whatsoever: no password policy, no acceptable use policy, no incident response procedure, and no documented risk assessment. This alone is a direct HIPAA Security Rule violation regardless of any technical controls.
HIGH
03 // Approach

How I Would Approach It

The remediation would run in three phases over two weeks, prioritizing the highest risk items first while minimizing disruption to the practice's daily operations.

PHASE 01
Microsoft 365 Security Hardening
A possible first step would be to enable MFA for each account, review Conditional Access settings, and consider appropriate Microsoft 365 protections. The final design would need to be validated against the practice’s requirements and a qualified compliance review.
PHASE 02
Identity & Access Control Implementation
A potential plan would replace shared accounts with individual identities, map access to job responsibilities, reduce unnecessary admin rights, and enable relevant audit logging. Exact roles and configurations would require discovery and approval from the organization.
PHASE 03
HIPAA Security Policy Development
A complete engagement might include policy drafts, a risk-analysis process, and security-awareness training. These materials should be reviewed by qualified legal and compliance professionals before use.
04 // Example Outputs

What an Engagement Could Include

🔐
MFA Enforced Across All Accounts
All 7 staff accounts now require Microsoft Authenticator approval for every sign-in. Conditional Access policies block unauthorized login attempts automatically.
// EXAMPLE
👤
Individual Accounts & RBAC
Shared credentials eliminated. Each staff member has a unique account with access only to the systems their role requires, fully auditable and HIPAA compliant.
// EXAMPLE
📋
Complete HIPAA Policy Package
Five written security policies delivered covering passwords, acceptable use, access control, incident response, and a documented risk assessment ready for any audit.
// EXAMPLE
🎓
Staff Security Awareness Training
All 7 staff members completed a security awareness session covering phishing, password hygiene, and HIPAA obligations. Session documented for compliance records.
// EXAMPLE
05 // Learning Takeaway

The Goal

The purpose of this scenario is to show a risk-first way of thinking: identify the highest-impact identity and access gaps, clarify what needs expert review, and plan improvements without promising a compliance outcome.

4
Illustrative Findings
100%
Illustrative MFA Goal
5
Example Policy Areas

A real practice would need a tailored risk analysis, documented decisions, and appropriate professional review. No configuration or policy set can by itself guarantee HIPAA compliance or insurance renewal.

The timeline, scope, and costs for real work vary substantially by environment and should be established only after a qualified discovery process.

// NOTE
This is a practice scenario, not a completed client engagement. Keystone Family Dental is a fictional business used to demonstrate a realistic HIPAA audit and remediation process, reflecting the types of issues commonly found in small healthcare practices and the standard approach used to fix them. All client details are fictional.
// Keep Learning

See More Projects

This case study is a learning artifact. Visit the portfolio for personal labs, notes, and clearly scoped work.

Back to Portfolio

// Free · No commitment · mark@markschwinn.com