Your small business doesn’t provide most of the fuel for the Eastern Seaboard or process and distribute a huge proportion of America’s meat supply. But that doesn’t mean you shouldn’t be worried about ransomware attacks or other cybersecurity threats. The recent attacks on the Colonial Pipeline and meat processor JBS are just two high-profile examples of what has become a significant threat to companies, medical practices, and licensed professionals across a wide range of businesses and professions.
A Ransomware or Other Cyberattack Can Be a Deathblow To Your Business
Every minute of every day, sophisticated hackers attempt to gain access to trade secrets, personal customer or patient information, and all other data that makes a company run. Sometimes, the data itself has value to cybercriminals, such as customer financial information, credit card numbers, Social Security numbers, and the like. Other times, as is the case in ransomware attacks, hackers hold a company’s entire information infrastructure hostage until they receive the eponymous ransom. The increasing complexity and frequency of ransomware attacks drove the average ransom payment from less than $5,000 in 2018 to over $233,000 in 2020.
Such security breaches can cost companies millions of dollars in business disruption and remediation costs. Cyberattacks and the release of confidential information can cause customers to lose faith in the ability of the company to maintain the confidentiality of their payment and personal data.
Additionally, a complex patchwork of state and federal laws establishes notification requirements in the event of a breach. Failure to follow those laws can expose businesses to fines and adverse regulatory actions that only add to the pain of a cyberattack.
For business owners, physicians and medical practices, and licensed professionals, a robust cybersecurity program is no longer optional. Failing to implement a comprehensive strategy to protect valuable intellectual property and proprietary information is essentially business negligence. Failing to act swiftly and aggressively once a breach has occurred can be business and professional suicide.
Medical Practices Increasingly Under Threat
The threat to medical practices and other entities in the healthcare industry is of particular concern because the subject of the attacks usually includes protected health information (PHI). Cybercriminals hold that information hostage under the threat of “doxing,” meaning to publicly release documents containing PHI.
Guidance from the Department of Health and Human Services Office for Civil Rights, the federal body charged with enforcement of HIPAA, states that ransomware encryption of PHI is a per se unauthorized disclosure of PHI triggering the Breach Notification Rule. That rule requires HIPAA-covered entities and their business associates to provide notification following a breach of unsecured protected health information. The rule presumes a cybersecurity incident has resulted in unauthorized access to unsecured PHI, at which point the burden shifts to the practice or organization to show a low probability of the compromise of the PHI it maintains.
What You Can And Should Do Right Now To Protect Your Data and Your Business
The U.S. Small Business Administration has a wonderful website dedicated to helping business owners prevent and respond to ransomware and other cybersecurity threats. The site includes these ten key steps companies should take as part of a comprehensive strategy:
- Protect against viruses, spyware, and other malicious code
- Secure your networks
- Establish security practices and policies to protect sensitive information
- Educate employees about cyberthreats and hold them accountable
- Require employees to use strong passwords and to change them often
- Employ best practices on payment cards
- Make backup copies of essential business data and information
- Control physical access to computers and network components
- Create a mobile device action plan
- Protect all pages on your public-facing websites, not just the checkout and sign-up pages
I recommend that all small business owners and medical practices spend some time at the SBAs cybersecurity website (https://www.sba.gov/managing-business/cybersecurity) and take all steps necessary to shore up this crucial aspect of their operations. A hack of your network may not attract national headlines, but it could repel customers and patients and cost you your business or practice.
If you have questions about protecting your business or medical practice from cyber threats, please give me a call at 312-236-2433 or fill out my online form to arrange for your free initial consultation.

Bankruptcy happens. It’s not a crime, it’s not a moral failure, it’s not a character flaw. In times of economic upheaval, in particular, even the most hard-working, intelligent, and responsible professionals, from physicians to accountants to hairstylists, can find that their debts have simply become untenable. Filing for bankruptcy can itself be a difficult experience, emotionally, financially, and practically. But if you’re also worried that you might lose your professional license, and thus your ability to support yourself and your family, the anxiety is only compounded.
Whether a physician faces disciplinary action by their state medical board depends primarily on their own conduct. Practicing with competence, ethics, and integrity should insulate a doctor from any significant concerns that their license may be put in jeopardy. But it’s not only how you practice, but where you practice, that can determine how likely you are to face the scrutiny of your state’s medical licensing authorities.
As you know from years of watching TV courtroom dramas or the travails of real-life politicians, people under criminal investigation or who are facing charges often “plead the Fifth” -that is, refuse to provide statements or testimony – because they fear that what they say can and will be used against them in those proceedings.
As the COVID-19 pandemic rages on, America’s physicians and health care professionals often face an unnecessary and dangerous choice about what matters more: their career or their mental health.
Simply saying something doesn’t make it so. Just because you believe a proposition doesn’t make it true. And wanting a certain result doesn’t entitle a person to get it. If you are going to advocate for a position or seek an outcome based on claims you make, you better have the receipts to back it up. That is a fundamental proposition of our judicial system. A party seeking relief, whether a plaintiff in a civil lawsuit, a prosecutor in a criminal case, or a defeated president in a flurry of desperate and delusional litigation, must meet the applicable burden of proof to prevail. So too must the Illinois Department of Financial and Professional Regulation (IDFPR) when pursuing disciplinary action against a physician, as does a doctor seeking to have their license reinstated.
Do the right thing. Follow the rules. Straighten up and fly right. Do what you’re told. If the Illinois Department of Financial and Professional Regulation (IDFPR) has suspended your professional license or put you on probation, following or satisfying the probationary terms and conditions imposed by the department is a necessary prerequisite to reinstatement and resumption of your career. But it can be hard to comply with probationary terms if you don’t know what they are.
Well-before the world had heard of COVID-19, the use of telemedicine was increasingly seen as a way to expand patient access to care and address a growing shortage of physicians, particularly in rural and underserved areas. As noted by the authors of an article in the 
After over two months on personal and professional lockdown, we all want things to return to some semblance of “normal” at the earliest opportunity, while also remaining cognizant of the continuing public health risks posed by COVID-19. Business owners and service providers, including those who hold professional licenses, are desperate to get back to work and bring in income after sitting idle for what seems like forever. 