Millennial Networks

    Insights

    FQHC Cybersecurity: How to Build the Operating Program, Step by Step

    The short answer

    FQHC cybersecurity is the day-to-day operating program that protects patient information across every system a 330 center runs: eClinicalWorks, backups, email, imaging, satellite workstations, and any automation with an EHR account. It is not a binder assembled before a visit, and it is not a certification shopping list. It is a dated risk analysis with owners on findings, access that matches roles, restores you have actually run, an incident path staff can recite, executed business associate agreements (BAAs), and training with names on it. The HRSA site visit cybersecurity file is what a reviewer opens when that program is working. This post covers how to build the program itself.

    What FQHC cybersecurity means day to day

    A private practice can treat security as an annual checklist. A federally qualified health center (a 330 community health center) cannot. The same stack that feeds UDS, sliding fee packets, and multi-site care also has to survive power events, shared workstations, temps, and vendors who touch PHI.

    Day to day, FQHC cybersecurity looks like this:

    • A living risk analysis. Scope names the systems that hold patient information. Findings have owners and next dates. See the HIPAA security risk analysis for FQHCs.
    • Access tied to people and roles. Joiners, leavers, and transfers are handled the same week they happen. Shared "nurse" logins are retired.
    • Backup you have restored. Software on a dashboard is not proof. A restore on a date you can name is proof.
    • An incident and downtime path. Who gets called at 6:40 a.m., what staff do when eCW will not open, and how paper notes return to the record.
    • Executed BAAs. EHR host, cloud, billing, shredding, MSP, and any automation vendor with an EHR account.
    • Training with a roster. Completions for people who still work there, including new hires, not only the annual blast.
    • Island operating reality. Generator run time, last-mile that fails in pieces, and sites that stay open while another goes dark. Write those threats into the plan, not as footnotes.

    Health outcomes sit on whether the provider can open the chart. Patients with health-related needs still have a morning slot when the west site is on generator.

    How this differs from the HRSA site-visit file

    The HRSA site visit cybersecurity page is the file reviewers open inside Quality Improvement/Assurance, data reporting, board authority, and contracts. There is no cybersecurity chapter in the Site Visit Protocol. Reviewers still ask for retrievable records, protection against loss, destruction, or unauthorized use, and whether you meet applicable federal requirements, including HIPAA.

    This post is the program that feeds that file. If access changes, restore tests, incidents, and training happen in daily operations, the named security official can open the evidence on the first ask. If the only work starts when OSV dates land, the PDF will not match production, and the interview will show it.

    How to build an FQHC cybersecurity program, step by step

    1. Start with discovery. Sites, EHR, current vendors, BAAs on file, last restore date, and any compliance or OSV dates on the calendar. Thirty minutes with the right people beats a month of guesswork.
    2. Inventory every system that holds patient information. eClinicalWorks and its interfaces, backups, email and file shares (including sliding-fee packets), imaging and lab systems, satellite workstations, and any automation with a named EHR account. One enterprise list, then site-specific reality.
    3. Run or refresh the HIPAA security risk analysis. Dated scope, findings, and owners. Do not invent a 40-control matrix for a visit. Produce the analysis you actually run. Details: FQHC HIPAA security risk analysis.
    4. Clean up access control. Tie every account to a person and a role. Retire shared logins. Document joiners, leavers, and transfers. Include temps, students, locums, and billing staff across sites.
    5. Prove the restore. Restore a system on a set date and record the result. Know what is backed up, where it lives, and that it is not only on the same island as the only server. Decide what clinic staff do when the EHR is down and how notes return to the record.
    6. Write the incident and downtime path. Named owner, call tree someone would use before clinic opens, criteria for a reportable breach, and a place to log "no incidents this period."
    7. Close the BAA file. Fully executed agreements for every vendor that creates, receives, maintains, or transmits PHI. Drafts in legal do not count.
    8. Make training evidence real. Completions that match the roster of people who still handle patient information. New-hire timing, not only the annual session.
    9. Match policies to production. Board-approved where governance requires it. Staff can find the current version. If the policy says unique passwords and the front desk shares one login, rewrite the policy or fix the desk.
    10. Put the program on a cadence. Weekly or monthly rhythm for open findings, access changes, restore tests, and incidents. Then the OSV file is a snapshot of how you run, not a scramble.

    Island operating reality without the drama

    Puerto Rico and the USVI are part of the threat model, not a special exception. Grid events happen. Generator time is not infinite. Connectivity fails in pieces. A USVI spare-parts delay is measured in water, not miles.

    Your contingency procedures should name what stays up (EHR, phones, eligibility, e-prescribing), how long you can run on generator, and what happens at a satellite that is dark while the main site is still seeing patients. A mainland template that assumes a same-day truck roll is not a plan here.

    Where Managed IT and vCIO fit

    Managed IT for community health centers is how the program stays current: help desk around clinic hours, eClinicalWorks support, access changes, tested restores, and the security file in the same stack. Virtual CIO for FQHCs is the leadership layer: risk priorities, board-facing readiness, and which remediations land first.

    Millennial Networks has run healthcare IT for community health centers in Puerto Rico and the USVI since 2017. We do not drop a binder and leave. The security official still has to speak to the program in an interview. Our job is to make that interview match production.

    Commercial path: discovery to Gap Check to remediation

    For security-led conversations, the front door is a discovery call, then a Security Readiness Gap Check (default $15,000). That assessment maps your current controls against what a reviewer and an OCR desk would expect: risk analysis, access, restore evidence, incident path, BAAs, and training. From there, remediation runs through managed IT and, where leadership wants it, vCIO oversight.

    Start at the Millennial Networks homepage or contact. Bring your last risk analysis (or say you do not have one), your last restore date, and any OSV dates on the calendar.

    Who this is for

    • CEOs, CIOs, and compliance leads at FQHCs and community health centers in Puerto Rico, the USVI, and the mainland US.
    • Security officials who will be interviewed and cannot afford to hunt a share drive.
    • Boards and executives who want an operating program, not a badge they will not maintain.

    Frequently asked questions

    #### What is FQHC cybersecurity?

    It is the operating program that protects patient information across the systems a 330 center actually runs: risk analysis with owners, access control, tested backup and restore, incident and downtime procedures, executed BAAs, and workforce training. It feeds the file an HRSA reviewer opens. It is not a separate HRSA chapter and not a certification shopping list.

    #### How is this different from the HRSA cybersecurity file?

    The HRSA site visit cybersecurity page covers the evidence reviewers open during the visit. This post covers the day-to-day program that produces that evidence. Build the program first. The file follows.

    #### Does every FQHC need a HIPAA security risk analysis?

    Yes. HIPAA requires an analysis of risks to electronic protected health information. HRSA is not OCR, but reviewers still ask whether you have a dated analysis and whether you meet applicable federal requirements. Details: FQHC HIPAA security risk analysis.

    #### Does HRSA require HITRUST or SOC 2 for a 330 center?

    No. Those certifications describe a vendor stack. Millennial Networks claims HIPAA, HITRUST, and SOC 2 Type II for our own operation. Reviewers want your dated risk analysis, access, restore evidence, BAAs, training roster, and a person who can speak to them.

    #### What should we bring to a Security Readiness Gap Check?

    Your last risk analysis (or a clear statement that you do not have one), a list of systems that hold patient information, your last restore date and result, the BAA inventory, the training roster, and any OSV or audit dates. Default price is $15,000; scope adjusts with sites and systems.

    #### Can managed IT own the cybersecurity program for us?

    Managed IT can build it and keep it current as part of daily operations. The named security official still has to speak to it. The program works when access changes, restore tests, incidents, and training are tracked by the same team that runs the stack. See managed IT for community health centers.

    Talk to our team

    Call 787-945-2260 or contact Millennial Networks to schedule a discovery call or a Security Readiness Gap Check. Bring your current security file, written or not, and we will walk through what a reviewer can open today.