Short answer
A small optometry or physiotherapy clinic should keep an inventory of every device, use separate accounts with multi-factor sign-in, encrypt laptops, separate guest and payment networks from clinic computers, back up nightly to an encrypted off-site copy with tested restores, keep Windows and device software updated, and train staff on phishing.
Devices and inventory
- A list of every computer, laptop, tablet, printer and imaging device, with warranty dates
- Windows versions checked, with replacements planned before end of support
- Laptops and tablets encrypted and set to lock automatically
- A spare or second check-in workstation for the front desk
Optometry: imaging and diagnostic equipment
- Know which workstation each retinal camera, OCT or field analyser sends images to
- Ask the device vendor before applying major Windows updates to those workstations
- Imaging workstations wired, not on Wi-Fi
- Image folders included in the backup
Physiotherapy: mobile devices and treatment rooms
- Each practitioner signs in with their own account, never a shared login
- Screens lock when a laptop is left in a treatment room
- Exercise videos and home-program tools reached through approved apps, not personal accounts
- Lost or stolen devices can be locked or wiped remotely
Network and Wi-Fi
- A business-grade firewall instead of the ISP modem alone
- Separate networks for clinic computers, guests and payment terminals
- Wi-Fi coverage checked in every room that uses a laptop or tablet
Accounts, email and security
- Multi-factor sign-in on email and remote access
- Access removed the same day a staff member leaves
- Short phishing training for everyone who uses email
- Updates and endpoint protection on every computer
Backups
Nightly, encrypted, off-site and restore-tested. See our PHIPA backup guide for the details and the questions to ask your provider.