Cyber insurance checklist for chiropractic and physiotherapy clinics

This is the list of things to set up in a clinic with staff, one at a time.

Before you start

Write down every computer in the clinic (front desk, each treatment room, the back office, any laptop that goes home) and every person who signs in to email or the clinic system, including anyone who has left. The checklist covers all of them.

The checklist

1. One login per person. No shared front desk password. Close accounts for staff who have left.
2. Two-step sign-in on email, including the shared front desk inbox. Google Workspace or Microsoft 365.
3. Two-step sign-in on your clinic system. Turn it on for every user in its security settings. If you can't find it, ask the company.
4. Everyday accounts for staff. Staff computers should use an account that can't install software, with the admin login kept for whoever looks after your computers. A tech can set this up.
5. Encryption on every computer. Turn on FileVault or BitLocker.
6. Automatic updates on every computer. Turn them on.
7. Antivirus on every computer. Check it's on.
8. A backup you unplug, plus a restore test. Set up the backup.
9. DMARC on your email domain. Google Workspace or Microsoft 365.
10. A list of outside logins: your IT company, software vendors, web designer. Make the list.
11. A call-back rule for payments. Phone before any bank detail change.
12. Yearly staff training. Set it up and keep a log.
13. A one-page plan for a bad day. Write it.

How to show it's done

Take a dated screenshot as you finish each item, one per computer where it applies, with no patient details in the picture. Keep them in one folder with your policy. How to save proof shows what each one needs.