What makes a practice particularly exposed
A practice combines three factors rarely found together elsewhere. First, the value of the data: a patient record holds medical history, a social security number and contact details — everything needed to steal an identity for years. Second, the absence of an IT department: the computer is administered by the software vendor, sometimes by a relative, and updates wait until the practice closes. Third, constant urgency: a practitioner running from one consultation to the next opens an attachment in thirty seconds, without checking the sender. An attack does not need to be sophisticated to succeed here; it needs to arrive at the right moment.