September 2026 | Medical Practice Cybersecurity Salt Lake City | AI & Disaster Recovery | HIPAA-Compliant Continuity Planning

Most medical practices know they should have a disaster recovery plan. Few have one that's current, tested and complete, even though an EHR outage or ransomware attack directly affects patient care, and healthcare remains the number one target for ransomware.

That's not because practices lack initiative. Usually, the challenge is getting the first version down. People are far better at improving something than starting from scratch. Give a practice administrator a rough draft of a downtime procedure and they'll point out what's missing, what's unrealistic and what needs to change. Leave them staring at an empty document between patient calls, and the work gets pushed aside.

That's where AI fits into preparedness planning for Salt Lake City medical practices, not as a replacement for strategy or medical practice cybersecurity expertise, but as a tool that provides a useful starting point. With September being National Preparedness Month, here are five ways to put it to work.

One rule before anything else: never put PHI into an AI tool. Patient names, dates of birth, chart details, insurance information, none of it belongs in a public AI service, and even a private one requires a business associate agreement first. Everything below works with generic, de-identified process information.

1. Document Processes Faster

One of the biggest obstacles to preparedness planning is getting everyday workflows out of people's heads and into a format others can follow during an emergency, or when a key staff member isn't available.

AI can turn rough notes or scattered bullet points into clear first drafts: how the front desk checks patients in when the EHR is down, who contacts the Epic, Cerner or Athenahealth support line during an outage, what steps clinical staff follow when e-prescribing is unavailable.

The draft still needs review by the people who know the practice, and by whoever owns HIPAA compliance. But a working draft is much easier to refine than a blank page.

2. Create Checklists and Response Playbooks

A good plan is easier to follow when it's broken into clear steps. AI can create first drafts of checklists and response playbooks for situations like a ransomware attack, an EHR outage mid-clinic-day, a phone system failure or a suspected PHI breach.

Useful documents include a front desk downtime checklist, an outage communication template for patients, a staff onboarding guide that covers HIPAA basics, or a basic response outline for a system issue.

Here too, AI produces a starting point, not a finished plan. It doesn't know your patient population, your payer mix, your vendors or your HIPAA obligations unless you give it the right context. Your leadership team reviews the output and decides on the final version.

3. Identify Gaps You Didn't Know to Look For

The hardest part of recovery planning is knowing what questions to ask. AI can help close that gap. Try prompting it with specific, de-identified questions:

  • What happens if our EHR is unavailable for eight hours on a fully booked clinic day?
  • What operational risks should a medical practice consider during an internet outage?
  • What's typically missing from a healthcare business continuity plan?

AI won't know which risks matter most to your practice without context. But it can surface questions, dependencies and weak spots your team should examine more closely, including phishing scenarios that target practices specifically, like fake referral emails and fraudulent insurance authorization requests.

4. Simplify Technical Information

Most technical documentation isn't written with physicians or practice administrators in mind. Backup reports, security findings and HIPAA risk assessment results can be accurate and still hard to turn into a clear decision.

AI can translate that information into plain English: summarize what a document says, explain what it means for patient care and daily operations, and identify the points your leadership team should discuss with your IT provider.

The goal isn't for every provider to understand every technical detail. It's for the right people to understand enough to make informed decisions about what needs attention, what can wait and what could put patient records at risk if ignored.

5. Keep Documentation Current

Policies and downtime procedures become outdated faster than practices expect. Staff roles change, intake moves to Phreesia or DocuSign, telehealth expands through Doxy.me, billing shifts to AdvancedMD, and new threats emerge as the practice evolves.

AI makes it easier to review and refresh documentation: compare old procedures against new notes, standardize the format across documents written at different times, or turn recent changes into updated drafts your team can review.

Human ownership still matters. AI can streamline maintenance work, but only a person can decide what's accurate, what's approved and what your clinical staff should follow, and HIPAA holds the practice, not the tool, accountable for the result.

Where AI Stops

Everything above depends on using AI the right way: as a draft, a guide, a way to move planning forward. The closer you get to patient care, the more that distinction matters.

There are things AI simply can't do, regardless of how good the prompt is:

  • Test your PHI backups or confirm patient records will actually restore under real conditions
  • Verify that your recovery timeline is realistic for a practice with patients scheduled every 15 minutes
  • Understand the nuances of your patient population, your providers or your compliance obligations
  • Coordinate your front desk team and clinical staff during an active outage
  • Replace the clinical and strategic judgment that comes from experience and accountability

That part takes leadership, tested downtime procedures and an IT partner who can validate that the plan holds up when the waiting room is full.

Where a Medical Practice Cybersecurity Partner Fits

A recovery plan can look complete on paper and still fall short when it matters most. The difference is the experience behind it.

Qual IT understands how a practice's systems depend on one another, EHR, intake, billing, telehealth, and where hidden risks to patient records emerge. We test recovery strategies to make sure they work in practice, not just in theory, and we bring the HIPAA-compliant IT services perspective that turns a document into genuine protection for your Salt Lake City practice.

AI can help you build the first draft. We make sure the plan is ready for a real clinic day.

Frequently Asked Questions

Do you offer HIPAA-compliant IT services for medical practices in Salt Lake City?

Yes. Qual IT provides HIPAA-compliant IT services for Salt Lake City medical practices, including cybersecurity, PHI backup and disaster recovery, and continuity planning, all covered by a signed business associate agreement.

Is it safe to use AI tools in a medical practice?

It can be, with clear rules. Never enter PHI into an AI tool unless the vendor has signed a business associate agreement, and even then, limit what you share. Use AI for generic drafting, downtime procedures, checklists, patient communication templates, and keep patient records out of it.

How often should a medical practice update its disaster recovery plan?

Review it at least twice a year, and any time the practice changes significantly, a new EHR or billing platform, new providers or locations, expanded telehealth or staffing changes. An outdated plan can be nearly as risky as no plan at all.

The Next Step Is Yours

AI can support you as you think through the plan, organize the work and surface questions your team may not have thought to ask. But knowing where your practice actually stands, whether the backups restore, whether the front desk knows the downtime drill, takes a different kind of conversation.

We work with Salt Lake City medical practices to protect patient data and maintain HIPAA compliance.

If you're curious how AI and proactive disaster recovery planning can work together for your practice, schedule a 10-minute discovery call with Qual IT. We'll assess where your preparedness efforts stand today and what it would take to strengthen them. Book your discovery call here.