Table of Contents
A four-provider clinic in Ravenswood has the same week as any small business. Payroll is late, the printer jams, someone calls in sick on the busiest morning. The difference is that the clinic runs under stricter data rules than most banks, with no IT department and a front desk of two.
That makes clinics a genuinely useful model for the rest of us. Not because HIPAA applies to your business. It probably doesn’t. But the habits transfer, and the legal distance between a medical office and a gym is shrinking faster than most owners notice.
You’re Holding More Sensitive Information Than You Think
Gyms collect injury histories. Salons keep allergy notes. Agencies hold payroll files and client contracts. Contractors walk around with home addresses and alarm codes in a phone.
Illinois owners should look hardest at biometrics. BIPA sets damages at $1,000 for each negligent violation and $5,000 for each reckless one, and a fingerprint timeclock without written consent has been enough to start a class action. Pret A Manger settled one for $677,000 covering roughly 800 workers. In April 2026, the Seventh Circuit ruled in Clay v. Union Pacific that damages accrue once per person rather than once per scan. That lowers the ceiling even further.
State privacy laws are widening at the same time. Connecticut drops its coverage threshold to 35,000 consumers on July 1, 2026, and removes the volume threshold altogether for any business processing sensitive data. Rhode Island’s law allows penalties up to $10,000 per violation with no cure period. “Sensitive” in these statutes covers health conditions, religion, sexual orientation, and citizenship status.
So the question stops being whether you’re regulated and becomes how you’d behave if you were. Below’s 4 habits to learn from clinics in this regard.
Give Everyone The Least Access That Still Lets Them Work
HIPAA calls this “minimum necessary,” and in a clinic it looks specific. The scheduler can see that you’re booked for 2pm and what you owe. She cannot open your chart notes. That split is built into the practice management systems clinics run their front desks on, where scheduling, billing, and clinical records live behind separate permissions rather than one shared login.
Now compare that to your business. Your summer intern probably has admin rights in the CRM. Your bookkeeper probably has the shared inbox. Access accumulates over time, because revoking it is annoying and granting it solves a problem today.
So what to do?
Pull your user list once a quarter and cut whatever nobody needs. It takes about half an hour.
Know Who Opened What
Clinics can answer a question most businesses can’t. Who viewed this record, and when? Staff behave differently knowing the log exists.
Ask yourself who downloaded your customer list the week that salesperson quit. If you can’t answer, turn on audit logging in Google Workspace or Microsoft 365. You already pay for it, but almost nobody switches it on.
Vet The Vendor, Not Just The Software
A clinic can’t simply start using a tool. Somebody has to sign an agreement accepting responsibility for the data first, which is a step worth borrowing whether you’re ten years in or still working through the basics of starting a business in Chicago.
This matters most with AI right now. Clinics testing ambient documentation tools are stuck on an uncomfortable detail because no vendor accepts clinical liability, so physician review stays mandatory. Meanwhile plenty of small businesses paste client lists and employee complaints into free chatbots with no equivalent conversation happening at all. Ask what the clinic asks. Who’s responsible if this leaks, and what did we agree they can do with it?
Data SHOULD Expire
Clinics run retention schedules and destroy records on a timetable. Most small businesses keep everything forever, which turns every old spreadsheet into a future breach surface.
Centralized systems help here more than people expect. Practices on modern EHR platforms can revoke a departing employee’s access in one place instead of hunting through twelve separate tools and forgetting three.
In other words, offboarding is where most small businesses actually leak, and it’s fixable in an afternoon.
What You Shouldn’t Copy
Healthcare still faxes things, which is indefensible. It hoards records out of fear. And it produces consent forms nobody reads, which is theater rather than security. So, copy the habits, not the binders.
The Saturday Morning Version
- Turn on multi-factor authentication everywhere, 40 minutes
- Audit who has access to what, 30 minutes
- Enable audit logging, 15 minutes
- Write a one-page offboarding checklist, 20 minutes
- List every vendor that touches customer data, 45 minutes
- Pick one data type and delete what’s past its useful life, 1 hour
One last thing worth sitting with. For twenty years, HIPAA let practices treat safeguards like encryption as “addressable,” and addressable slowly became optional whenever it was expensive or inconvenient. Regulators have now proposed taking that option away. Every small business owner reading this has made the same trade, for the same reasons. Good luck!