Healthcare IT has a reputation for being behind the curve on security, and having worked in this space for a while I can say that reputation isn't entirely unfair. But the gap I see most often isn't about sophisticated attacks or zero-day exploits — it's about file transfer, and specifically about the gap between what teams think is HIPAA compliant and what actually is.
Here's what comes up most often.
Treating encryption as a checkbox rather than a practice
Most healthcare IT teams know that data needs to be encrypted. What gets missed is the difference between encrypting data at rest and encrypting data in transit — and the assumption that having one means you've covered both. HIPAA requires protection of protected health information both when it's stored and when it's being transmitted. An SFTP server with strong encryption handles the in-transit side, but only if it's actually configured correctly, using modern cipher suites and not legacy algorithms that technically pass an audit but wouldn't hold up against a serious attack.
Post-quantum encryption is something very few healthcare organizations are thinking about yet, but given how long medical records need to be retained and how fast cryptographic standards are evolving, it's worth factoring into decisions you're making today about your secure file transfer infrastructure.
Audit logs that log the wrong things
HIPAA requires that you can demonstrate who accessed what protected health information and when. A surprising number of SFTP setups log that a file transfer happened without logging enough detail to satisfy that requirement — no user attribution, no IP address, no timestamp granular enough to be useful in an investigation.
When an auditor or an incident response team asks you to pull the access history for a specific file over the last 90 days, you need to be able to answer that question quickly and completely. If your current setup can't do that, your audit trail isn't HIPAA compliant regardless of what your policy documents say.
Shared credentials for file transfer accounts
This one is surprisingly common. A vendor or partner needs SFTP access to receive files, so someone creates a shared account with a generic username and password that gets emailed around. Six months later nobody knows who has those credentials or whether the person who originally set it up still works there.
HIPAA's access control requirements exist for exactly this reason. Every entity that accesses your systems should have individual, traceable credentials, and access should be revoked promptly when the relationship ends. Granular user management and virtual directories that limit each user to exactly what they need to see are not optional features for a healthcare environment — they're the baseline.
No high availability plan for critical transfers
Patient data doesn't stop needing to move because your file transfer server had a problem. Lab results, imaging files, referral documents — these have real clinical implications if they're delayed. A single point of failure in your file transfer infrastructure is a clinical risk as much as a technical one, and most healthcare IT teams don't have a tested high availability setup for their SFTP environment.
Active-active high availability across multiple nodes sounds like an enterprise concern but it's increasingly accessible even for smaller healthcare organizations, and the cost of downtime in a clinical environment makes it worth taking seriously.
Assuming on-premise means compliant
Running your own SFTP server on your own infrastructure doesn't automatically make you HIPAA compliant any more than having a lock on a door makes a room secure. Compliance comes from the combination of the right technical controls, proper configuration, detailed logging, access management, and documented procedures — not from where the server physically sits.
The flip side is also true — cloud hosted or hybrid deployments can absolutely be HIPAA compliant when set up correctly. The location matters less than the controls.
None of this is particularly exotic. The organizations that consistently pass HIPAA audits without drama aren't running unusually sophisticated setups — they got the fundamentals right, documented them properly, and actually check that they're still working periodically.
If you're not sure whether your current file transfer setup would hold up under scrutiny, the audit log question is the fastest diagnostic. Pull the access history for any sensitive file from last month and see how complete the picture is. That answer tells you a lot about where you actually stand.
