My apologies if this question has been asked before.
How does a medical practice assure patients that the practice follows excellent computer security practices?
Conversely, how does a patient find this out?
Some initial questions:
Do any of the computers in the office run Windows XP? If so, are they air-gapped?
Ditto for Windows Vista.
Does each computer use full-disk encryption?
What is office policy about BYOD devices?
Is there a written security policy? What documents do employees sign?
These questions, and more, would be answered in a security audit. Can medical facilities provide a statement to patients about their security practices, without revealing specifically what they are?
An interesting link:
NOTE: I think that a "medical audit" does not cover security issues. A "medical audit" covers proper diagnosis and coding of medical conditions according to the ICD-10-CM (International Classification of Diseases, Tenth Revision, Clinical Modification). See http://www.cdc.gov/nchs/icd/icd10cm.htm