HIPAA Compliance with Tebra (Kareo): Practice Guide

Tebra (formerly Kareo) is a popular cloud-based EHR and practice management platform specifically designed for small independent practices and clinics. The integrated EHR and billing system offers cloud-based HIPAA compliance features including role-based access control, audit logging, patient portal capabilities, and secure billing integration. As a cloud system, compliance relies on both Tebra's infrastructure protections and proper configuration of user access and security settings.

1. Execute and Maintain Business Associate Agreement

• Verify current BAA is signed with Tebra before any PHI use
• Confirm BAA covers all Tebra products you use (EHR, billing, patient portal)
• Review BAA terms for data storage, backup, encryption, breach notification
• Understand Tebra's security responsibilities versus your practice's obligations
• Review and update BAA annually or when services change

2. Configure User Roles and Access Controls

• Navigate to Settings → User Management → Roles in Tebra
• Create roles specific to your practice (clinicians, clinical staff, billing, administration)
• Assign minimum necessary permissions per role (principle of least privilege)
• Restrict administrative access to essential staff only
• Document all roles and review quarterly to ensure appropriateness

3. Implement Strong Authentication Policies

• Enforce minimum 12-character passwords with complexity requirements
• Enable Multi-Factor Authentication (MFA) for all practice staff
• Configure automatic session timeout after 15 minutes of inactivity
• Disable password sharing and enforce unique user logins
• Set password expiration to 90 days with change history enforcement

4. Secure the Patient Portal

• Require strong patient account passwords (12+ characters with complexity)
• Configure account lockout after 5 failed login attempts
• Enable encryption for all patient-provider secure messaging
• Restrict patient access to their own records only
• Set session timeout for inactive patient accounts (15 minutes maximum)

5. Establish Access Review and Termination Procedures

• Conduct quarterly user access reviews by practice owners or managers
• Deactivate terminated employee accounts within 24 hours of termination
• Maintain documentation of all access changes with approval evidence
• For small practices, use reminders to ensure timely account deactivation
• Keep records of former employee account deactivation dates

6. Enable Audit Logging and Review

• Verify audit logging is enabled for all Tebra activities
• Enable alerts for suspicious activities (bulk downloads, unusual access, failed logins)
• Schedule monthly review of Tebra audit logs and document findings
• Retain all audit logs for minimum 6 years per HIPAA requirements
• Investigate and document any suspicious access patterns

7. Secure Billing and Payment Information

• Implement access controls restricting billing information to authorized staff
• Enable encryption for all payment information and billing records
• Verify PCI-DSS compliance if accepting credit card payments
• Monitor billing access logs regularly for unauthorized activity
• Secure any exported billing reports containing patient information

8. Verify Cloud Security and Vendor Responsibilities

• Request and review Tebra's SOC 2 Type II compliance report
• Confirm Tebra encrypts data at rest and in transit
• Understand Tebra's backup and disaster recovery procedures
• Document cloud vendor security in your HIPAA documentation
• Establish incident notification procedures with Tebra for breaches

9. Establish Incident Response and Breach Procedures

• Document incident response procedures specific to Tebra security events
• Create breach notification procedures aligned with HIPAA Breach Notification Rule
• Establish process for notifying Tebra of any security incidents
• Maintain incident logs with investigation results and actions taken
• Have contact information for Tebra security team readily available

• Missing or Outdated BAA: Many small practices overlook BAA requirements. Verify current BAA is signed and covers all Tebra services before using the system.
• Overly Permissive User Roles: Default Tebra roles may grant excessive access. Create customized roles based on actual job functions.
• Weak Patient Portal Security: Patient account sharing and weak passwords create unauthorized access risks. Monitor portal activity regularly.
• Inadequate Billing Security: Billing staff access to full patient records may violate minimum necessary access principle. Restrict billing staff access appropriately.
• No Audit Log Review: Having audit logs enabled is insufficient. Schedule regular reviews to detect suspicious activity.
• Slow Account Deactivation: For small practices, informal processes lead to delayed account deactivation after termination. Implement systematic procedures.