Seven digital security checks for your veterinary practice

4 mins

In a busy practice, digital security is easy to overlook. Shared computers, fast-moving workflows, and constant interruptions all create small moments where mistakes can happen, so it helps to build digital safety into everyday working before anything goes wrong.

A screen left unlocked at reception, an unexpected request to sign in, a browser extension that promises to save time. Each is worth talking through with your team: what should someone do, who can they ask, and how quickly can they get help?

That makes digital security a matter of habits, awareness, and considered choices during the working day, as well as a technical issue. Reminding people to be careful is not enough on its own: the practice also needs sensible controls, clear responsibilities, and a plan for when something goes wrong. The National Cyber Security Centre (NCSC) is part of GCHQ and gives cyber security advice to UK organisations. It publishes free guidance for small organisations, and this article draws on it. Here is how we would apply it in a veterinary practice, in seven areas to review with your practice manager and IT provider.

1. Protect accounts with more than a password

Reuse is the weak point to remove first: one password that opens several accounts means one leak can open them all. A password manager approved for your practice fixes that by generating and storing a different strong password for every account, so nobody has to memorise them. Where someone does have to remember one, three random words are hard to guess and easier to recall than a pet’s name, the practice name, or a familiar veterinary term with a number added.

A password is only half the protection. Ask your IT provider to turn on two-step verification (also called multi-factor authentication), starting with email, and use passkeys for staff accounts where your email service supports them. Without passkeys, treat a strong, unique password plus two-step verification as the minimum.

Shared workstations need a decision too: agree how staff reach their own accounts without exposing saved credentials to the next person.

2. Verify unusual requests through a separate route

Detecting a scam email is no longer as simple as looking for spelling mistakes and bad grammar. Scams can look convincing, and many lean on authority or urgency to push someone into acting.

Picture an unexpected supplier request to change payment details, or a message saying someone will lose access unless they sign in immediately. Both rely on a busy person acting before checking. The answer is the same each time: confirm it through a separate route, using contact details from the organisation’s official website, not the number or link in the message.

That only works if checking is normal. Make it an accepted part of the process, so nobody feels they must choose between verifying a request and appearing unhelpful.

3. Make shared-device routines explicit

Every device should need a PIN, password, or fingerprint or face recognition to unlock, and should be kept up to date. Turn that into a clear workstation routine:

• Agree when staff should lock a screen and when they should sign out.
• Review automatic screen-lock and session settings with whoever manages your systems.
• Decide how individual access works on shared computers.
• Include account access in your joining, role-change, and leaving procedures.

Check reception, consulting rooms, and portable devices. Ask staff to show you the normal workflow, because the written policy may not match what happens during a busy shift.

4. Give updates an owner

Updates fix weaknesses that criminals can exploit, which is why keeping devices, software, and apps up to date is worth the interruption. They tend to slip when nobody owns them, so name someone responsible for checking that they are installed, including on operating systems, browsers, applications, and devices used away from the practice.

Ask your IT support which updates are managed automatically, who follows up failed or postponed ones, and whether any devices or applications are no longer supported. Staff also need a way to report an update prompt they are unsure about.

5. Check integrations before granting access

Before connecting a new tool to your practice management software, ask what information it will access, why it needs that access, and how the access can be withdrawn.

For IDEXX Animana, IDEXX advises using official integrations and contacting Customer Support if you are unsure whether one is official. Apply the same scrutiny to browser extensions and external services. A tool being useful does not mean it has been approved for your practice.

For Animana or ezyVet, confirm the proposed connection and access arrangements with the relevant supplier before you proceed. A tool described as compatible may not have been reviewed for your practice’s use.

6. Ask how recovery would work

The NCSC describes regular backups as the most effective way to recover from a destructive ransomware attack. It also notes that attackers often target backups, and that backups, on premises or in the cloud, are not ransomware-resistant by default. Do not assume yours are.

At your next supplier or IT review, establish:

• Which information is backed up, and by whom?
• What falls outside those arrangements?
• How are backups protected?
• When was restoration last tested?
• What would the practice do while systems were unavailable?

Include information held outside your main practice software, such as locally stored documents. For cloud services, ask the supplier to explain its backup and recovery arrangements, then work out what the practice still has to manage itself. “It is in the cloud” is not a complete continuity plan.

7. Make reporting straightforward

Write down who staff should contact if they open a suspicious attachment, disclose credentials, lose a device, or notice unusual account activity. Include an alternative route in case email or the usual system is unavailable.

Encourage people to report concerns promptly, even when they are unsure what happened. Getting the right help quickly matters more than finding who made the mistake.

For what to do after an incident, the NCSC’s response guidance for small organisations covers phishing, hacked accounts, infected devices, and ransomware. Use it alongside the advice of whoever supports your systems when you write your response plan.

Start with the gaps you can see

At your next practice meeting, ask three questions: who manages account security, who checks updates and backups, and who should someone contact about a suspected incident?

If the answers are unclear, start there. Give each action an owner and review it with your IT provider.

When exploring IDEXX Animana or ezyVet, ask each supplier about backup and recovery, access controls, and approved integrations. See how IDEXX Veterinary Software fits your practice.