This article is certainly on point and is full of great advice for any medical practice.  That said, the biggest challenge is the section focused on culture.  Culture in medical practices can be challenging because big egos are often involved.  Medical practices are comprised of highly educated and motivated professionals, often at the top of their respective fields which creates an environment where the need to turn to other professionals in other fields more difficult.  If I mastered all the aspects of my professional specialty, surely I can master the demands of IT and IT security.  Sound familiar?

https://www.tripwire.com/state-of-security/featured/best-practices-healthcare-information-security/