To maintain a secure and compliant IT infrastructure for patient data in healthcare, key practices include: implementing robust access controls with role-based permissions, encrypting data both at rest and in transit, regularly monitoring and auditing access logs, enforcing strong password policies, conducting thorough vulnerability assessments, educating staff on data security protocols, and ensuring compliance with relevant regulations like HIPAA and GDPR; all while prioritizing the principle of least privilege to minimize unauthorized access to sensitive patient information.