For practices and clinics
In a practice almost everything depends on the EHR, the phones and the internet connection. If one of them fails, the schedule stalls. We run the IT of medical practices and clinics so it works reliably every day and meets the HIPAA Security Rule, and we sign a Business Associate Agreement.
Health care providers that transmit health information electronically in standard transactions, such as insurance claims, are covered entities under HIPAA. The Security Rule requires administrative, physical and technical safeguards for electronic protected health information. The rule is scalable, so a small practice can choose measures that fit its size, but it cannot skip a required standard.
The Security Rule requires an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of electronic patient data. A missing or outdated risk analysis is one of the most common findings in HHS enforcement actions. It is also the starting point for every other safeguard, because it shows where the real risks are.
An IT provider that can access systems with patient data is a business associate. HIPAA requires a written Business Associate Agreement before that access begins, and the business associate must protect the data under the Security Rule as well. We sign a Business Associate Agreement with every HIPAA client.
HHS proposed a major update to the Security Rule in January 2025, with stricter requirements such as multi-factor authentication and encryption in most cases. As of October 2026 the update is still a proposal and has not been finalized. Until then the current rule applies. Practices that already use multi-factor authentication, encryption and tested backups will be in a good position either way.
What we do not do: maintenance of medical devices, configuration of the clinical EHR application itself and legal advice. We connect devices and the EHR securely to your network and coordinate with the vendors. Your practice designates its HIPAA security official, and your counsel decides legal questions.
FAQ
Yes. We sign a Business Associate Agreement with every client whose systems contain protected health information, before we receive any access. The agreement states how we protect the data, what we may use it for and how we report a security incident to you.
No, and no IT provider can be. HHS does not endorse or recognize private HIPAA certifications, and a certificate would not change your obligations under the Security Rule. What counts is a signed Business Associate Agreement, safeguards that match your risk analysis and documentation that shows what was done.
It requires administrative, physical and technical safeguards for electronic patient data. In practice this includes a documented risk analysis, unique user accounts, access based on job role, audit logs, protection against malware, a contingency plan with data backup and tested restores, secure transmission of data and Business Associate Agreements with vendors. Some specifications are required and others are addressable, which means you implement them or document why an equivalent measure is reasonable.
The Security Rule does not set a fixed interval. It requires an accurate and thorough risk analysis and ongoing review of your safeguards. Many practices update it every year and whenever something important changes, such as a new EHR, a new location or a move to the cloud. Our HIPAA Readiness Check for practices with up to 15 staff at one location costs $3,500 and includes the risk analysis.
HHS published a proposed update in January 2025. It would, among other things, make most addressable specifications required and call for multi-factor authentication and encryption in most cases. As of October 2026 the rule is not final, and the current Security Rule applies. We already set up multi-factor authentication, encryption and tested backups as standard, so you do not have to wait for the final rule.
Call us right away. In the Standard and Complete plans we respond to an outage that stops your practice within 2 hours. We check the network, internet connection, workstations and local servers and work with the EHR vendor if the problem is on their side. Your contingency plan should also describe how you see patients while the system is down, and we help you write and test it.
Yes, on the IT side. We make sure staff can sign in securely, that workstations, cameras and browsers work and that your network is ready for video visits. The portal and telehealth platform themselves are run by their vendors, and we coordinate with them when there is a problem.
No. Ongoing managed IT starts at 5 users, and the HIPAA Readiness Check is designed for practices with up to 15 staff at one location. Smaller practices can also book individual projects, such as encrypting laptops or setting up multi-factor authentication, at a fixed price agreed in advance.
Medical practices and clinics
Tell us how your practice or clinic works today. In a 20-minute call we discuss where you stand and what makes sense as a next step.
