Services · Healthcare & HIPAA
IT for medical practices, built around HIPAA.
Medical, dental, and behavioral-health offices handle patient information on every computer, phone, and inbox. We protect it the way the HIPAA Security Rule expects — and keep the written record that shows we did.
What HIPAA asks of your IT
The Security Rule, mapped to the work we do.
HIPAA's Security Rule sets out safeguards for any practice that keeps patient information electronically. Most of them are about how computers, accounts, and backups are run — which is exactly what we manage every day.
The most common gap regulators find isn't a hacker. It's a practice that never did, or never updated, its security risk analysis.
- §164.308(a)(1)Risk analysis
- We find every place patient information lives — computers, phones, the server, email, cloud apps — and write down the risks to each.
- §164.312(a)Access control
- Every person signs in as themselves, with multi-factor sign-in and automatic screen locks. Departing staff lose access the same day.
- §164.312(a)(2)(iv)Encryption
- Laptops, desktops, and phones are encrypted, so a lost or stolen device doesn't expose the patient records on it.
- §164.312(b)Audit controls
- Sign-ins and device activity are recorded and monitored around the clock, so there's a record of who accessed what.
- §164.308(a)(7)Contingency plan
- Daily backups with an offsite copy, a monthly restore test, and a same-day spare computer if one fails.
- §164.310(d)Device & media controls
- A live inventory of every device. Retired computers and drives are wiped before they leave, with a record kept.
- §164.308(a)(5)Malicious software protection
- Managed endpoint protection on every computer, and security patches installed on a tested schedule.
- §164.312(e)Transmission security
- Secure remote access for staff working off site, and encrypted email for messages that carry patient information.
HIPAA security readiness
Four steps, and you approve the cost first.
STEP 01
Risk analysis
We go through every device, account, and system that touches patient information, and record what could go wrong with each.
STEP 02
Findings, in plain English
You get a ranked list of gaps — what each one is, why it matters, and what it takes to fix. The quote comes before any work.
STEP 03
Close the gaps
We switch on encryption, multi-factor sign-in, screen locks, and backups, and clear out anything that shouldn't be there.
STEP 04
Records you can show
You get written documentation of your safeguards, ready to file with your HIPAA policies — and we repeat the analysis every year.
What's included
- A security risk analysis covering every device and account
- A written findings report and a fixed quote before we start
- Full-disk encryption on laptops and desktops
- Multi-factor sign-in on email and remote access
- Phones and tablets with patient data managed and protected
- Encrypted email set up in Microsoft 365 or Google Workspace
- Backups confirmed, tested, and kept offsite
- Documentation of your technical safeguards for your files
- An annual review, so the analysis never goes stale
Where our part ends
We handle the technology. You stay in charge of the practice.
Be wary of anyone who sells “HIPAA compliance” in a box. Compliance is your practice's policies, training, and decisions as much as its computers.
What we can do is make sure the technical safeguards are really in place, keep them that way month after month, and document them clearly — so when your privacy officer, an auditor, or a cyber insurer asks how patient information is protected, you have a straight answer on paper.
Healthcare IT FAQ
Questions practices ask us first.
- Will you sign a Business Associate Agreement?
- Yes. Any IT provider that can reach patient information has to sign one, and we sign ours before we connect to anything. If your practice already has a standard BAA, we're happy to review yours.
- Does this make us HIPAA compliant?
- No IT company can honestly promise that. HIPAA also covers your privacy policies, patient rights, staff training, and who your privacy and security officers are — decisions only your practice can make. We take care of the technical safeguards and give you the records that show it.
- Do you support our EHR or practice-management software?
- We support the computers, network, printers, and scanners around it, and we work directly with your EHR vendor when something on their side needs fixing. The vendor still owns the software itself.
- Our records are in a cloud EHR. Aren't we covered?
- Only partly. Patient information still ends up in email, scanned documents, downloaded reports, and on the phones staff use to check schedules. A risk analysis has to cover all of it, not just the EHR.
- What happens if a laptop is lost or stolen?
- If it was encrypted to the standard HHS sets out, the patient information on it is considered secured, and losing it generally isn't a reportable breach. If it wasn't, it may be — so encryption is one of the first things we switch on. We can also lock or erase it remotely.
- What does it cost?
- The readiness project is quoted after we've seen how many people and devices you have. After that, the ongoing safeguards are part of our flat monthly fee, the same as for any other client.
Everything that keeps the safeguards running month to month is part of our flat-fee monthly services.
Find out where your practice stands.
Tell us how many people and devices you have, and we'll start with the risk analysis.