Our Practice Has an EHR, a Fax Machine, and Nobody in Charge of HIPAA Security. Where Do We Start?

The practice manager at a 24-person family medicine office in Grove City found out who was responsible for HIPAA security the same way most practices do. An insurance renewal form asked for the name and title of the practice's "designated security official." She walked the question down the hall. The physician owner thought it was the IT company. The IT company, a one-man shop that came out when something broke, thought it was the practice. Nobody had ever written a name down.

That gap is common, and it is the reason managed IT services for healthcare look different from IT support for a general small business. A medical practice is not just a small office with computers. It runs on an electronic health record (EHR) that has to be up when the first patient checks in, it holds some of the most valuable data criminals can steal, and it answers to federal rules that assume somebody is actually watching the systems. This guide covers what healthcare managed IT should include, how HIPAA shapes the work, and what to ask before you hire anyone.

What should managed IT services for healthcare actually include?

If you have read our overview of managed IT services for small businesses, the foundation is the same: a flat monthly arrangement where one company monitors, maintains, and secures your technology instead of waiting for it to break. Healthcare managed IT services add a layer on top of that foundation, because the stakes and the rules are different.

At a minimum, a provider serving a medical practice should cover:

• EHR and practice management uptime. Whether your EHR runs on a server in the back closet or in the vendor's cloud, the provider should monitor the pieces it depends on: the server, the internet connection, the workstations at the front desk and in the exam rooms, and the scanners and signature pads that feed it.
• Backup failover for the internet line. If your EHR is cloud-hosted, the internet connection is now a clinical system. A second connection (a different carrier, or a cellular backup) that takes over automatically is not a luxury.
• Security monitoring that someone reads. Endpoint protection, email filtering, and alerting on every machine, with a person who responds at night and on weekends. Healthcare is a top target for ransomware and for email account takeovers.
• Access control. Every staff member with their own login, multi-factor authentication on email and remote access, and accounts shut off the day someone leaves. Shared front desk logins are one of the first things an auditor flags.
• Backups tested by restoring them. Encrypted, kept off-site, and actually restored on a schedule, with the results written down.
• HIPAA documentation support. Help with the risk analysis, the asset inventory, the policies, and the audit trail, so the paperwork matches what is actually running.
• Vendor coordination. One party who calls the EHR vendor, the lab interface vendor, the phone company, and the copier company, so the practice manager is not the IT department by default.

How does HIPAA change the IT services a healthcare practice needs?

HIPAA does not tell you which firewall to buy. The Security Rule is written around outcomes, and it leaves the specifics to each practice based on its own risk analysis. In plain English, it asks a practice to do a few things that come down to IT work:

1. Name a security official. One person responsible for the security program. It can be the practice manager, with an outside IT provider doing much of the work, but someone has to own it.

2. Do a risk analysis, and keep it current. A documented review of where patient information lives, what could go wrong, and what you are doing about it. This is the requirement practices skip most often (we walk through it step by step in our guide to the HIPAA security risk assessment), and the federal Office for Civil Rights (OCR) has been running an enforcement initiative focused on it. Many recent settlements cite a missing or outdated risk analysis.

3. Control and log access. Unique user IDs, automatic logoff, and the ability to show who looked at what.

4. Have a contingency plan. Data backup, disaster recovery, and a way to keep seeing patients while systems are down. Our guide to a disaster recovery plan for a small business walks through the pieces.

5. Train the workforce. Ongoing security awareness, not a video once a year.

6. Sign business associate agreements. Any outside company that can access patient information, including your IT provider, needs a signed business associate agreement (BAA) that makes it legally responsible for protecting that data.

The Department of Health and Human Services also proposed a significant update to the Security Rule in January 2025 that would turn several "addressable" safeguards, such as encryption and multi-factor authentication, into firm requirements, and add items like a written technology asset inventory and network map. Ask your compliance advisor where that rule stands today. Either way, a practice that already does those things is in good shape, and a good provider will steer you there regardless.

This is a general overview, not legal advice. Your attorney or compliance advisor should confirm how the rules apply to your practice.

What does HIPAA IT compliance look like day to day?

HIPAA IT compliance is less about a binder on a shelf and more about a handful of habits that a provider either does every month or does not do at all. Here is what it looks like when it is working:

• The risk analysis is reviewed every year and any time something big changes (a new EHR, a new location, a move to the cloud).
• Every laptop and workstation is encrypted, patched, and listed in an inventory with who uses it.
• Multi-factor authentication is on for email, remote access, and the EHR wherever the vendor supports it.
• A monthly report shows patch status, security alerts handled, backup test results, and accounts added or removed.
• When a staff member leaves, their access is gone the same day, and the change is logged.
• The practice can produce its BAAs, policies, training records, and risk analysis within a day if OCR, an insurer, or a hospital partner asks.

If you have never had an outside review, a cybersecurity assessment is the fastest way to find out where you stand. Our post on cyber security audit services explains what a real assessment covers and what you should get at the end.

Why do medical practices get hit by ransomware and email fraud so often?

Patient records are worth more to criminals than credit card numbers, because they can be used for insurance fraud and identity theft for years. Practices also cannot tolerate downtime, which makes them more likely to pay. And many independent practices run on older equipment and thin IT support, which makes them easier to get into than a hospital.

The 2024 attack on Change Healthcare showed a second risk: practices that were never attacked directly still could not process claims for weeks, because a vendor they depended on went down. Good healthcare IT services plan for that too, by knowing which outside systems your revenue depends on and what the workaround is if one disappears.

The most common entry point is still email. A front desk employee gets a convincing message that looks like it came from the EHR vendor or a payer, enters a password on a fake login page, and the attacker is now reading the practice's inbox. Email security filtering plus multi-factor authentication stops most of these attempts before they become a reportable breach. Under HIPAA, a breach affecting 500 or more people has to be reported to HHS and the media, and every affected patient has to be notified, which is a cost and a reputational hit no practice wants.

What should a practice ask before hiring a healthcare IT support provider?

General IT companies and healthcare IT support providers can look identical on a website. These questions separate them quickly:

1. Will you sign a business associate agreement? If the answer is hesitant, stop there.

2. Who in your company has worked with our EHR, or one like it? Ask for the specific systems, not a general claim.

3. What happens when the EHR goes down at 8 a.m. on a Monday? Listen for a named process: who answers, how fast, and when they call the vendor.

4. Will you help with our risk analysis, or just the technology? A provider that only fixes computers leaves the documentation to you.

5. What does your monthly report show? Ask to see a sample.

6. How do you handle access when an employee leaves? The answer should be same-day, every time.

If you already have an IT person on staff, you do not have to replace them. A co-managed IT arrangement lets your person keep the EHR and the front desk running while an outside team carries monitoring, security, and the HIPAA documentation. Dental practices have their own set of systems to worry about (imaging sensors, practice management software), which we cover in our guide to dental office IT support.

Pricing for healthcare managed IT depends on the number of users and devices, whether the EHR is hosted locally or in the cloud, and how much of the compliance work the provider carries. A provider should scope it after looking at your practice, not quote it on the first call. Request an IT assessment for pricing that fits your setup.

How did the Grove City practice close its gaps?

The family medicine office started with an assessment. It found what assessments at independent practices usually find. Three people shared one front desk login. Two laptops that went home with providers were not encrypted. The backup ran every night but had never been restored, and when it was tested, the most recent good copy was eleven days old. There was no BAA with the old IT company, and the last risk analysis was a template filled out in 2019.

Over the next sixty days, every staff member got their own login with multi-factor authentication, both laptops were encrypted, a cellular backup was added to the internet line so the cloud EHR would stay reachable, and the backups were fixed and tested monthly. The practice manager was named the security official in writing, with the outside provider carrying the technical work under a signed BAA. A new risk analysis was completed and scheduled for annual review.

When the insurance renewal came around the next year, the practice manager answered the security questions in an afternoon instead of a week.

MCR Business Tech Solutions provides managed IT services for medical practices, physical therapy and specialty clinics, behavioral health offices, and dental practices across Mercer, Lawrence, Butler, Crawford, Erie, and Allegheny counties in Western Pennsylvania, and Trumbull and Mahoning counties in eastern Ohio. Whether you need full managed IT support or a partner for the IT person you already have, call 833-859-9021 or Request an IT assessment through our contact page. We will start by finding out where patient data lives in your practice and who is responsible for protecting it.