Managed IT lead
Healthcare practices
Medical, dental, and behavioral health practices: EHR access that does not stall a waiting room, and the HIPAA Security Rule controls with evidence to show for them.
What usually comes up
The problems we hear first.
- The EHR is slow or down and the waiting room fills while someone calls the vendor.
- HIPAA requires a security risk analysis and nobody can find the last one.
- Front-desk staff share logins because adding a user to the EHR is a vendor ticket.
- Laptops with patient data leave the building in staff bags and nobody tracks them.
What we typically deploy
A stack that fits the building.
We describe capabilities rather than name the specific products in client environments. Happy to walk through the detail under NDA.
Security risk analysis & evidence
The risk analysis the HIPAA Security Rule requires, with the policies, access reviews, and audit logs to back it up at an audit or an insurance renewal.
Endpoint & identity controls
EDR on every workstation, full-disk encryption on anything portable, MFA on email and the EHR, and accounts closed the day someone leaves.
Backup & recovery for clinical systems
Encrypted on-site and off-site copies with restores tested on a schedule, and a recovery time for the EHR agreed in writing.
Network, Wi-Fi & cameras for the suite
Clinical devices on their own network segment, patient Wi-Fi kept off it, and cameras and door access for the suite, the records room, and medication storage.
Where clients here usually start
Usually a security risk analysis first, because HIPAA asks for one and most practices have never had it done.
Will you sign a business associate agreement?
Yes. HIPAA requires one from any vendor that may touch patient data, so a business associate agreement is signed alongside the managed agreement. It sets out what we protect and what we do if there is an incident, and your counsel can review it before signing.
Does managed IT make us HIPAA compliant?
No vendor can make you compliant. The Security Rule asks for a risk analysis, access controls, audit logs, encryption, backup, and workforce training. We put those controls in place and keep the evidence; your compliance officer or counsel owns the program.
Can you work with our EHR vendor?
Yes. We manage the workstations, network, and accounts the EHR runs on, and we work the vendor's ticket with you so your office manager is not relaying messages between two support desks.
Tell us what's in front of you.
A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.