# Healthcare practices

Medical, dental, and behavioral health practices: EHR access that does not stall a waiting room, and the HIPAA Security Rule controls with evidence to show for them.

## The problems we hear first

- The EHR is slow or down and the waiting room fills while someone calls the vendor.
- HIPAA requires a security risk analysis and nobody can find the last one.
- Front-desk staff share logins because adding a user to the EHR is a vendor ticket.
- Laptops with patient data leave the building in staff bags and nobody tracks them.

## What we typically deploy

- **Security risk analysis & evidence.** The risk analysis the HIPAA Security Rule requires, with the policies, access reviews, and audit logs to back it up at an audit or an insurance renewal.
- **Endpoint & identity controls.** EDR on every workstation, full-disk encryption on anything portable, MFA on email and the EHR, and accounts closed the day someone leaves.
- **Backup & recovery for clinical systems.** Encrypted on-site and off-site copies with restores tested on a schedule, and a recovery time for the EHR agreed in writing.
- **Network, Wi-Fi & cameras for the suite.** Clinical devices on their own network segment, patient Wi-Fi kept off it, and cameras and door access for the suite, the records room, and medication storage.

## Where clients here usually start

Usually a security risk analysis first, because HIPAA asks for one and most practices have never had it done. Lead service: [Managed IT & Cybersecurity](https://lnxinc.com/services/managed-it/).

## Common questions

**Will you sign a business associate agreement?** Yes. HIPAA requires one from any vendor that may touch patient data, so a business associate agreement is signed alongside the managed agreement. It sets out what we protect and what we do if there is an incident, and your counsel can review it before signing.

**Does managed IT make us HIPAA compliant?** No vendor can make you compliant. The Security Rule asks for a risk analysis, access controls, audit logs, encryption, backup, and workforce training. We put those controls in place and keep the evidence; your compliance officer or counsel owns the program.

**Can you work with our EHR vendor?** Yes. We manage the workstations, network, and accounts the EHR runs on, and we work the vendor's ticket with you so your office manager is not relaying messages between two support desks.

Contact: https://lnxinc.com/contact/ or 833-569-5690.