Running a medical office, clinic, or any healthcare operation today means walking a compliance tightrope every single day. Most providers understand that HIPAA protects patient data, but far fewer understand how deeply those rules reach into their technology infrastructure, and what that means for the IT company they trust with their systems. For the 14th consecutive year, healthcare leads all industries in data breach costs, with the average incident now costing $7.42 million. That number alone should make any practice manager sit up straight. The right IT partner is either your strongest line of defense or a hidden liability. Understanding how HIPAA compliance requirements apply to your IT provider is the first step to knowing which one you have.
Key Takeaways
- Your IT provider is legally classified as a Business Associate: If your IT company creates, receives, maintains, or transmits patient information for your practice, it is a HIPAA business associate, and you need a signed Business Associate Agreement before it touches that data. That usually includes a managed IT provider, because it runs the servers, backups, and email where PHI lives.
- Three safeguard categories apply to IT systems: HIPAA compliance for IT covers administrative safeguards (risk analysis, role-based access, training, vendor oversight, and incident response), physical safeguards (facility access, workstation security, and device controls), and technical safeguards (authentication, encryption, audit logging, integrity controls, and transmission security). Your IT provider must address all three, not just the technical layer.
- A signed BAA is the floor, not the ceiling: HIPAA-compliant IT services require encryption of PHI at rest and in transit, audit logging of all PHI access, access controls limiting PHI to authorized users, a signed Business Associate Agreement, documented risk assessments, and an incident response and breach notification plan. Operating without a signed BAA from your IT provider violates HIPAA, even if no breach occurs.
- Enforcement is real and growing: OCR closed 2025 with 21 HIPAA settlements and civil monetary penalties, the second-highest annual total on record, totaling roughly $6.6 million. If your IT setup has gaps, regulators will find them.
- Proposed 2025 rule changes signal where compliance is heading: The HHS NPRM published January 6, 2025, would remove the “addressable” designation that let organizations treat safeguards as flexible, making encryption of ePHI at rest and in transit mandatory, requiring multi-factor authentication for systems that access ePHI, and adding operational requirements including annual penetration testing, twice-yearly vulnerability scans, a 72-hour restoration standard, and written annual verification of safeguards from business associates. Smart practices are getting ahead of this now.
Quick-Start Prioritization Framework
| IT Service Area | Best For | Effort Level | Time to Results |
|---|---|---|---|
| Business Associate Agreement | All practices, immediately | Low | Same week |
| Multi-factor authentication (MFA) | Any practice with EHR or remote access | Low-Medium | Days to weeks |
| Encryption (at rest and in transit) | All practices handling ePHI | Medium | Weeks |
| Annual HIPAA risk assessment | All covered entities | Medium | 30-60 days |
| Audit logging and monitoring | Growing practices with larger teams | Medium-High | Weeks |
| Disaster recovery and tested backup | All practices (especially post-ransomware) | High | 1-3 months |
Start here if you’re:
- A small practice with a general IT provider: Get a signed BAA in place first, then confirm encryption and MFA; these are your highest-risk exposure points.
- A mid-size clinic with an existing MSP: Audit whether your current provider performs and documents annual HIPAA security risk assessments and actively manages your audit logging.
- A growing multi-location organization: Focus on role-based access controls, a full BAA chain that covers all downstream vendors, and real-time monitoring that scales with your footprint.
What Makes an IT Provider a HIPAA Business Associate
This is the piece that catches most practices off guard. The moment your IT company can access, store, or transmit patient data, HIPAA classifies it as a Business Associate, and that classification comes with specific legal obligations.
The Business Associate Agreement Requirement
A HIPAA Business Associate Agreement is a legally required contract between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on their behalf. The BAA must specify permitted uses, security requirements, breach notification obligations, and termination conditions. This is not optional paperwork. The HITECH Act and 2013 Omnibus Rule made business associates directly liable for HIPAA violations with penalties up to $2.13 million per violation. So before your IT provider remotely accesses a single server that touches patient records, you must sign the BAA.
Pro Tip: Ask any existing IT provider to produce the signed BAA immediately. If they cannot locate it or have never signed one, that is a compliance violation in progress, regardless of whether a breach has occurred. Address it before your next audit or incident.
What the BAA Must Actually Cover
A well-constructed BAA goes well beyond a simple signature. It must define exactly how PHI may be used and under what conditions it may be shared, require administrative, physical, and technical safeguards aligned with HIPAA Security Rule standards, specify timelines and procedures for notifying the covered entity of a potential or confirmed breach, and ensure any downstream vendors who access PHI also sign BAAs and follow HIPAA standards.
That last point, the downstream vendor chain, is frequently overlooked. To verify subcontractor HIPAA compliance, ask the managed IT provider to show the full Business Associate Agreement chain, including all downstream vendors; provide the subcontractor list identifying which services each delivers; and confirm written annual verification under the proposed 2026 HIPAA rule.
The Three Safeguard Categories Your IT Provider Must Address
HIPAA-compliant IT services must address all three safeguard categories. Services that address only technical controls while leaving administrative and physical safeguards unaddressed do not provide HIPAA-compliant coverage, no matter how sophisticated the technical controls are. Many general IT providers focus exclusively on the technical layer and leave significant compliance gaps.
Administrative Safeguards
Administrative safeguards are the policies, procedures, and management processes that govern how ePHI is handled inside your organization, and your IT provider plays a direct role in supporting them.
OCR audit data reveals that only 14% of covered entities and 17% of business associates substantially fulfill HIPAA’s risk assessment requirement, making it one of the most frequently cited violations in federal enforcement actions. That means your IT provider must not just perform a risk assessment, but produce documented proof of one. Every healthcare organization that creates, receives, maintains, or transmits PHI must conduct a HIPAA risk assessment, and it must be thorough, documented, and updated regularly. If your IT provider cannot show you a completed, dated risk assessment with your name on it, demand one immediately or find a provider who will deliver it.
By the end of May 2025, OCR had announced 10 additional financial penalties tied specifically to its Risk Analysis Initiative, launched in late 2024 to target organizations that had never completed a required security risk assessment. This enforcement push shows regulators are actively hunting for this gap.
Physical Safeguards
Physical safeguards govern where ePHI lives and who can physically reach it, including the servers, devices, and facilities managed by your IT provider. HIPAA-compliant IT services include workstation configurations that enforce automatic screen locks, prevent unauthorized physical access, and implement appropriate session timeout policies.
If your provider hosts your data in a data center or cloud environment, their physical security controls must meet HIPAA’s requirements. For practices using managed hosting or cloud services, the provider’s data center physical security controls must meet this requirement. For on-premises systems, the practice must document its facility security procedures, and the IT provider should advise on their adequacy.
Technical Safeguards
HIPAA technical safeguards are the technology controls the HIPAA Security Rule requires to protect electronic protected health information (ePHI). They are set out in 45 CFR 164.312 as five standards: access control, audit controls, integrity, person or entity authentication, and transmission security.
In practice, this means your IT provider should deliver and manage each of these capabilities as part of their standard service, not as optional add-ons.
The Non-Negotiable Technical Controls
Encryption: At Rest and In Transit
HIPAA-compliant IT services must encrypt ePHI in transit using current encryption standards, since unencrypted email containing ePHI is a common source of HIPAA violations. The encryption requirement applies in both directions. HIPAA says organizations must implement a mechanism to encrypt and decrypt electronic protected health information. This includes encryption for data “at rest” (such as data on your servers) and “in transit” (such as data shared back and forth with another device, like a patient’s computer or smartphone).
Your email system must use TLS encryption for messages containing ePHI, and any cloud services, including EHR, billing, and file storage, must encrypt data both in transit and at rest. Unencrypted email containing patient information is a reportable breach under HIPAA’s Breach Notification Rule. If your IT provider has set up email without encryption, your next patient email could be a reportable breach.
Multi-Factor Authentication
HIPAA-compliant IT services implement MFA on practice management systems, EHR systems, email systems, remote access, and any other system that contains or accesses ePHI. A password alone is no longer defensible. In January 2025, HHS’s Office for Civil Rights published a Notice of Proposed Rulemaking that would meaningfully tighten the HIPAA Security Rule, most notably by converting several currently “addressable” safeguards, including multi-factor authentication and encryption of ePHI at rest and in transit, into requirements with no flexibility clause.
The rule is still proposed, but the direction is unambiguous. The proposed HIPAA Security Rule clearly signals where healthcare cybersecurity expectations are heading: MFA, encryption, a real inventory, tested recovery, regular testing, and documentation. Get ahead of it now.
Pro Tip: Ask your IT provider which specific systems currently have MFA enforced. Request a written list. Any system that touches ePHI and appears on that list without MFA is a risk you can quantify and fix today.
Audit Logging and Access Controls
The HIPAA Security Rule’s Audit Controls standard (45 C.F.R. § 164.312(b)) requires covered entities and business associates to implement mechanisms that record and examine activity in systems containing ePHI. These are not soft requirements; OCR enforcement actions regularly cite incomplete or absent audit logging as a Security Rule violation.
HIPAA-compliant IT services must implement unique user identification so that every person accessing ePHI can be identified and their activity tracked, since shared credentials that cannot be attributed to a specific individual are not compliant. Therefore, if your practice uses any shared logins, even for convenience, your IT provider must help you transition away from that practice immediately.
Disaster Recovery and Tested Backup
A disaster recovery plan covers how your organization will restore systems and data after a ransomware attack, hardware failure, or natural disaster. HIPAA specifically requires a documented recovery plan for ePHI. Note the word “documented”; an untested, undocumented backup plan does not meet the standard.
Ransomware attacks hit 67% of healthcare organizations in 2024, nearly double the rate from 2021. Therefore, you must test disaster recovery at least annually and document the results in writing. Ask your IT provider when the last restoration test was performed and to show you the results.
Common Mistakes That Lead to Enforcement Actions
In my experience working through HIPAA compliance scenarios, the failures that draw OCR attention are rarely dramatic; they are often process gaps that accumulated quietly over time.
Assuming Your IT Provider Is Already Compliant
No government-issued HIPAA certification exists for IT providers. Any provider claiming to be “HIPAA certified” is using a marketing term, not a regulatory status. The only way to know whether your provider meets requirements is to verify, through documentation, not conversation.
Your IT provider should actively support your compliance efforts, not just claim they’re “HIPAA compliant.” This means helping you conduct annual HIPAA security risk assessments that document where patient data flows through your systems and identifying vulnerabilities with clear remediation plans.
Pro Tip: Request the following documents from your IT provider: the signed BAA, the most recent HIPAA security risk assessment, your audit log retention policy, and evidence that your last backup was successfully restored. If any of these cannot be produced within 48 hours, that is a compliance gap.
Leaving Security to Reactive Support
HIPAA-compliant IT services include documented patch management procedures with defined patch-application timelines and evidence that patches are applied as scheduled. A provider that patches only when something breaks leaves known vulnerabilities open for weeks or months. Attackers exploit that gap.
Practices often discover their IT provider was reactive, not proactive, only after an incident occurs. The right provider monitors continuously and patches on a defined schedule, not on demand.
Overlooking Workforce Training Documentation
HIPAA requires documented security awareness training for all staff who handle PHI. Your IT provider should not only configure your systems but also support training programs that ensure staff use those systems correctly. Staff who share passwords, ignore phishing warnings, or bypass authentication steps undermine every technical control an organization has deployed.
How to Evaluate Whether Your IT Provider Is HIPAA Ready
Questions to Ask Before or During Your Next Review
The evaluation process should be direct and document-focused. Ask your provider how they conduct HIPAA Security Risk Assessments and what the deliverable actually looks like. A HIPAA Security Risk Assessment is an explicit regulatory requirement under 45 CFR Section 164.308(a)(1), not a differentiating service. Ask to see a sample deliverable from a comparable client.
Beyond the risk assessment, ask about:
- Whether they will sign a BAA today and provide a copy for your records
- Which encryption standards they use for data at rest and in transit
- Whether MFA is enforced across all systems that touch patient data
- How they handle breach notification timelines under HIPAA’s 60-day rule
- What their patch management schedule looks like and how they document it
- Whether they can produce audit logs on request in a format usable in an OCR investigation
A HIPAA-compliant IT provider covers the specific regulatory requirements of the HIPAA Security Rule: security risk assessments, Business Associate Agreements, encryption, audit logging, access controls, staff training support, and documented disaster recovery. A general IT provider covers none of that by default.
Providers like Datacate, Inc. build HIPAA-aligned IT practices into their core service model for healthcare clients, meaning the compliance framework is part of the engagement from day one, not a retrofit you have to fight for after the fact.
Frequently Asked Questions
Does my IT provider need to sign a HIPAA Business Associate Agreement?
If your IT company creates, receives, maintains, or transmits patient information for your practice, it is a HIPAA business associate, and you need a business associate agreement for HIPAA compliance before it touches that data. This applies to managed IT providers, cloud hosting companies, and any technology vendor whose services bring them into contact with patient records. You must sign the BAA before work begins, and you must keep it in your files for at least six years.
What happens if my IT provider has a data breach involving patient data?
The Breach Notification Rule requires covered entities and business associates to notify affected individuals and HHS when unsecured PHI is compromised. Notice must occur without unreasonable delay and no later than 60 days after discovery. Your BAA should specify the exact notification timeline your IT provider must follow when informing you of a suspected or confirmed breach. Breaches involving 500 or more individuals must also be reported to the media, while smaller breaches are recorded and submitted annually.
Is encryption actually required under HIPAA right now?
Under the current HIPAA Security Rule, encryption is classified as “addressable”, meaning organizations can choose an equivalent alternative if they document their reasoning. However, the proposed amendments would end the long-standing distinction between “required” and “addressable” implementation specifications, mandate encryption of ePHI at rest and in transit, require multi-factor authentication on all systems accessing ePHI, and impose semi-annual vulnerability scanning and annual penetration testing. The practical guidance: implement encryption now. The regulatory direction is clear, and the risk of inaction is already significant.
How often does my practice need a HIPAA security risk assessment?
Reassess whenever significant changes occur, new technology is deployed, the organization restructures, or a security incident occurs, and most organizations schedule a formal review at least annually. A HIPAA risk assessment is not a one-time exercise; it must be reviewed and updated periodically, and whenever significant operational or environmental changes occur. Your IT provider should drive this schedule, not wait for you to ask.
What are the penalties if my practice is found non-compliant?
HIPAA penalty tiers in 2025 range from a minimum of $141 for unknowing violations up to $2,134,831 per violation for willful neglect that is not corrected within 30 days. Those figures apply per violation, not per incident. OCR has fined solo dental practices as low as $25,000 for HIPAA violations. The Manasa Health Center paid $30,000 in 2024. Small practices are not exempt; enforcement reaches every size of covered entity.
The Bottom Line
HIPAA compliance requirements reach directly into your IT infrastructure, your vendor contracts, and your daily technology operations. A general IT provider unfamiliar with healthcare regulations is not a neutral choice; it’s an active liability. Your IT partner must sign a BAA, deliver documented risk assessments, enforce encryption and MFA, maintain audit logs, and stand ready to support breach notification procedures if the worst happens.
The good news is that finding a partner who genuinely understands these requirements is straightforward once you know what to ask. Start with the BAA, verify the risk assessment, and work through the technical safeguard checklist. Datacate, Inc. works with healthcare organizations to make HIPAA-aligned IT a built-in feature of their technology environment, not a compliance exercise that happens once a year and then sits in a drawer.
Sources
- IBM Cost of a Data Breach Report 2025, Healthcare Sector Data, Deepstrike/IBM. Average healthcare breach cost and industry rankings. https://deepstrike.io/blog/healthcare-data-breaches-2025-statistics
- HIPAA Compliant IT Services for Medical Practices, Mind-Core. Technical safeguard requirements for IT providers serving healthcare. https://mind-core.com/blogs/hipaa-compliant-it-services-medical-practices/
- HIPAA Compliance for IT Professionals: 2026 Playbook, Digacore. Administrative, physical, and technical safeguard breakdown. https://digacore.com/blog/hipaa-compliance-for-it-professionals/
- What Are HIPAA Compliance Requirements for IT Providers?, Abacus Technology. IT provider Security Rule obligations. https://abacustechnology.com/resources/hipaa-compliance/
- HIPAA Business Associate Agreement for IT Compliance, NetSys Group. BAA requirements for IT companies. https://www.netsysgroup.com/blog/hipaa-business-associate-agreement-it-provider
- HIPAA Compliance Requirements: 2025 Security Rule Changes, Kiteworks. Risk assessment and proposed amendments. https://www.kiteworks.com/hipaa-compliance/hipaa-compliance-requirements/
- HIPAA Security Rule NPRM: Encryption, MFA, and the End of Addressable, Safeguard.sh. Proposed mandatory encryption and MFA details. https://safeguard.sh/resources/blog/hipaa-security-rule-2025-nprm
- HIPAA Fines Statistics: Real Penalties and Cases 2026, FaxSIPit. OCR enforcement actions by year and penalty size. https://www.faxsipit.com/blogs/hipaa-fines-statistics
- 21 HIPAA Settlements in 2025, PrivacyTerms.io. OCR settlement totals and Risk Analysis Initiative details. https://privacyterms.io/hipaa-violation-statistics-2026
- HIPAA Enforcement in 2025, MedSafe. Penalty tiers and 2025 civil monetary penalty schedule. https://medsafe.com/hipaa-compliance/hipaa-enforcement/
- HIPAA Risk Assessment Guide for Healthcare Organizations, Cybriant. OCR audit data on risk assessment fulfillment rates. https://cybriant.com/feeds/blog/hipaa-risk-assessment
- Essential Managed IT Support Checklist for Healthcare Practices, Medical ITG. Active compliance support versus passive compliance. https://medicalitg.com/hipaa-compliance/essential-managed-it-support-checklist-for-healthcare-practices-1-5/
- Healthcare Cybersecurity Statistics for 2026, SwifAI/Faxsipit. Ransomware rate in healthcare and breach frequency. https://www.faxsipit.com/blogs/healthcare-cybersecurity-statistics
- Proposed HIPAA Security Rule Update: Mandatory MFA and Encryption, MyWorkDrive. NPRM details on MFA and encryption mandates. https://www.myworkdrive.com/blog/hipaa-security-rule-update
- HIPAA Compliant IT Services: What Businesses Need to Know, LesOlson. Technical safeguard requirements and disaster recovery. https://lesolson.com/blog/hipaa-compliance-guide-for-it-professionals-2024/
