HIPAA Compliant Managed IT Services: What They Should Mean

Some IT providers advertise HIPAA compliant managed IT services. The phrase sounds reassuring, but it can hide a misunderstanding that leaves a practice exposed. No IT provider can make a medical practice compliant on the practice's behalf. What a provider can do is put the right safeguards in place, operate them reliably, sign the right agreement and give the practice the evidence it needs. This guide explains what that should look like.

This article is general information, not legal advice. Practices should rely on their privacy or compliance lead and qualified counsel for decisions about their obligations.

Key Takeaways

• No HHS-approved certification proves an IT provider is HIPAA compliant, so ask which safeguards it operates and what evidence it produces.
• An IT provider that can reach patient information is generally a business associate and should sign a business associate agreement before it receives access.
• The risk analysis belongs to the practice; the provider supplies technical assessments and evidence that feed into it.
• Write down who owns each responsibility among the practice, the IT provider and each software vendor before the relationship begins.

There is no official HIPAA certification for IT providers

There is no certification standard approved by the U.S. Department of Health and Human Services (HHS) that demonstrates a business associate's HIPAA compliance, as Microsoft's HIPAA compliance documentation notes. Some providers hold third-party assessments or attestations, which can be useful evidence, but they do not transfer the practice's obligations to the provider. When a provider says it is "HIPAA compliant," ask what that means in practice: which safeguards it operates, what it documents and whether it will sign a business associate agreement.

Business associate agreements for HIPAA compliant managed IT services

Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on a covered entity's behalf is a business associate. An IT provider that manages servers, backups, email or workstations containing patient information usually falls into that category. The practice should have a signed business associate agreement before the provider receives access. The agreement sets out how the provider safeguards the information, how quickly it reports incidents and what happens to data when the relationship ends. Read the incident reporting terms closely, because a slow report from a vendor leaves the practice less time to meet its own obligations.

Ask about subcontractors too. If the provider stores backups with a third-party data center or uses other vendors that can reach patient information, those relationships need their own agreements. A good provider will tell you who is downstream without being pushed. And remember what a business associate agreement does not do: it allocates responsibility between two parties, but it does not make either of them compliant.

The Security Rule safeguards IT supports

The HIPAA Security Rule organizes most of its requirements into administrative, physical and technical safeguards. A managed IT provider supports parts of each.

Administrative safeguards

These cover risk analysis and risk management, workforce security training, access management processes and contingency planning. The provider supplies technical input and evidence. The practice owns the policies and decisions.

Physical safeguards

These cover control over facility access, workstation use and security, and the handling and disposal of devices and media. The provider can manage device inventories, encryption and secure disposal records.

Technical safeguards

These cover unique user accounts, automatic logoff, encryption, audit logging and protection of data in transit. Much of the provider's day-to-day work supports them, through multi-factor authentication, encryption management, log collection and monitoring.

The risk analysis belongs to the practice

The Security Rule requires covered entities to conduct an accurate and thorough risk analysis and to manage the risks it identifies. An IT provider can perform technical assessments that feed into it, such as a cybersecurity risk assessment, but the practice is responsible for completing the analysis, deciding how to treat each risk and keeping the documentation.

The analysis also needs revisiting when the practice changes: a new location, a telehealth platform, a new EHR, a change in who holds administrator access or the acquisition of another practice. An assessment that produces findings but no remediation plan leaves the practice with documented problems it has not fixed, so ask how any provider supports the follow-through.

A shared responsibility list

Write down who owns each responsibility before the relationship begins. A simple list might look like this:

Adjust the list to your agreements. The point is that nothing important is left unowned.

Evidence your IT provider should be able to produce

• A current inventory of devices and systems that store or access patient information.
• Records of user access changes, including removals.
• Patch and update status reports.
• Backup job results and restore test records.
• Security monitoring summaries and incident records.
• Encryption status for laptops and portable media.
• Training completion records for security awareness programs.
• Change records for firewall rules, new accounts and configuration changes.
• The signed business associate agreement and a current list of subcontractors.

Our article on what HIPAA, NIST and ISO 27001 require for patching covers the patching evidence in more detail.

Questions to ask about HIPAA compliant managed IT services

• Will you sign our business associate agreement before receiving access?
• Which safeguards do you operate, and which remain our responsibility?
• What evidence will you provide, and how often?
• How do you handle a suspected incident involving patient information?
• How do you manage clinical devices and vendor remote access?
• What do you not cover?
• How do you evaluate new tools staff want to use, such as AI assistants, online fax services or messaging apps, before they touch patient information?
• Can we see a redacted sample of your regular reports?

Inzo provides network infrastructure, cybersecurity, backup and recovery and managed support for healthcare organizations from our headquarters in Chesterfield. Learn more on our healthcare technology page, or book an Insight Session.

Frequently asked questions

Is there such a thing as a HIPAA-certified IT provider?

No. HHS has not approved any certification standard that demonstrates a business associate's HIPAA compliance. Look instead for a signed business associate agreement, clearly defined safeguards and regular evidence that they operate.

Does our IT provider need to sign a business associate agreement?

If the provider can access protected health information while managing your systems, it is generally a business associate and should sign one. Confirm with your compliance lead or counsel.

Who is responsible for the HIPAA risk analysis?

The covered entity, meaning the practice, is responsible. An IT provider can supply technical assessments and evidence that feed into it.

Can staff use ordinary business email for patient information?

Use an email service configured with appropriate safeguards whose provider has signed a business associate agreement with the practice. Confirm the agreement exists before staff send patient information, and apply the same review to fax and messaging services.

What does healthcare compliance IT support include?

It typically includes operating technical safeguards such as access control, encryption, patching, monitoring and backup, plus producing the documentation a practice needs for its own risk analysis and audits.