Healthcare organizations face a unique problem when it comes to managed IT: the stakes are higher, the regulatory landscape is more complex, and the consequences of getting it wrong are severe. HIPAA violations can result in fines ranging from $100 to $50,000 per violation, with annual penalties reaching $1.9 million per violation category. Beyond the financial exposure, a data breach involving protected health information (PHI) damages patient trust in ways that are difficult to quantify and nearly impossible to repair.
The challenge is that many managed IT providers claim HIPAA expertise they don't actually have. They'll sign a Business Associate Agreement (BAA) willingly — because it costs them nothing upfront — without having built the security controls, documentation practices, and incident response procedures that genuine HIPAA compliance requires.
This article explains what HIPAA actually demands from a technical infrastructure perspective, what your managed IT provider should be doing, and how to tell the difference between genuine compliance and compliance theater.
What HIPAA Actually Requires
HIPAA's Security Rule establishes national standards for protecting electronic protected health information (ePHI). It's organized around three categories of safeguards:
Policies and procedures governing who can access PHI, how workforce members are trained, how security incidents are managed, how business associates are vetted, and how contingency plans are maintained. Your IT provider should be contributing to and maintaining this documentation — not leaving it entirely to your internal team.
Controls over the physical systems that store or process ePHI — server room access, workstation security, mobile device policies, and disposal procedures for hardware containing PHI. In a cloud-managed environment, your provider should be ensuring that the physical infrastructure (whether at a data center or in your offices) meets these requirements.
The specific technology controls that protect ePHI: access controls, audit logging, transmission security (encryption), and automatic logoff. These are the areas where your managed IT provider has the most direct responsibility — and where the gaps are most commonly found.
The Business Associate Agreement: Necessary but Not Sufficient
Any managed IT provider that accesses, stores, or transmits your ePHI is a Business Associate under HIPAA and is legally required to sign a BAA. This is table stakes — not a demonstration of compliance readiness.
The BAA creates legal accountability, but it does not ensure that the provider's delivery actually meets HIPAA's technical requirements. Signing a BAA and then managing your environment with inadequate security controls, no audit logging, and no incident response procedure is a compliance failure regardless of what the contract says.
When a business associate experiences a breach involving your patients' PHI, your organization still bears exposure. The BAA matters — but it doesn't transfer your risk. Your provider's security posture is effectively your security posture.
What a HIPAA-Compliant IT Environment Looks Like
Across years of managing IT for healthcare organizations — from single-office physician practices to multi-site medical groups — here's what we consistently see distinguishes genuinely compliant environments from those with gaps:
Access Controls and Identity Management
Every user should have a unique identifier — shared credentials are a HIPAA violation. Access to ePHI should be role-based, meaning staff can access only the PHI necessary for their specific function. Multi-factor authentication should be enforced across all systems that touch ePHI, including email, EHR systems, and remote access. Privileged access should be tightly controlled and reviewed regularly.
Encryption at Rest and in Transit
All ePHI stored on workstations, servers, mobile devices, and cloud storage should be encrypted. Data transmitted over networks — including email containing patient information — should be encrypted in transit. Many small practices still send unencrypted PHI over standard email, which is a clear HIPAA violation. Your IT provider should have policies and tooling in place to enforce encryption across all channels.
Comprehensive Audit Logging
HIPAA requires audit controls — mechanisms that record and examine activity in systems that contain ePHI. This means logging who accessed what data, when, and from where. Logs should be retained for a minimum of six years and reviewed regularly for anomalous activity. Many organizations have logging enabled but no one actively reviewing the logs — which is compliance theater, not compliance.
Patch Management and Vulnerability Management
Unpatched systems are one of the leading causes of healthcare data breaches. Your managed IT provider should have a documented patch management program with defined timelines for applying critical security patches — typically within 30 days for high-severity vulnerabilities, faster for actively exploited ones. Vulnerability scans should be conducted regularly, with findings tracked to remediation.
Endpoint Security and Mobile Device Management
Endpoint detection and response (EDR) should be deployed on every device that could access ePHI — workstations, laptops, and servers. Mobile devices should be enrolled in an MDM platform with enforced encryption, PIN requirements, and remote wipe capability. Bring-your-own-device (BYOD) policies should be formal and enforced, not assumed.
Backup and Disaster Recovery
HIPAA's contingency planning requirements mandate that covered entities have data backup, disaster recovery, and emergency mode operation plans. Your backup solution should encrypt data at rest, store copies offsite or in the cloud, and be tested regularly. "Regularly" means at least quarterly restore testing — not an assumption that backups are working because no error alerts have appeared.
Security Awareness Training
Human error remains the leading cause of healthcare data breaches. HIPAA requires periodic security awareness training for all workforce members with access to ePHI. Phishing simulations — where staff receive realistic but fake phishing emails and their responses are tracked — are one of the most effective ways to measure and improve real-world security behavior. Your IT provider should be running these, not just providing an annual training video.
The Incident Response Requirement
HIPAA requires covered entities to have a written incident response plan — procedures for identifying, responding to, and mitigating the effects of a security incident involving ePHI. This plan should define what constitutes a breach, how it is contained, how affected individuals are notified, and how the incident is documented for regulatory purposes.
Under HITECH, healthcare organizations must notify affected individuals within 60 days of discovering a breach involving 500 or more individuals, and must report to HHS. Breaches affecting 500 or more individuals in a single state must also be reported to prominent media in that state.
Your IT provider should have a defined role in your incident response procedure — and should have rehearsed it, not just documented it.
Questions to Ask Your Current or Prospective IT Provider
- Do you have healthcare clients, and can you provide references from organizations of similar size and complexity?
- Are you willing to sign a Business Associate Agreement, and can I review your standard BAA before we engage?
- How do you document the security controls in my environment for compliance and audit purposes?
- What is your patch management SLA for critical security vulnerabilities?
- Do you perform regular vulnerability assessments on our environment? How often, and what happens with the findings?
- What is your procedure if you discover or suspect a breach involving ePHI?
- Do you provide security awareness training and phishing simulations as part of your managed service?
A provider who answers these questions with specifics and confidence is one who has thought carefully about HIPAA as an operational discipline, not just a contract requirement. A provider who is vague, defers the questions to "our compliance team," or suggests HIPAA compliance is primarily your responsibility as the covered entity does not have the operational depth healthcare organizations require.
HIPAA compliance is not something that happens once during onboarding and then runs on autopilot. It requires ongoing management — access reviews, patch cycles, training campaigns, audit log monitoring, and regular testing of your backup and recovery procedures. The managed IT provider you choose is either doing this work systematically or they're not. There is no in-between.
Managing a Healthcare IT Environment? Let's Talk.
Plexus has managed IT for healthcare organizations — from physician practices to multi-site medical groups — for over two decades. HIPAA-aligned infrastructure, security, and compliance documentation are core parts of how we work, not add-ons. Schedule a complimentary discovery session to discuss your environment.
Schedule Free Discovery