HIPAA-Compliant IT Services for Healthcare Practices: A Complete Guide

Nobody sells HIPAA compliance. No software package, server or IT contract can make a practice compliant, because HIPAA does not certify products at all. The law regulates how your organization treats protected health information day after day, and that behavior runs through your people and your processes as much as your technology.

What you can buy, or build, is an IT foundation that makes compliance achievable, documented and defensible. That foundation is where most practices come up short. The cause is rarely carelessness with patients. It is growth: the practice added staff, locations and systems over the years, and nobody ever lined up what HIPAA requires against what the IT environment actually does.

This guide lines them up. It is written for practice owners, administrators and office managers rather than IT staff, and it walks the whole territory: the rules themselves, the risk assessment you are legally required to perform, vendor agreements, secure email and texting, the systems behind your EHR and telehealth visits, the true cost of a violation, and staying ready for the day a regulator or auditor asks for documentation.

Three rules do the work together:

• The Privacy Rule sets who may see and share protected health information (PHI), and for what purposes.
• The Security Rule applies to electronic PHI (ePHI) in particular. Nearly every IT obligation a practice has lives here.
• The Breach Notification Rule spells out what you must do, and on what timeline, when PHI is exposed.

The Security Rule sorts its requirements into three groups of safeguards. If one framework from this guide sticks, let it be this one:

• Administrative safeguards (policies, people and process): risk assessments, workforce training, a sanctions policy for violations, procedures for granting and removing access, and a named security officer.
• Physical safeguards (places and devices): a locked server closet, screens turned away from public view, rules for workstations, and secure disposal of retired drives and copiers.
• Technical safeguards (the controls themselves): a unique login for every user, automatic logoff, encryption at rest and in transit, audit logging and access controls.

Look at what that list says. Two of the three categories have nothing to do with buying technology. A practice with excellent firewalls but no training program, no written policies and no risk assessment is not compliant. It is well equipped and undocumented. A provider that only ever talks about tools is addressing one third of the problem, and the other two thirds are where audits are decided. That gap is the reason our compliance support service exists.

One more distinction matters. Each Security Rule specification is labeled either required or addressable. Addressable is not a polite word for optional. It means you implement the specification, implement a reasonable equivalent, or write down a legitimate reason it does not apply to you. "We never got to it" is not an addressable decision; an investigator will record it as a finding. Expect this to tighten, too: HHS has proposed a Security Rule update that would make every specification required. It was still a proposal when this guide was written, with a final rule possible as soon as 2027, and the direction is clearly stricter.

The foundational HIPAA obligation is also one of the most frequently skipped: a documented security risk assessment (SRA). The Security Rule requires it in plain terms. It is the first document the Office for Civil Rights (OCR, the HHS office that enforces HIPAA) asks for in an investigation, and a missing or inadequate assessment shows up again and again in published enforcement actions.

A genuine SRA does five things:

1. Maps every location where ePHI is stored or travels: the EHR, email, texts, billing systems, laptops, phones, backup drives, and the fax-to-email service everyone forgot existed.
2. Names the threats and weaknesses facing each one, from ransomware to a stolen laptop to a former employee whose login was never shut off.
3. Rates how likely and how damaging each risk is, so priorities are honest rather than political.
4. Records the controls you have and the ones you are missing.
5. Produces a remediation plan with an owner and a date for each item, followed over time by evidence that the plan is being worked.

Practices tend to underrate that fifth point. Regulators see an assessment whose remediation plan was never acted on as worse than ignorance, because it is written proof that you knew about a problem and left it alone.

Run the assessment every year, and again whenever something material changes: a new EHR, a new location, a merger, or a move into telehealth. If your practice has never had one, it is the first project, ahead of any new tool purchase. The discipline is the same one behind a general IT assessment, viewed through a regulatory lens. When you are ready to do the work, our step-by-step SRA walkthrough supplies the inventory format, the rating grid and a checklist you can print.

Any vendor that creates, receives, stores or transmits PHI for you counts as a business associate. Before any PHI reaches one, federal law requires the two of you to sign a business associate agreement (BAA). Without that agreement you are out of compliance the moment data moves, however well that vendor protects it.

Go down your vendor list with that rule in mind and gaps surface quickly:

• Your IT provider. It holds administrative access to everything you run. An MSP that serves healthcare should sign a BAA without a second thought, and if a prospective provider stalls on it, the conversation is over. Talos signs BAAs with its healthcare clients. Our guide to HIPAA-compliant IT support for Houston medical practices covers more warning signs of this kind.
• Email and productivity suites. Microsoft 365 and Google Workspace will each sign a BAA, though only for qualifying plans and only after you accept the agreement and set the services up correctly. The plan your practice is on matters, and our Microsoft 365 vs. Google Workspace comparison gets into the licensing details.
• EHR and billing vendors. These are usually covered, but confirm that a signed BAA is actually on file rather than assumed to be buried in the terms of service.
• Backup, phones and VoIP, texting, transcription, shredding and cloud storage. This is the category practices forget. If voicemails, call recordings or text messages can contain patient details, the vendors behind them need BAAs as well.

Store every BAA in one place, know what each one requires the vendor to do, and review the whole list during the annual SRA. After a vendor breach, the first question anyone asks is whether a BAA existed and what it said. For the practice-manager version of this topic, including which vendors count, what the agreement does and does not do, and the warning signs buried in vendor paperwork, read our plain-English guide to business associate agreements.

Communication is where otherwise careful practices leak. The EHR can be locked down tightly, and then someone emails tomorrow's schedule, patient names included, to a personal Gmail account so they can work from home. That is a reportable incident.

For email, the baseline is encryption in transit and at rest, a signed BAA with the platform, access controls with MFA on every mailbox, and above all correct configuration. A Microsoft 365 tenant covered by a BAA is still not compliant as delivered. Encryption policies, data loss prevention rules and retention settings all have to be set up on purpose. An IT partner that works in healthcare every day handles this routinely, and one that does not often misses it entirely. We go much deeper, with a three-part qualifying test, the quiet ways email fails and a configuration checklist, in what actually makes email HIPAA compliant.

Texting needs separate attention. It is the channel patients like best and the one small practices most often get wrong. Standard SMS is unencrypted, and staff texting PHI from their own phones is one of the most common violations in smaller offices. Consent rules and platform choices are a subject of their own, and Talk Is Cheap covers them thoroughly in its guide to HIPAA-compliant communications, with detail on choosing an acceptable texting platform and recording patient consent. For this guide, the rule is short: never send PHI over standard SMS, use a platform that encrypts messages and signs a BAA, and write the policy down so the expectation is documented rather than assumed.

Phone systems belong in the same conversation. A modern VoIP platform stores voicemails and call recordings as data files, so if those can include PHI, the phone provider needs a BAA and a careful configuration like any other system. Our business phone systems team handles that setup for healthcare clients as a matter of course, including on Talos Connect, the phone service we operate ourselves, where Talos signs the BAA.

The EHR holds your most sensitive data, and its compliance depends on choices that are easy to get wrong:

• Cloud or on-premise. A cloud EHR moves much of the infrastructure security burden to the vendor, which the BAA should confirm. An on-premise EHR makes you responsible for hardening and patching the server, physical security and backups. Neither model wins automatically, but an on-premise system with no dedicated IT support is where assessments tend to find the worst problems: servers running years-old, unpatched software with the full patient database on board.
• Access discipline. Give every user a unique login, since shared logins are both a violation and the end of a usable audit trail. Set role-based permissions so the front desk sees less than the physician, enable automatic logoff on exam-room machines, and shut off a departing employee's access the same day. Former staff accounts that still work are among the findings practice assessments turn up most.
• Audit logs. The Security Rule expects you to be able to see who accessed what. The EHR records it, but logs that nobody reads are for show. Someone, on staff or at your IT partner, should review access reports for anything odd, such as an employee opening the charts of patients they have never treated.
• Integration sprawl. Each lab interface, e-prescribing link and billing connection is another data flow to protect and another line in your risk assessment.

Keeping the EHR's environment running is the minimum. Keeping it running in a way you can defend to an auditor is the real work of our healthcare IT services.

In a few short years telehealth went from novelty to routine care. The temporary enforcement discretion that let practices use consumer video apps during the public health emergency has ended, and the expectation now looks like this:

• A video platform that encrypts sessions and signs a BAA. FaceTime or a personal Zoom account does not qualify.
• Controls on who joins a session: waiting rooms, authenticated links and meeting addresses nobody can guess.
• Secured clinician devices at home: managed by the practice, encrypted and set to lock, never the shared family laptop.
• Network guidance for remote clinicians, ideally a VPN or zero-trust access into practice systems rather than bare home Wi-Fi.
• A recording policy that decides whether sessions are ever recorded and, if so, where the files live, because those recordings are unusually sensitive PHI.

Telehealth also enlarges the scope of your risk assessment, since every clinician's home setup is now part of your environment. Practices seldom update the SRA to reflect that, and auditors have noticed. Our guide to telehealth security requirements covers the full 2026 standard, from platform and sessions to endpoints, networks and recordings, with a readiness checklist.

HIPAA explicitly calls for a data backup plan, a disaster recovery plan and an emergency mode operation plan, meaning the ability to keep critical work going during an incident. On this point federal law and Houston weather agree completely.

A posture that satisfies both starts with encrypted backups on the 3-2-1 pattern: several copies, on more than one type of media, with at least one stored off-site and outside the flood plain. Add documented recovery time objectives for the EHR, test restores on a regular schedule (a backup nobody has tested is a hope, not a plan), and a written procedure for running the practice while systems are down, covering paper workflows, phone triage and how you will update patients. Ransomware gives this work a second purpose. The same isolated, tested backups that carry you through a hurricane are your leverage when someone demands payment to unlock your files. We build these plans through our backup and disaster recovery service and include the HIPAA paperwork from the start, since an auditor treats a plan you cannot show in writing as a plan you do not have.

HIPAA civil penalties are graded by culpability, meaning what you knew and whether you made an effort:

• Tier 1: you did not know about the violation and could not reasonably have known.
• Tier 2: reasonable cause, meaning you knew or should have known, but the failure did not amount to willful neglect.
• Tier 3: willful neglect that was corrected within 30 days.
• Tier 4: willful neglect that was never corrected.

The minimum amount per violation climbs steeply from one tier to the next, and annual caps apply. HHS adjusts every figure for inflation each year, so check the current HHS numbers instead of relying on a table from an old article.

The structure carries a clear message: penalties are a verdict on effort. A practice that suffers a breach but can show a current risk assessment, signed BAAs, training records and a remediation plan in progress lands in the lower tiers, and OCR often resolves cases like that with a corrective action plan instead of a fine. A practice that cannot produce a risk assessment at all is, nearly by definition, in willful neglect territory.

The penalty is seldom the largest cost. Notifying patients, paying for credit monitoring, legal fees, possible action by a state attorney general, months of distraction during an investigation and lost patient trust routinely cost more than the fine. For a small practice, the disruption alone can outweigh anything OCR imposes, as our look at the real cost of IT downtime shows.

If the work has been happening, audit preparation is mostly organization. Keep one binder, paper or digital, holding:

1. Every security risk assessment, current and past, with its remediation plan and proof of progress
2. Policies and procedures for access management, sanctions, incident response, disposal of devices and media, and remote work
3. Training records showing who was trained, on what and when, for new hires and every year after
4. All signed BAAs
5. An incident log that includes minor events and how you responded. A practice that has never recorded a single incident looks unexamined, not clean.
6. System documentation: the asset inventory, access reviews and backup test results

Suppose a records request arrived tomorrow with a two-week deadline. Could you hand over all six? That question measures your compliance posture more honestly than any tool does. Practices that can say yes take an OCR letter in stride. Practices that cannot should begin with the first item this quarter.

Practices are adopting AI phone agents, automated scheduling and digital intake quickly, and every one of those tools touches PHI. That puts each of them in your risk assessment and your BAA file, exactly like any other vendor. Built well, automation improves compliance: the scripts are consistent, the logs are complete, and patient callbacks stop living on sticky notes. Adopted casually, it is a new way to be breached through a vendor nobody vetted. Before piloting anything, read our complete guide to AI voice agents for medical practices, which covers BAAs, data flows and where recordings are stored. When clients bring these tools in, our automation team handles the setup and the security review.

If this guide has exposed some gaps, the order of work is simple, and it is the same sequence we follow with new healthcare clients:

1. Start with the risk assessment. You cannot fix what you have not mapped.
2. Close the paperwork gaps: BAAs, written policies and training records.
3. Work through technical findings in risk order. MFA, encryption, access cleanup and backup testing usually top the list, and our small business cybersecurity guide covers each of them in depth.
4. Make it routine with yearly assessments, quarterly access reviews and continuing training, so compliance becomes maintenance rather than an emergency project.

Our team has supported Houston-area healthcare organizations since 2014. Practices working in and around the Texas Medical Center cannot treat compliance as optional, and neither do we. For an honest view of where your practice stands, contact Talos about a HIPAA-focused assessment. We will map the gaps and give you the findings in writing, and you can fix them with us or on your own.

Strictly speaking, nothing does, because HIPAA does not certify products or providers. An IT service is HIPAA-capable when it signs a business associate agreement, puts the Security Rule's administrative, physical and technical safeguards in place across your environment, and produces the documentation, including risk assessments, policies and logs, that makes your compliance defensible.

It is required. The Security Rule specifically calls for a documented security risk assessment, and it is the first document regulators ask for in an investigation. The sound practice is to complete one every year and again after any material change, such as a new EHR, a new location or the start of telehealth.

Any outside company that handles PHI on your behalf, whether it creates, receives, stores or sends that data. In a typical practice the list includes the IT provider, the email service, EHR and billing companies, backup and cloud storage, the phone and texting systems, transcription and document shredding. If one of them lacks a BAA, the practice falls out of compliance once PHI reaches that vendor, no matter how good its security is.

Standard SMS is off the table because it travels unencrypted. To text anything containing PHI, use a messaging platform that encrypts conversations and signs a BAA, get each patient's consent on record, and cover the practice with a written texting policy. Bare-bones appointment reminders carry less risk, but they should still follow a documented approach.

Either one can be. Both offer BAAs on qualifying business plans, but neither is compliant straight out of the box. You need an eligible plan, an executed BAA, and correct configuration of encryption, data loss prevention, retention and MFA. A tenant with a signed BAA and default settings is still a finding waiting to happen.

Civil penalties are set in four tiers based on culpability, with the minimum per violation rising steeply at each tier, annual caps, and amounts that HHS adjusts for inflation every year. In practice, breach response costs such as patient notification, legal fees, credit monitoring and lost trust often outrun the fines. What most improves your position is proof of good-faith effort.

Completely. The pandemic-era enforcement discretion for consumer video tools is over. Telehealth now requires an encrypted platform with a signed BAA, access controls on sessions, secured clinician devices, and remote setups included in your risk assessment.