What Houston Medical Practices Should Expect From HIPAA-Compliant IT Support

Keeping the email up and the printers working is the floor for a medical practice's IT provider, not the job. In a Houston practice, that provider also carries a real share of your HIPAA obligations, and when it drops them the cost is more than a fine. A serious breach can put a practice out of business.

Below is what HIPAA asks of your technology, what a capable provider should already be doing, and the signs that yours is not. Consider it the short, practice-level version. The full framework, covering risk assessments, business associate agreements, telehealth and audit preparation, is in our complete HIPAA compliance guide for healthcare IT.

The fines are the part everyone has heard about. When Congress strengthened HIPAA through the HITECH Act, it set the original civil penalty range at $100 to $50,000 per violation, with an annual ceiling of $1.5 million for each category of violation, and HHS adjusts those figures upward for inflation each year. The money is only the start of what a breach sets in motion:

• Notification duties: every affected patient has to be told.
• A federal investigation: the HHS Office for Civil Rights (OCR) can open an inquiry and impose a corrective action plan.
• Lasting reputational harm: in a local market like Houston, patients and referring physicians remember, and that trust is very hard to win back.
• Litigation: patients whose records were exposed may sue.

Houston has one of the heaviest concentrations of healthcare providers anywhere, centered on the Texas Medical Center. Compliance expectations here get applied to real practices every day.

Protected health information (PHI) needs encryption both where it is stored and while it moves. In practice that covers:

• Email: any message that carries patient information goes out encrypted.
• Disks: full-disk encryption on every workstation, laptop and server that handles PHI.
• Remote access: a VPN or another encrypted channel whenever staff connect from outside the office.
• Backups: encrypted copies, including the ones that live in the cloud.

A simple test: if someone on your staff can send a patient record through ordinary Gmail or Outlook with no encryption applied, your IT setup has missed one of the most basic requirements.

The same logic reaches patient messaging. Ordinary SMS is not encrypted, so a practice that confirms appointments by text needs its own guardrails. Talk Is Cheap explains them in its guide to HIPAA-compliant patient texting.

HIPAA expects access to follow roles, not convenience. Not everyone in the building needs every record.

• One login per person: each staff member gets a unique user ID, and nobody shares credentials.
• Minimum necessary access: the front desk does not need what the physicians need.
• Automatic timeouts: unattended workstations lock themselves.
• Audit trails: logs record who opened which records, and when.

The rule expects you to be able to get patient data back after any disaster, whether that is a hurricane, a failed server or ransomware. Your provider should be delivering:

• Encrypted daily backups of every system that holds PHI
• Copies stored off-site or in the cloud, never just a USB drive sitting in the office
• Written recovery procedures with recovery time objectives (RTOs) that have actually been tested
• Scheduled test restores that confirm the data comes back complete

Our backup and disaster recovery service builds exactly this, with the documentation an auditor will ask to see.

This requirement catches a lot of Houston practices off guard. HIPAA requires a documented security risk assessment, the accepted practice is to repeat it at least once a year, and your IT provider should either perform it or coordinate it with whoever does.

A real assessment finds the specific weak points in your environment, not a generic list of things that might go wrong. Plenty of practices have never had one at all, and that absence is a compliance problem by itself. If you want to see what the process involves, our step-by-step security risk assessment walkthrough lays it out.

Your IT provider can reach your systems, which means it can reach PHI. HIPAA requires a signed business associate agreement (BAA) with every vendor in that position.

If your IT company has never signed a BAA with you, you are both out of compliance at this moment. There is no optional version of this. Talos signs BAAs with the healthcare practices we support, and any provider that hesitates to sign one is telling you something important.

The technical controls above are necessary, but a provider that understands healthcare also takes on the ongoing work around them. For a Houston practice, expect it to:

• Keep written documentation of your security policies and procedures
• Run or coordinate the annual risk assessment and track the fixes it produces
• Train your staff on security awareness and HIPAA basics
• Watch for intrusions with endpoint protection and intrusion detection
• Maintain an incident response plan written specifically for PHI breaches
• Keep the systems your EHR depends on patched and properly secured
• Manage the mobile devices that reach patient data, personal phones included

That list describes our compliance support work for healthcare clients.

One boundary is worth drawing clearly. Everything above is IT compliance. Phone answering at the front desk, appointment reminders and after-hours coverage are questions about patient communication rather than IT, and our Talos Connect team covers them in a guide to choosing a HIPAA-compliant answering service. If you are weighing AI for those calls, our post on what is safe to automate under HIPAA sorts the options. Whichever service you choose still goes on your vendor list with a signed BAA, the same as any other system that touches PHI.

• No BAA has ever been signed between you.
• Nobody can explain what a risk assessment is or when your last one happened.
• Workstations stay unlocked no matter how long they sit idle.
• Staff members share logins.
• Patient information leaves by email with no encryption.
• No one has tested a backup restore in the past six months, or ever.
• Your practice gets treated exactly like a retail store or a law office.

A city with this many healthcare providers produces two kinds of IT companies. Some genuinely specialize in healthcare compliance. Others claim HIPAA expertise because they installed antivirus software.

You find out which one you have when OCR starts asking questions, and by then it is late. "Our IT guy told us we were compliant" has never worked as a defense.

If you are not sure your practice would hold up on the IT side of HIPAA, start with an honest assessment: a genuine review of your current setup against the rule, not a sales call dressed up as an audit. Talos runs HIPAA-focused assessments for Houston medical practices as part of our healthcare IT services, and you get the findings in writing. Contact us or call (346) 330-3390 to schedule one.