Your doctors take care of patients. We take care of the technology.

Three things on the technical side: control who logs in and what they see (access control + MFA), keep records of who did what (audit logs), and encrypt PHI in transit and at rest. Plus the organizational pieces: a Business Associate Agreement with every IT vendor touching PHI, a written incident-response plan, and an annual risk analysis. We handle the technical side end-to-end and walk your office manager through the rest.

Maybe. The question is whether PHI was actually accessed or disclosed. Step one is preserving the audit logs from the EHR, M365, and the workstation before they roll off retention. Step two is a 4-factor risk assessment (nature of PHI, who accessed it, was it actually viewed, mitigation). If the risk is more than low, you notify patients and HHS within 60 days. We help practices run this drill in advance so the day of the incident isn't the first time anyone has thought about it.

No, and this is the most expensive misunderstanding in healthcare IT. HIPAA is a shared-responsibility model. The EHR vendor is responsible for the controls inside their platform. Your practice is responsible for everything around it: who has accounts, MFA, the workstations the EHR runs on, the network, the email system, the off-boarding when a doctor leaves, and the Business Associate Agreement with every vendor (including us). A "HIPAA-compliant EHR" without HIPAA-compliant operations is still a violation waiting to be found.

Yes — and the same controls that satisfy the insurance carrier mostly satisfy HIPAA Security Rule, too. The standard 2026 healthcare requirements: MFA on every clinical account, endpoint detection (EDR) on every workstation, immutable offsite backups tested by actually restoring, a written incident-response plan, a 24/7 security operations center for after-hours alerts, and quarterly phishing simulations for staff. We deliver the technical pieces and the documentation the carrier asks for so renewal isn't a panic week.

Not all of it — but more than most small practices realize. The non-negotiables for any HIPAA-covered entity: MFA on the EHR, the email, and the M365 admin account; a real backup of the EHR and email tenant (not just whatever the vendor includes); endpoint protection on every workstation; a signed BAA with every IT vendor; a written incident-response plan; an annual risk analysis. We scope to the practice — your size, your specialty, your insurance carrier's questionnaire — without selling you enterprise architecture you don't need.

This is the most common engagement we run in healthcare. First two weeks: discovery — every account, every device, every login, every vendor contract. Week three: documentation, password rotation, MFA enrollment, and a single source of truth for the practice. Week four: we sit down with the office manager and walk through what we found, what was broken, and what was missing. From that point forward you have a real IT operation, in writing, that doesn't walk out the door when one person leaves.

Yes — Microsoft signs a BAA for the M365 healthcare plans and the platform is widely used in clinical settings. The work is in the hardening: separate clinical and administrative mailboxes, MFA on every account, conditional access policies blocking logins from outside the U.S., data-loss prevention rules that flag PHI in outbound mail, audit logs piped to long-term storage, and off-boarding automation when a provider or staff member leaves. The default M365 tenant is not HIPAA-ready. The hardened version is.

Yes — SMS is not HIPAA-compliant. The fix is a secure messaging platform that signs a BAA: TigerConnect, Klara, Spruce, or OhMD are the common choices. Each one supports the workflows doctors actually use (curbside consults, on-call handoff, photos of wounds or imaging) without the PHI ever sitting on a personal phone's SMS history. Migration usually takes a week and most providers prefer the new platform within a few days.

Yes, and it's the compliance most practices forget exists. PCI-DSS v4.0 applies any time you process or store cardholder data — including a card terminal at the front desk or copay collection inside the patient portal. Most small practices fall into SAQ-A or SAQ-B-IP scope, which we help complete annually. The good news: most of the same controls we deploy for HIPAA Security Rule (network segmentation, encryption, access control, log retention) also satisfy PCI. One compliance program, two regulators happy.