Most MSPs Leave HIPAA to You. We Put It In the Package.
Most IT providers sign a business associate agreement and leave HIPAA compliance to the practice or refer it to a separate vendor. Southeastern Technical bundles it into managed services for medical and dental clients, and answers the vendor questions inside your assessment ourselves.
Call three IT companies that say they serve medical practices and ask each one the same question: who writes our security risk analysis? You will get three versions of the same answer. They will sign a business associate agreement. They will encrypt the laptops, turn on multi-factor authentication, run the backups and patch the servers. Then there is a pause, and some variation of “your compliance consultant handles that part.”
That pause is the gap most practices fall into. The technical controls get implemented by the IT company. The documentation that proves those controls exist, and that someone reviewed them, and that staff were trained, and that the vendor with access to your imaging system has a current agreement, belongs to nobody in particular. It lands on a practice manager who already has a full day.
We decided to take that part on, and to put it inside the managed services agreement rather than sell it separately.
Compliance is in the package, not next to it
Every medical and dental client on managed services with us gets HIPAA compliance bundled into the agreement. Not referred out to a consultant. Not a separate subscription you buy from a third party and administer yourself. Not an add-on line item that appears when you ask about it. It is part of what managed services means here.
As far as we can tell that makes us one of very few MSPs doing it this way, and we have not yet come across another one locally. The common arrangement is that your IT company sells you IT, and compliance is somebody else’s product that you buy, learn and run on your own time.
The platform is ComplianceAX, which covers 282 HIPAA requirements as 195 plain-English questions, one screen at a time. Your practice gets it as part of the service rather than as a line item.
Including the software is the easy half. The part that matters is that we are inside the assessment with you.
When your assessment reaches the questions that belong to your IT vendor, which is a significant share of the technical safeguards, we answer them. Not you, guessing at what your IT company does. Us, in writing, with evidence attached and a date and a name on it. You review what we put in and accept it or send it back.
That is a different relationship from signing a BAA and wishing you luck.
The work we actually do, not the work we say we do
Your security risk analysis stays current. Not reviewed annually if someone remembers, but revisited when something changes: a new EHR, a second location, a move to cloud imaging, a new vendor with access to patient records. After an incident the risk analysis is the first document requested, and the one most practices cannot produce in a usable state.
Workforce training is tracked per person against their actual duties, so the front desk is not sitting through material written for a systems administrator, and a cleaning service gets a short notice instead of a full course.
Your vendor list gets built and kept honest. Most practices cannot produce a list of every company that touches their patient data. ComplianceAX walks you through finding them, works out which ones need a business associate agreement based on what each vendor does and what it can reach, and confirms those agreements every year with expiry dates tracked.
Policies get versioned, signed electronically, and checked against what actually happens in the building. A policy that says screens lock after fifteen minutes is worth very little if the exam room workstations do not. We find that gap because we are the ones who can see both sides of it.
And when something goes wrong, the incident opens as a guided case file with the 60-day notification clock visible, walking the four-factor assessment HIPAA requires. A person makes the breach determination, always. But the record of how that determination was reached builds itself as you go.
Why most IT companies will not do this
It is worth being fair about the reason, because it is not laziness.
Compliance work is unglamorous, it does not scale the way ticket work does, and it carries a liability tail. An IT company that writes your risk analysis has put its name on something an investigator may read. Most providers look at that and decide the safer commercial position is to install the controls, sign the agreement, and let the practice carry the documentation burden.
We think that reasoning gets the risk backwards. The practice carrying it alone is exactly how a practice ends up with a three-year-old risk analysis, a training log nobody updated, and a vendor list that omits the two companies most likely to cause a breach. We would rather be accountable for the part we are actually qualified to be accountable for.
We went through the Compliancy Group certification process ourselves. Our technicians are HIPAA trained. The documentation we produce for clients is the documentation we have had to stand behind for our own organization.
What this is not
We are not your attorney, and we do not provide legal representation. If HHS comes calling we help you gather and present your evidence and prepare your response, and that is support and organization rather than legal counsel.
We will not tell you that any of this makes you HIPAA compliant. There is no government HIPAA certification, no vendor can issue one, and any IT company that tells you otherwise is either confused or selling. Compliance is a judgment someone makes about your practice. What we can do is make sure the work is genuinely done, the evidence genuinely exists, and the record is organized and dated on the day somebody asks for it.
The question worth asking your current provider
You do not need to take our word for any of this. Ask whoever supports your practice today three questions.
Who writes and updates our security risk analysis, and when was it last revisited? Who answers the IT portions of our HIPAA assessment? If we had a reportable breach tomorrow, who assembles the documentation, and how long would it take?
Then ask a fourth: is any of that included in what we already pay you, or is it billed separately?
If the answers are “you do”, “you do”, “we would help where we can” and “that would be extra”, you have the common arrangement. It is not negligent and it is not unusual. It is just a long way from what your practice actually needs on the day it matters.
ComplianceAX
See what your practice would actually get.
A 30-minute demo walks through the assessment, the head start from your own documents, and what a finished record looks like when an auditor asks for it.
Or talk to us about managed services for your practice at (678) 807-6156.
More on the platform itself in our ComplianceAX overview, and on the underlying security work on our HIPAA IT security page.
Frequently asked questions
Doesn't every IT company handle HIPAA?
Nearly every IT company serving healthcare will sign a business associate agreement, and most will implement the technical controls: encryption, multi-factor authentication, backups, patching. Very few go further. Ask a prospective provider who writes your security risk analysis, who tracks which staff completed training this year, and who answers the vendor questions in your assessment. The usual answer is that those are the practice's job. We do them.
What exactly is included with managed services for a medical or dental practice?
The IT work you would expect, plus HIPAA compliance bundled in rather than sold alongside: the ComplianceAX assessment platform, and our own time inside your assessment. We answer the questions that belong to us as your IT vendor, keep your security risk analysis current rather than annual-if-someone-remembers, and produce the documentation. You still own the decisions, because a covered entity cannot delegate those.
Can you work with the compliance consultant we already have?
Yes, and it usually makes their job easier. Consultants spend much of their time chasing technical evidence from IT providers who are slow to produce it. We hand it over directly, dated and in the format they need.
Our practice already did a risk assessment a few years ago. Is that enough?
No. HHS expects the risk analysis to describe the environment you run now, not the one you ran three years ago. A new EHR, a new location, a move to cloud imaging or a change of IT provider all change the answer. After any reported incident it is the first document requested, and a stale one is worse than an honest recent one with open items.
Do you do this for business associates too, or only practices?
Both. If you are a billing company, an IT provider or another vendor handling patient data, you carry your own HIPAA obligations. ComplianceAX has a separate assessment built for business associates so you are not skipping past questions about exam rooms.
Most MSPs Leave HIPAA to You. We Put It In the Package.
Most IT providers sign a business associate agreement and leave HIPAA compliance to the practice or refer it to a separate vendor. Southeastern Technical bundles it into managed services for medical and dental clients, and answers the vendor questions inside your assessment ourselves.
Call three IT companies that say they serve medical practices and ask each one the same question: who writes our security risk analysis? You will get three versions of the same answer. They will sign a business associate agreement. They will encrypt the laptops, turn on multi-factor authentication, run the backups and patch the servers. Then there is a pause, and some variation of “your compliance consultant handles that part.”
That pause is the gap most practices fall into. The technical controls get implemented by the IT company. The documentation that proves those controls exist, and that someone reviewed them, and that staff were trained, and that the vendor with access to your imaging system has a current agreement, belongs to nobody in particular. It lands on a practice manager who already has a full day.
We decided to take that part on, and to put it inside the managed services agreement rather than sell it separately.
Compliance is in the package, not next to it
Every medical and dental client on managed services with us gets HIPAA compliance bundled into the agreement. Not referred out to a consultant. Not a separate subscription you buy from a third party and administer yourself. Not an add-on line item that appears when you ask about it. It is part of what managed services means here.
As far as we can tell that makes us one of very few MSPs doing it this way, and we have not yet come across another one locally. The common arrangement is that your IT company sells you IT, and compliance is somebody else’s product that you buy, learn and run on your own time.
The platform is ComplianceAX, which covers 282 HIPAA requirements as 195 plain-English questions, one screen at a time. Your practice gets it as part of the service rather than as a line item.
Including the software is the easy half. The part that matters is that we are inside the assessment with you.
When your assessment reaches the questions that belong to your IT vendor, which is a significant share of the technical safeguards, we answer them. Not you, guessing at what your IT company does. Us, in writing, with evidence attached and a date and a name on it. You review what we put in and accept it or send it back.
That is a different relationship from signing a BAA and wishing you luck.
The work we actually do, not the work we say we do
Your security risk analysis stays current. Not reviewed annually if someone remembers, but revisited when something changes: a new EHR, a second location, a move to cloud imaging, a new vendor with access to patient records. After an incident the risk analysis is the first document requested, and the one most practices cannot produce in a usable state.
Workforce training is tracked per person against their actual duties, so the front desk is not sitting through material written for a systems administrator, and a cleaning service gets a short notice instead of a full course.
Your vendor list gets built and kept honest. Most practices cannot produce a list of every company that touches their patient data. ComplianceAX walks you through finding them, works out which ones need a business associate agreement based on what each vendor does and what it can reach, and confirms those agreements every year with expiry dates tracked.
Policies get versioned, signed electronically, and checked against what actually happens in the building. A policy that says screens lock after fifteen minutes is worth very little if the exam room workstations do not. We find that gap because we are the ones who can see both sides of it.
And when something goes wrong, the incident opens as a guided case file with the 60-day notification clock visible, walking the four-factor assessment HIPAA requires. A person makes the breach determination, always. But the record of how that determination was reached builds itself as you go.
Why most IT companies will not do this
It is worth being fair about the reason, because it is not laziness.
Compliance work is unglamorous, it does not scale the way ticket work does, and it carries a liability tail. An IT company that writes your risk analysis has put its name on something an investigator may read. Most providers look at that and decide the safer commercial position is to install the controls, sign the agreement, and let the practice carry the documentation burden.
We think that reasoning gets the risk backwards. The practice carrying it alone is exactly how a practice ends up with a three-year-old risk analysis, a training log nobody updated, and a vendor list that omits the two companies most likely to cause a breach. We would rather be accountable for the part we are actually qualified to be accountable for.
We went through the Compliancy Group certification process ourselves. Our technicians are HIPAA trained. The documentation we produce for clients is the documentation we have had to stand behind for our own organization.
What this is not
We are not your attorney, and we do not provide legal representation. If HHS comes calling we help you gather and present your evidence and prepare your response, and that is support and organization rather than legal counsel.
We will not tell you that any of this makes you HIPAA compliant. There is no government HIPAA certification, no vendor can issue one, and any IT company that tells you otherwise is either confused or selling. Compliance is a judgment someone makes about your practice. What we can do is make sure the work is genuinely done, the evidence genuinely exists, and the record is organized and dated on the day somebody asks for it.
The question worth asking your current provider
You do not need to take our word for any of this. Ask whoever supports your practice today three questions.
Who writes and updates our security risk analysis, and when was it last revisited? Who answers the IT portions of our HIPAA assessment? If we had a reportable breach tomorrow, who assembles the documentation, and how long would it take?
Then ask a fourth: is any of that included in what we already pay you, or is it billed separately?
If the answers are “you do”, “you do”, “we would help where we can” and “that would be extra”, you have the common arrangement. It is not negligent and it is not unusual. It is just a long way from what your practice actually needs on the day it matters.
ComplianceAX
See what your practice would actually get.
A 30-minute demo walks through the assessment, the head start from your own documents, and what a finished record looks like when an auditor asks for it.
Or talk to us about managed services for your practice at (678) 807-6156.
More on the platform itself in our ComplianceAX overview, and on the underlying security work on our HIPAA IT security page.
Frequently asked questions
Doesn't every IT company handle HIPAA?
Nearly every IT company serving healthcare will sign a business associate agreement, and most will implement the technical controls: encryption, multi-factor authentication, backups, patching. Very few go further. Ask a prospective provider who writes your security risk analysis, who tracks which staff completed training this year, and who answers the vendor questions in your assessment. The usual answer is that those are the practice's job. We do them.
What exactly is included with managed services for a medical or dental practice?
The IT work you would expect, plus HIPAA compliance bundled in rather than sold alongside: the ComplianceAX assessment platform, and our own time inside your assessment. We answer the questions that belong to us as your IT vendor, keep your security risk analysis current rather than annual-if-someone-remembers, and produce the documentation. You still own the decisions, because a covered entity cannot delegate those.
Can you work with the compliance consultant we already have?
Yes, and it usually makes their job easier. Consultants spend much of their time chasing technical evidence from IT providers who are slow to produce it. We hand it over directly, dated and in the format they need.
Our practice already did a risk assessment a few years ago. Is that enough?
No. HHS expects the risk analysis to describe the environment you run now, not the one you ran three years ago. A new EHR, a new location, a move to cloud imaging or a change of IT provider all change the answer. After any reported incident it is the first document requested, and a stale one is worse than an honest recent one with open items.
Do you do this for business associates too, or only practices?
Both. If you are a billing company, an IT provider or another vendor handling patient data, you carry your own HIPAA obligations. ComplianceAX has a separate assessment built for business associates so you are not skipping past questions about exam rooms.
Talk to Us About Your Practice
Tell us where your compliance or IT situation stands and we will get back to you. No obligation, and no sales sequence.