HIPAA Compliance

HIPAA is not only a doctor's problem. The Security Rule reaches every organization that creates, receives, maintains, or transmits protected health information, which sweeps in a long list of businesses that do not think of themselves as healthcare at all: medical billing companies, claims processors, transcription services, dental and orthodontic labs, IT and software vendors serving practices, staffing agencies, records storage firms, and management companies. If you are a covered entity, you already know it. If you are a business associate, you may be under the rule without ever having been told.

This page is about the requirement and the controls behind it. If you run a medical or dental practice and want the practical version, our healthcare IT page is written for you.

What the Security Rule actually asks for

HIPAA does not hand you a product list. It asks you to protect electronic protected health information with administrative, physical, and technical safeguards, and to be able to show your work. In practice, the technical side comes down to a handful of things being true, and provable:

• Access control. Only the right people reach the right records, each with their own account, and you can show who has access to what.

• Audit controls. Activity in systems holding PHI is logged, so access can be reconstructed after the fact.

• Integrity and transmission security. Records cannot be altered or destroyed without detection, and PHI is encrypted when it moves.

• Encryption at rest. Laptops, servers, and backups holding PHI are encrypted, so a lost device is not a reportable breach.

• Contingency planning. You can recover the data. That means offsite, immutable backup that is monitored rather than assumed.

• Risk analysis. The one most organizations skip, and the one regulators ask for first. You are expected to know where PHI lives and what could go wrong with it.

What we do, and what we do not

We put the technical safeguards in place and document them: endpoint detection and response on every device, identity threat protection, controlled and logged access, DNS filtering, managed password security, encrypted backup for both servers and Microsoft 365, and patching. Then we produce the evidence, so that when someone asks how PHI is protected, you have an answer with substance behind it rather than an assurance.

Here is what we are not. We are not a certification body, and no vendor can make you "HIPAA certified", because no such certification exists. Anyone selling you one is selling you a logo. Compliance is a program: it includes policies, workforce training, business associate agreements, and a risk analysis you own. We handle the technology underneath it, and we will tell you plainly which parts sit outside our scope. If you want to know where you stand before you start, that is an assessment.

Why the technical side is where breaches actually happen

Health data is among the most valuable material on the criminal market, and the organizations holding it are often the least defended. Ransomware groups target them deliberately, and the way in is usually mundane: a phished credential, an unpatched server, a backup that was never verified. AI has made the phishing side far harder to spot, which is why access control and multi-factor authentication carry more weight now than any policy document.

Common questions about HIPAA and IT

We are not a medical practice. Does HIPAA apply to us?

If you handle protected health information on behalf of a covered entity, you are a business associate and the Security Rule applies to you. Billing companies, labs, IT vendors, transcription services, and records handlers routinely fall under it. If you are unsure, ask us and we will walk through what you actually touch.

Can you sign a Business Associate Agreement?

We are putting formal BAA coverage in place. If a signed BAA is a requirement for your organization, contact us and we will tell you exactly where that stands rather than promise something we cannot yet sign.

Will you make us compliant?

We will put the technical safeguards HIPAA requires behind your program and document them, which is the part most organizations get wrong. The policies, the training, and the risk analysis are yours to own, and we will tell you what is missing rather than let you assume the IT work covers it.

Do you work with our EHR or practice software?

Yes. We work alongside whatever system holds the records, keep the environment around it secure, backed up, and running, and coordinate with the software vendor when an issue crosses into their platform.

What areas do you serve?

We are based in New Jersey and work with organizations across NJ, PA, and NY, with remote support available nationwide. On-site work is scheduled and quoted before we start.