Is My IT Company Handling HIPAA? Five Questions That Reveal the Gap

The question comes up almost every time I talk with a small practice administrator: "Doesn't our IT company handle all of that?"

It is a reasonable assumption. The practice pays a monthly fee to an IT company or managed service provider. That company manages the computers, handles software installs, fixes network problems, and is the first call when something breaks. It stands to reason that HIPAA security is part of that arrangement.

For most small practices, it is not — and the gap is larger than it appears.

What Your IT Company Almost Certainly Does

A generalist IT company supporting a small medical practice typically provides:

• Workstation setup, maintenance, and replacement
• Network infrastructure — router, firewall, switches, Wi-Fi
• Microsoft 365 or Google Workspace administration
• Antivirus and basic endpoint protection
• Software installation and updates
• Help desk support for hardware and application issues
• Backup management (though the scope varies significantly)

These are real, valuable services. They are not HIPAA Security Rule compliance.

What the Security Rule Actually Requires

The HIPAA Security Rule at 45 CFR §164 requires covered entities to implement administrative, physical, and technical safeguards for electronic protected health information. The administrative safeguards alone — which include the Security Risk Analysis, the workforce training program, the sanction policy, the access management procedures, and the contingency plan — are primarily documentation and policy work that most IT companies do not produce and are not contracted to produce.

The technical safeguards the Security Rule requires — unique user identification, audit controls, automatic logoff, encryption — may be partially addressed by your IT company's tools, but whether they are actually configured and documented for your specific environment is a separate question. Having a firewall is not the same as having a documented assessment that the firewall addresses the specific threats to your ePHI.

The distinction matters: your IT company may have implemented security tools. The Security Rule requires that you have documented that those tools address your specific risk environment, as determined by a Security Risk Analysis.

Five Questions to Ask Your IT Company

These questions are direct. A generalist IT company that is genuinely handling your HIPAA Security Rule compliance should be able to answer each one in writing.

1. Have you delivered a documented Security Risk Analysis for our practice?

The HIPAA Security Rule requires every covered entity to conduct and document a Security Risk Analysis — an assessment of threats, vulnerabilities, and risks to electronic protected health information. Not a network vulnerability scan. Not a firewall review. A formal documented SRA that identifies all the places ePHI exists in the practice environment and assesses the risks to each. [verify: cite SRA requirement at https://www.hhs.gov/hipaa/for-professionals/security/index.html]

If the answer is no, the practice's most foundational Security Rule requirement is unmet.

2. Do you have a HIPAA Business Associate Agreement with us?

Any vendor that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate and must sign a Business Associate Agreement. An IT company that has access to systems containing patient records — even for routine maintenance — is almost certainly a business associate. A BAA is required. A standard IT services agreement is not a BAA.

If the answer is no or "I'm not sure," request a copy of a HIPAA-specific BAA before the next service call.

3. Have you reviewed our access control configuration specifically for HIPAA?

The Security Rule requires that access to ePHI is limited to the minimum necessary for each person's role, that every user has a unique identifier, and that audit logs exist to record access. Your IT company may have configured Active Directory or Microsoft 365 in a standard way. That is different from a HIPAA-specific review of who can access what, whether shared accounts exist, and whether access control reflects actual job functions.

4. Do you maintain documentation of what you have implemented and why, in terms of the Security Rule?

The Security Rule's addressable implementation specifications require that a covered entity either implement the specification or document why an equivalent alternative was used. This documentation — which should connect the practice's specific risk environment to its security measures — is not typically produced as part of routine IT management. Ask for it.

5. What is your procedure when you suspect a security incident involving our patient records?

The HIPAA Breach Notification Rule requires covered entities to investigate and, in many cases, report security incidents involving ePHI. Does your IT company have a documented incident response procedure that includes notifying your practice of suspected ePHI involvement? Or does their process stop at "we fixed the issue"?

The Pattern These Questions Reveal

If your IT company can answer all five of these questions in writing, with documentation, you have an unusually capable partner. If the answers are vague, or if the company seems surprised by the questions, you have a generalist IT company that handles your infrastructure — not a HIPAA Security Rule compliance program.

This does not mean your IT company has done anything wrong. Most generalist IT companies are not positioned as HIPAA compliance providers, do not hold themselves out as such, and are not priced to deliver what HIPAA compliance actually requires. The gap is not typically negligence on their part. It is a scope mismatch that the practice needs to address.

What the Gap Means Practically

The HIPAA Security Rule obligation belongs to the covered entity — the practice. An IT company is a business associate. If OCR investigates your practice following a breach, the question is whether the practice had a compliant security program, not whether the IT company believed it had implemented good security tools.

"We trusted our IT company to handle it" is not a documented Security Risk Analysis.

The HIPAA Security Readiness Checklist covers the Business Associate Agreement question (items 11 and 12) and the access control questions (items 6 and 7) alongside the other twelve areas. If you want to talk through what these gaps mean for your specific practice, the free security review call is the starting point.