Most IT providers say they're HIPAA compliant. Very few can produce a written risk assessment, explain their audit logging approach, or tell you what happens when a device with PHI goes missing. The difference matters — HHS OCR fines start at $100 per violation and can reach $1.9 million per violation category annually.
HIPAA compliance for IT services is defined by the HIPAA Security Rule (45 CFR Part 164), which mandates specific technical, physical, and administrative safeguards for electronic protected health information (ePHI). A HIPAA compliant IT provider isn't just one who signs a BAA — they're one who implements and documents the specific controls the Security Rule requires.
Here's what that actually means in practice:
What your EHR's BAA doesn't cover: Your EHR vendor (Epic, athenahealth, eClinicalWorks, etc.) signs a BAA and secures their application. But your laptops, email system, network, backup infrastructure, and user access management are outside the EHR's scope. Most HIPAA breaches happen at the infrastructure level — unencrypted laptops, compromised email accounts, unauthorized access — not within the EHR itself. You need a separate HIPAA-compliant IT provider for everything outside the EHR.
| Requirement | Specification Type | What It Means for IT |
|---|---|---|
| Access controls | Required | Unique user IDs, automatic logoff, emergency access procedures |
| Audit controls | Required | Hardware/software activity logs for systems containing ePHI |
| Integrity controls | Addressable | Electronic mechanisms to verify PHI hasn't been improperly altered or destroyed |
| Transmission security | Addressable | Encryption of ePHI in transit (effectively required in modern environments) |
| Encryption at rest | Addressable | Encryption of stored ePHI on devices and servers (effectively required) |
| Workstation security | Required | Physical and logical security of workstations that access ePHI |
| Device & media controls | Required | Policies for hardware/media containing ePHI — disposal, reuse, and accountability |
| Person/entity authentication | Required | Verify identity of users before granting access to ePHI |
| Business associate contracts | Required | Signed BAA with every vendor who handles ePHI on your behalf |
| Contingency planning (backup) | Required | Data backup plan, disaster recovery plan, and testing of restoration procedures |
The "Addressable" designation does not mean optional — it means you must implement the safeguard or document a specific reason why an alternative measure achieves equivalent protection. In 2026, "we're a small practice" is not an adequate justification for unencrypted storage.
Most IT providers will say they're HIPAA compliant during a sales call. Very few can answer these questions specifically:
The compliance audit test: Ask your current IT provider to give you a copy of your current HIPAA risk assessment. If they can't produce it in 24 hours — or if they're confused about what you're asking for — you don't have a HIPAA compliant IT provider. You have an IT provider who says they're HIPAA compliant.
HIPAA compliant managed IT costs more than standard managed IT because it requires additional tooling, documentation, and expertise. Here's what to budget:
| Organization Size | Monthly Range | Per-User Range | What's Included |
|---|---|---|---|
| Solo / under 10 staff | $1,200–$2,500/mo | $150–$250/user | Monitoring, helpdesk, encryption, backup, BAA, basic audit logging |
| 10–50 staff | $2,500–$8,500/mo | $130–$200/user | All of above + email security, risk assessment, employee training |
| 50–200 staff | $8,500–$28,000/mo | $150–$175/user | All of above + vCIO advisory, formal incident response plan, MDM |
| 200+ staff | Custom | $140–$200/user | Full compliance program, dedicated security resources, OCR audit support |
Note: These ranges assume the provider handles compliance documentation and program management, not just the technical controls. IT providers who only implement technology without documentation are providing incomplete HIPAA compliance services.
HIPAA applies to covered entities and their business associates. In terms of organizations that need HIPAA compliant IT:
HIPAA compliant IT services are managed IT services that implement the specific technical safeguards required by the HIPAA Security Rule: PHI encryption, audit logging, access controls, signed BAA, documented risk assessments, and an incident response plan. Providers must be able to produce documentation proving compliance — not just claim it.
A Business Associate Agreement is a HIPAA-required contract between a covered entity and any vendor who handles protected health information on their behalf. Your IT provider must sign a BAA before accessing any system that contains patient data. Operating without a signed BAA is a HIPAA violation regardless of whether a breach occurs.
HIPAA compliant managed IT typically costs $130–$280 per user per month. A 20-provider medical practice typically pays $4,000–$8,000/month for fully compliant managed IT. Use our IT Budget Calculator to estimate your cost.
No. Your EHR vendor's BAA covers their application only. Your IT infrastructure — endpoints, email, network, backup, user management — is your responsibility and requires a separate HIPAA-compliant IT provider. Most HIPAA breaches occur at the infrastructure level, outside the EHR.