IT Support for Healthcare Practices Where the Schedule Can't Stop

Downtime means patients waiting. A frozen front desk computer or a dead internet connection stops check-in, charting and billing all at once.

Ransomware targets healthcare. Criminals know practices can’t afford to be offline, so they aim for them.

Lots of devices, lots of people. Front desk, exam rooms, billing, part-time staff and outside vendors all need access, and all of it has to be managed.

The risk analysis you keep meaning to do. HIPAA expects one, and many practices have an old one or none at all.

Vendors handling patient data. Billing companies, IT providers and cloud apps all touch patient information, and each needs the right paperwork.

We keep the practice running. Ongoing care for computers, network and connections, with a real person to call.

We help protect patient information. MFA, sensible access controls, and encryption on laptops and data so lost devices don’t become breaches.

We back it up and test it. Backups you can actually restore, so a bad day doesn’t become a bad month.

We help with your risk analysis. We’ll walk through where patient data lives and what could go wrong, on the technology side.

We train your team. Plain English phishing training your staff will actually remember.

This section is a plain English overview to help you understand what the rules ask for. It isn’t legal advice. For questions about what applies to your practice, talk with your attorney. Our role is to help you meet these requirements on the technology side and document the work. The responsibility for your program stays with your practice, and we don’t promise or guarantee compliance.

HIPAA (Health Insurance Portability and Accountability Act)

HIPAA is enforced by the HHS (U.S. Department of Health and Human Services) Office for Civil Rights. Three parts matter most for your technology.

• The Security Rule. HHS says it sets national standards to protect electronic protected health information (ePHI) that a covered entity or its business associate creates, receives, uses or keeps. It requires administrative, physical and technical safeguards. It’s found at 45 CFR Part 160 and Subparts A and C of Part 164.
• A risk analysis. The Security Rule expects you to look honestly at where patient information lives and what could go wrong. HHS and the ONC (Office of the National Coordinator for Health IT) offer a free Security Risk Assessment Tool built for small and medium-sized practices.
• Breach notification. After a breach of unsecured protected health information, you must notify affected patients without unreasonable delay and no later than 60 days after discovery. A breach affecting 500 or more people also must be reported to HHS within 60 days, and one affecting more than 500 residents of a state requires notice to prominent media there. Smaller breaches can be reported to HHS once a year. HHS says information that has been properly encrypted isn’t “unsecured,” which is one big reason encryption matters.
• Business associates. Outside companies that handle patient information for you, like your IT provider, are business associates, and HIPAA expects a written business associate agreement with them.

HHS also published a proposed update to the Security Rule on January 6, 2025. It was released as a proposed rule, so check the HHS website for its current status.

New Jersey’s data breach law (N.J.S.A. 56:8-161 to 56:8-166)

New Jersey’s Identity Theft Prevention Act covers any business that does business in New Jersey, and any public entity, that keeps computerized records with personal information. If there’s a breach of New Jersey residents’ personal information, you have to tell the affected people in the most expedient time possible and without unreasonable delay. Before you tell them, the law says you must report the breach to the New Jersey State Police. The State Police and the NJCCIC (New Jersey Cybersecurity and Communications Integration Cell) provide an online form for that report. If you decide misuse of the information isn’t reasonably possible, the law says to document that decision in writing and keep it for five years.