HIPAA compliant IT services: what a healthcare organization should require from its managed provider
Healthcare organizations hear “HIPAA compliant,” a reference to the Health Insurance Portability and Accountability Act (HIPAA), attached to almost every IT service, from email to backup to help desk support. The phrase sounds like a credential, but there is no official HIPAA certification for an IT provider. What exists instead is a set of legal obligations and a contract. This post explains what HIPAA compliant IT services actually means, what the law requires of a provider that touches electronic protected health information (ePHI), and the questions to ask before you sign.
What makes IT services HIPAA compliant?
IT services are HIPAA compliant when the provider signs a business associate agreement (BAA), implements the HIPAA Security Rule safeguards that apply to the ePHI it handles, and can show evidence that it does. The label on a website is not the test. The contract and the controls are.
The U.S. Department of Health and Human Services (HHS) is explicit that IT providers are covered. Its business associate guidance lists an IT contractor or vendor, including a “Managed Services Provider,” that provides maintenance or support services requiring access to ePHI as a business associate.
Does a managed IT provider need to sign a BAA?
Yes, if the provider creates, receives, maintains, or transmits ePHI on your behalf, including when it only supports systems that hold ePHI. A provider that manages your servers, backs up your electronic health record database, or monitors your network for threats is almost always a business associate.
The rule reaches further than many people expect. HHS guidance on HIPAA and cloud computing states that a cloud provider storing ePHI is a business associate even when it holds the data only in encrypted form and cannot view it, and that such providers “must comply with the applicable standards and implementation specifications of the Security Rule.”
A provider that hesitates to sign a BAA is telling you something about its readiness. Treat it as a stop sign.
What should a healthcare organization ask an IT provider?
Ask questions that require evidence, not reassurance. A good provider will answer these directly and in writing:
- Will you sign our BAA, or provide yours for legal review, before any access to systems that hold ePHI?
- Which of your staff and subcontractors will have access to ePHI, and how are they vetted and trained?
- How do you enforce multifactor authentication and least privilege for your own technicians?
- Where are our logs stored, how long are they kept, and can we see them directly?
- What is your incident response process, and how quickly will you notify us of a suspected breach involving our data?
- Which safeguards do you implement, and which remain ours? Put it in a responsibility matrix.
- How do you support our annual security risk analysis with documentation of the controls you run?
The responsibility matrix question matters most. The Security Rule obligations of a covered entity do not transfer to a provider by contract. Your organization still owns its risk analysis and its policies, even when the provider runs the tools.
Red flags when evaluating HIPAA compliant IT services
Some answers should end the conversation, or at least send it to your compliance officer. Watch for these:
- The provider claims to be “HIPAA certified” and cannot explain what that means, since no official certification exists.
- The provider will sign a BAA only after onboarding, or only with terms that exclude its subcontractors.
- Technicians share administrative accounts, or the provider cannot say who accessed your systems last month.
- Remote access to your network runs through a tool that is not protected by multifactor authentication.
- The proposal bundles services you did not ask for and cannot explain how each one protects ePHI.
None of these is unusual in the market, which is why the questions above matter. A provider that answers them well usually handles the rest of the relationship the same way.
Where healthcare IT security tends to break down
Healthcare IT security tends to break down at the edges: shared workstations in clinical areas, legacy systems attached to medical devices, remote access tools used by outside vendors, and email. These are also the places a generalist provider is least likely to have seen before.
Clinical environments add constraints most offices do not have. A workstation at a nurses’ station may need fast user switching, a lab system may run on an older operating system certified by its vendor, and downtime for patching has to be scheduled around patient care. A provider supporting healthcare should be able to describe how it handles each of those without weakening controls. VSO applies the same operating discipline it uses in defense and federal environments (asset inventory, hardened baselines, continuous monitoring, and documented exceptions) to healthcare and other regulated commercial clients. For organizations that serve both health and defense missions, see our post on stacking HIPAA and CMMC compliance.
How VSO supports healthcare organizations
VSO provides managed IT and security services to healthcare and other regulated commercial organizations, with a named service delivery manager, scope built around the systems you run, and a documented split between what VSO operates and what your team owns.
Choosing HIPAA compliant IT services
HIPAA compliant IT services come down to three things you can verify: a signed BAA, safeguards the provider can demonstrate, and a written split of responsibilities. Ask for all three before a provider touches a system that holds ePHI, and keep the answers with your risk analysis.
Looking for an IT partner that treats ePHI the way regulated data should be treated? Contact us today at sales@vso-inc.com or talk with VSO.
