Medical IT Services
HIPAA IT Security That Protects Your Practice
Risk assessments, encryption, access controls, and contingency planning, the IT security foundation that supports your practice's compliance goals and keeps patient data safe.
HIPAA Isn't Optional, But It Doesn't Have to Be Overwhelming
Every medical practice that handles electronic protected health information (ePHI) is required to meet HIPAA's IT security standards. That means encryption on every device, multi-factor authentication on every system, documented risk assessments, and audit logs that prove you're doing what you say you're doing.
The problem isn't that practices don't care about compliance. It's that most IT providers don't understand healthcare well enough to implement it properly. They'll set up a firewall and call it "HIPAA compliant", when the real risks are unencrypted laptops, shared EHR logins, and backup systems that have never been tested.
We've been through the Compliancy Group certification process ourselves. We know what auditors look for because we've built the systems that pass audits.
HIPAA's Security Rule is deliberately not a checklist of specific products, it requires "reasonable and appropriate" safeguards, which means the right controls for a five-provider practice look different from a fifty-provider group. We size the six categories below to your actual practice, not a generic template, and keep the documentation current so it holds up when it matters.
HIPAA IT Security
Protect your practice from data breaches, failed audits, and six-figure fines with IT security built around HIPAA requirements.
Security Risk Assessment
It's the first thing auditors ask for, and most practices don't have a current one. We deliver audit-ready documentation that demonstrates due diligence, updated annually, no effort on your end.
Workforce Security Training
Human error causes the majority of healthcare breaches, and untrained staff are the easiest way in. We run ongoing training with simulated phishing so your team recognizes threats before they click.
ePHI Encryption & MFA
A lost laptop without encryption is a reportable breach, and a single compromised password without MFA can expose every patient record. We lock down every device and every login so one mistake doesn't become a headline.
Audit Log Management
If you can't show who accessed what and when, you can't defend yourself in an investigation. We make sure your access records are complete, monitored, and ready for any auditor who asks.
HIPAA Contingency Planning
When ransomware hits or a server dies, practices without a tested plan face days of downtime and cancelled patients. We build and test your recovery plan so you know exactly how fast you'll be back up.
Media Disposal
Old hard drives sitting in a closet are a breach waiting to walk out the door. We handle certified destruction with documentation you can file for compliance.
See how your practice measures up
These are just some of the areas covered in our comprehensive practice assessment.
Schedule Your Free AssessmentWhat the Security Rule Actually Requires
HIPAA's Security Rule is organized into three groups of safeguards, and most practices are strong in one and thin in the other two. Administrative safeguards are the paperwork and the people: your risk analysis, your sanction policy, workforce training, access authorization and termination, contingency planning, and your business associate agreements. Physical safeguards cover the building: who holds keys, whether patients can read a screen from the waiting room, and what happens to a hard drive when a workstation is retired. Technical safeguards are the systems themselves: unique logins, automatic logoff, audit controls in the EHR, authentication, and encryption in transit and at rest.
The Rule is deliberately not a product list. It asks for safeguards that are reasonable and appropriate for your size, complexity and risk, which is why a four-provider family practice and a thirty-provider multi-site group can both be doing this correctly and look nothing alike.
"Addressable" does not mean optional
This is the single most common misreading we see. Specifications in the Security Rule are marked either required or addressable. Required means you implement it. Addressable means you assess whether it is reasonable and appropriate in your environment, and if it is, you implement it. If it is not, you document why and implement an equivalent alternative that achieves the same protection. Skipping an addressable item with nothing written down is a finding, and it is one an investigator can establish from your own records in minutes.
The Security Risk Analysis Is the Document Everything Else Rests On
After any reported incident, the risk analysis is the first document requested. It is also the most commonly missing one. A defensible analysis identifies where ePHI lives, including the places people forget: the imaging workstation, the fax server, the billing company's portal, the backup sitting in a closet. It identifies threats and vulnerabilities against each of those, rates likelihood and impact, records the safeguards already in place, and assigns a risk level. Then it gets reviewed when something changes.
A risk analysis that describes an environment you no longer run is worth very little. New EHR, new location, a move to cloud imaging, a change of IT provider: each is a reason to revisit it rather than wait for the calendar.
The Clocks You Need to Know
60 days
From discovering a breach to notifying affected individuals. Discovery is when you knew or reasonably should have known, not when you finished investigating.
500
At 500 or more affected residents, HHS and prominent local media are notified within that same 60 days. Under 500, you log it and report annually.
6 years
How long policies, risk analyses and the records of your decisions have to be kept and available, under 45 CFR 164.316(b)(2)(i).
Encryption is the one control that changes the math on all of this. Properly encrypted ePHI is treated as unusable and unreadable, so a lost encrypted laptop generally does not trigger the notification machinery at all. That is why we encrypt every device as a default rather than as an upgrade.
What We Actually Deliver
A current security risk analysis with the findings tracked to closure. Full disk encryption on every workstation, laptop and server, with proof of enrollment. Multi-factor authentication on email, remote access and the EHR where the vendor supports it. Unique accounts with a documented path for turning access off the day someone leaves. Backups that are tested by restoring from them, with the test dated. A business associate agreement register with expiry dates. Workforce training with completion records per person. Audit logging retained long enough to be useful after an incident rather than during one.
We went through the Compliancy Group certification process ourselves and our technicians are HIPAA trained, so the documentation we produce is the documentation we have had to defend.
ComplianceAX Everything ComplianceAX Does
282 HIPAA requirements, 195 plain-English questions, one screen at a time. Here is what the platform actually does, and what it looks like while it does it.
The guided assessment
One easy question at a time, in everyday words, with the HIPAA rule behind every question. A two-minute setup tailors it to your practice and every answer saves as you go. Not sure? Skip it, or hand it to someone who knows.
A head start from your own documents
Private AI reads the policies you already have and suggests answers, each one carrying the exact sentence it came from. It drafts what is missing and checks your proof. It never decides. You accept every answer.
Written, practiced and proven
Every requirement carries all three facts, and so do your score, plan and packet. Each promise a policy makes gets a next step and a way to prove it, so a binder full of paper never passes for a working program.
Everyone in their own lane
Hand a question to the person who knows. Your IT team and other vendors answer the questions that are theirs, and you review every answer before it counts. Each person gets a dashboard of their own tasks, training and policies to sign.
Training that fits the job
Nobody sits through what is not theirs. Training follows each person’s duties, with a short notice for pass-through roles. Policies are versioned with electronic sign-off.
Vendors and BAAs, worked out
A prompt list helps you find every vendor who touches patient data. Their role and access decide whether you need a business associate agreement, and it is confirmed every year.
A score you can trust
The score comes from fixed rules, never from AI. Every No becomes a next step on a plan with an owner and a due date, instead of a red mark you cannot act on.
Incidents with the clock in view
A guided case file keeps the 60-day breach notification clock on screen and walks the four-factor assessment. A person always decides what is a breach.
Evidence and the auditor packet
Proof lives with the answer it supports. Every HIPAA obligation traces to a question and its evidence, and you can export everything as of any date you choose, ready for an auditor or an insurer.
A relaxing break, built to focus
One question per screen with nothing competing for your attention, beside a calm natural scene. Nature sounds and music you layer yourself, off until you choose them.
Seeing it
Built for data you cannot afford to lose
Separate by design
Database row-level security keeps each organization’s records isolated from every other.
Strong sign-in
Passwordless email sign-in, required two-step verification for owners, admins and officers, and a 15-minute idle timeout.
A tamper-evident record
An append-only, hash-chained audit log of who did what, and when.
No software can make a practice HIPAA compliant, and there is no government HIPAA certification to earn. ComplianceAX gets the work done and documented so the record is there when it is asked for.
Questions Practices Actually Ask
What's the difference between a HIPAA compliant IT provider and one that just says they are?
A generic firewall and a signed BAA is not compliance. Real HIPAA IT security means encryption on every device, MFA on every system, a current documented risk assessment, and audit logs an investigator can actually review. We've been through the Compliancy Group certification process ourselves, so we know what auditors look for firsthand.
Do we really need a new Security Risk Assessment every year?
Yes. HHS expects an SRA to reflect your current environment, not a snapshot from years ago, and it's the first document auditors ask for after any reported incident. We keep yours current with no extra effort on your end.
What actually happens if we fail a HIPAA audit or have a reportable breach?
Consequences range from corrective action plans to civil penalties that scale with the severity and duration of the gap, on top of the practical cost: patient notification, reputational damage, and staff time lost to remediation. The far cheaper path is closing gaps before an auditor or an incident finds them.
What does "addressable" mean in the HIPAA Security Rule?
It does not mean optional. Addressable means you assess whether the safeguard is reasonable and appropriate for your environment. If it is, you implement it. If it is not, you document why and put an equivalent control in its place. An addressable item that was simply skipped, with nothing written down, is a finding an investigator can establish from your own records.
How long do we have to keep HIPAA documentation?
Six years, under 45 CFR 164.316(b)(2)(i). That covers policies, your risk analyses, and the records of the decisions you made, including the reasoning behind any addressable safeguard you chose not to implement. Six years from creation or from the last date it was in effect, whichever is later.
When do we have to tell HHS about a breach?
If 500 or more residents of a state or jurisdiction are affected, HHS and prominent local media are notified within the same 60 days you have for notifying individuals. Under 500, you keep a log and report those to HHS annually. The 60 days runs from discovery, meaning when you knew or reasonably should have known, not from when your investigation finished.
Is a lost laptop always a reportable breach?
If it's encrypted and the encryption key wasn't also exposed, generally no, encryption is treated as a safe harbor. If it's unencrypted, it almost always is. That single distinction is why we encrypt every device by default rather than treating it as optional.
How Does Your Practice's Technology Stack Up?
Our comprehensive assessment covers every system that touches patient care. No cost, no obligation, just clarity on where you stand.
Schedule Your Free AssessmentAsk Us About HIPAA, Not a Chatbot
Tell us where your practice is stuck, the risk analysis, the documentation, a vendor that will not sign a BAA, and we will tell you what it actually takes to fix it.
Content on this site is for informational purposes only and does not constitute legal or compliance advice. HIPAA requirements vary by organization type and size. Consult a qualified HIPAA compliance officer for guidance specific to your practice. SE Technical's HIPAA-aligned IT services are informed by the Compliancy Group certification framework.