IT for practices that hold patient data.
A small practice holds the same kind of patient information as a hospital, usually without anyone on staff whose job is IT. We protect it on every device, back it up, and keep the clinical software you depend on running.
We handle the technology part. It's one part.
HIPAA expects a practice to protect patient information: control who can see it, keep it from being lost or exposed, and be able to get it back. Much of that is policy and day-to-day practice that stays with you: who in the office can see what, how staff handle records, which vendors you share data with.
The technology side is where we come in. We set it up, keep it running, and document it, so when someone asks how patient data is protected, you have a concrete answer.
What the technology side covers
- Encryption on every computer, so a lost laptop doesn't expose patient records. Device management
- Remote lock and wipe for a lost, stolen or retired device.
- Strong passwords and screen locks enforced, and access removed when staff leave.
- Managed security on every machine, with a person checking on it every day. Managed security
- Daily off-site backup of patient data, with a technician doing the restore. Cloud backup
- A separate backup of practice email in Microsoft 365 or Google Workspace. Cloud app backup
Some computers in a practice can't be treated like the rest.
Clinical software
Records, scheduling and billing systems often come from a small vendor, run on an older platform, and don't forgive a careless update. We document how yours runs, write down how it should be handled, and keep the vendor's contact details where we can find them when something goes wrong.
Medical-device workstations
A computer attached to imaging or diagnostic equipment often has to follow the equipment maker's rules about updates and software. We identify those machines and handle them separately from the rest of the office, with the requirements written into your documentation.
Our advice to one practice: don't spend the $15,000.
- Solo chiropractic practice, Portland
- Silver plan
- Fragile legacy records software
The situation
The practice's clinical records ran on a fragile, older desktop application on the front-desk computer, unstable enough that staff had been told never to power the computers off. The software vendor quoted roughly $15,000 in one-time licensing, plus monthly fees, to move it to the cloud.
What we did
Worked out the math against how long the practice planned to keep using the system. It didn't add up, so we recommended not doing the migration, and secured what was there instead: managed security and monitoring on the machines, a written procedure for handling the fragile application, and a backup path for the data that matters.
The result
The practice kept the $15,000 and got the protection it needed.
Silver or Gold for a practice?
Most practices fit Gold. Without encryption, a lost laptop with patient records on it can turn into a breach you have to report. With encryption and remote wipe, it's an inconvenience. A practice whose computers stay in the office may fit Silver; the practice above is on Silver. Compare the packages
Practices ask us.
Will working with you make us HIPAA compliant?
Will you sign a business associate agreement?
Our records software is old. Will you make us replace it?
What happens if a laptop is lost or stolen?
Tell us what's not working.
Tell us how many computers and people you have, and we'll send a real number, not a range. If we're not the right fit, we'll say so.