Many medical practices hire a managed IT provider after a frustrating experience: a server that crashed during clinic hours, a part-time IT person who moved away, or a HIPAA question nobody could answer. Then they wonder what they should actually expect from the new arrangement.
Managed IT services for a medical practice should feel different from simply calling someone when things break. Here's what a good provider should deliver, and how to tell whether you're getting it.
1. Support That Understands Clinical Workflow
A medical practice isn't a typical office. Providers can't wait two hours for a printer to work when patients are waiting. Front-desk staff need check-in systems running at 7:30 a.m. A good managed IT partner understands:
- Which systems are critical during clinic hours.
- When maintenance can safely happen.
- How the EHR, imaging, lab interfaces, and e-prescribing fit together.
- That some issues need immediate attention, not a ticket in a queue.
2. A Responsive Help Desk
Staff should know exactly how to get help and what to expect when they ask. Expect:
- Clear ways to request support, such as phone, email, or a portal.
- Defined response times based on urgency.
- Technicians who explain things in plain language.
- Follow-up when issues are resolved.
Learn more about our help desk services.
3. Proactive Monitoring and Maintenance
The best IT problems are the ones you never notice. Your provider should monitor computers, servers, network equipment, and backups so they can catch issues early. This includes installing security updates on a regular schedule, watching for failing hardware, and keeping an eye on storage space.
If you're curious what this behind-the-scenes work looks like, read what a managed IT support provider actually does all day.
4. Security Built for Healthcare
Healthcare is one of the most targeted industries for cyberattacks. Your provider should help you put core protections in place:
- Multifactor authentication for email, the EHR, and remote access.
- Endpoint protection on every computer.
- Email filtering and phishing awareness training.
- Encryption on laptops and portable devices.
- Controlled vendor remote access.
5. Help With HIPAA, Not Just Technology
A managed IT provider isn't your compliance officer, but they should make HIPAA easier. Expect help with:
- Supporting your HIPAA security risk analysis.
- Documenting technical safeguards.
- Signing a business associate agreement if they handle patient information.
- Providing records of updates, backups, and access controls.
6. Backups You Can Trust
Ask your provider to explain your backups in plain language: what's backed up, how often, where copies are stored, and how quickly systems could be restored. Expect regular restore tests and at least one copy protected from ransomware.
7. EHR and Vendor Coordination
When the EHR is slow or an interface stops working, someone needs to determine whether it's a network issue, a computer problem, or a vendor issue. A good provider takes the lead on contacting vendors and works the problem until it's fixed, rather than telling you to call someone else.
8. Planning, Not Just Fixing
Expect regular conversations about:
- Computers and equipment nearing replacement.
- Software that's approaching end of support.
- Security improvements for the coming year.
- Technology needs for new providers or locations.
This planning helps practices budget and avoid surprises.
Red Flags to Watch For
- Updates installed during clinic hours without warning.
- Long delays before anyone responds to urgent issues.
- Vague answers about backups or security.
- Unwillingness to sign a business associate agreement.
- No regular check-ins with practice leadership.
Is Managed IT Right for Your Practice?
Managed IT tends to be a strong fit for practices that have outgrown informal support, operate multiple locations, have recently faced a security scare, or want predictable support and planning. Costs depend on factors like the number of users, locations, systems, and compliance needs.
Maise Technology supports medical and dental practices with IT services designed around patient care. Learn more on our IT services for healthcare organizations page.
If you'd like to talk about what your practice needs, Schedule A 15 Minute Discovery Call.
Dental offices have a technology setup unlike most other small businesses. A single practice might run practice management software, digital X-ray sensors, a panoramic or cone beam CT machine, intraoral cameras, patient-facing tablets, and a front office that handles insurance, payments, and patient communication all day.
Many of those systems are tied to specialized software and hardware that can't simply be swapped out. That creates unique security challenges, especially around imaging.
Why Dental Imaging Systems Are a Special Concern
Imaging equipment is expensive and built to last. It's common for a sensor or panoramic unit to stay in service for many years. The computer that runs it often stays the same too, because the imaging software is certified for a specific operating system version.
That leads to familiar problems:
- Imaging workstations running older versions of Windows that no longer receive security updates.
- Imaging software that requires administrator rights to run.
- Shared logins on operatory computers.
- Vendor remote access tools installed for support and left running.
- Images stored on a local computer or server without reliable backups.
None of these come from carelessness. They usually come from keeping expensive equipment working. But together, they give ransomware and other threats an easy path.
Protecting Systems You Can't Easily Replace
Isolate older imaging computers
If a workstation must run an unsupported operating system for now, limit what it can reach. Remove internet browsing and email from it. Place it on a separate network segment that only talks to the systems it needs. This approach, called a compensating control, reduces risk until replacement is possible.
Plan upgrades with your vendors
Ask your imaging and practice management vendors which operating systems they support and when. Build upgrades into your equipment budget rather than waiting for a failure.
Separate staff and operatory accounts
Give each team member their own login for practice management software. Where operatory computers need a shared session for chairside work, keep that account limited and make sure it can't change system settings.
Control vendor connections
Imaging vendors often need remote access for updates and troubleshooting. Turn access on only when needed and remove old tools. Vendor access is one of the most common gaps in healthcare, as we explain in our article on vendor remote access.
Backing Up Patient Records and Images
Dental images take up a lot of storage, and they're often stored separately from the practice management database. Ask these questions:
- Are images included in our backups, or only the practice management data?
- Is at least one backup copy protected from ransomware?
- How long would it take to restore everything after a server failure?
- When did we last test restoring an image and a patient record?
Many practices are surprised to learn their imaging folder wasn't part of their backup at all. Ransomware is especially damaging to dental offices because both the schedule and the images are needed to treat patients. Learn more in our guide on preventing ransomware.
The Front Office Matters Too
Front office staff handle insurance portals, patient emails, and payments. Protect them with:
- Multifactor authentication on email and insurance portals.
- Short, regular phishing awareness training.
- Secure methods for sending records to specialists and labs.
- Automatic screen locks when stepping away from the desk.
HIPAA Applies to Dental Practices
Dental practices that bill insurance electronically are covered entities under HIPAA. That means the Security Rule's requirements, including a documented risk analysis, apply. Your risk analysis should specifically address imaging systems, operatory computers, and vendor access.
A Dental Practice Security Checklist
- ☐ Inventory of every computer, imaging device, and server.
- ☐ Plan for any system running an unsupported operating system.
- ☐ Imaging data included in tested backups.
- ☐ At least one ransomware-resistant backup copy.
- ☐ Individual logins for practice management software.
- ☐ Vendor remote access enabled only when needed.
- ☐ Multifactor authentication for email and portals.
- ☐ Current HIPAA security risk analysis.
Keep the Chairs Full and the Data Safe
Dental practices need technology that works reliably all day so providers can focus on patients. Maise Technology supports practices with managed IT support that understands the realities of imaging equipment and specialized software. Learn more on our IT services for healthcare organizations page.
Ready to review your practice's systems? Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice regarding HIPAA.
Healthcare practices rely on outside vendors more than ever. EHR companies, imaging equipment manufacturers, billing services, lab interface providers, and IT support firms often need some way to reach your systems.
Remote access makes that support fast and convenient. It also creates one of the most overlooked security gaps in healthcare. When a vendor's connection is always on, poorly protected, or shared among many technicians, it becomes a door that attackers can use too.
Why Vendor Access Is a Real Risk
Several well-known healthcare breaches have started with a third party rather than the provider itself. Attackers know that one vendor may connect to dozens or hundreds of practices. Breaking into the vendor, or simply stealing a technician's password, can open many doors at once.
Common problems we find in small and mid-sized practices include:
- Remote access tools installed years ago and never removed.
- Vendor accounts with permanent administrator rights.
- One shared login used by every technician at the vendor.
- No record of when vendors connect or what they do.
- Vendors with access to far more systems than they support.
The HIPAA Connection
Vendors that create, receive, maintain, or transmit protected health information on your behalf are generally business associates under HIPAA. You need a business associate agreement (BAA) with them, and they have their own obligations to protect that information.
A BAA is important, but it's a legal document, not a technical control. It doesn't stop a stolen password from working. Practices still need to manage how and when vendors connect. Your HIPAA risk analysis should include vendor access as a specific area of review.
Five Ways to Close the Gap
1. Inventory every vendor connection
Start by listing every vendor that can reach your systems remotely. Include the tool they use, which systems they access, and who at your practice approved it. Many practices discover connections no one remembers setting up.
2. Give each technician an individual account
Shared vendor logins make it impossible to know who connected. Ask vendors to use named accounts for each technician, protected with multifactor authentication.
3. Turn access on only when needed
Many practices now use "just-in-time" access. The vendor requests a session, someone at the practice approves it, and the connection is closed when the work is done. Always-on access should be the rare exception.
4. Limit what vendors can reach
An imaging vendor needs access to the imaging system, not the entire network. This idea, called least privilege, is a core part of zero trust security.
5. Log and review sessions
Keep records of when vendors connect, how long they stay, and what systems they touch. Review them periodically, and investigate anything unexpected, such as a connection at 3 a.m. on a Sunday.
Questions to Ask Your Vendors
- Which remote access tool do you use, and how is it secured?
- Do your technicians use individual accounts with multifactor authentication?
- How do you protect your own systems from compromise?
- Will you notify us promptly if you have a security incident?
- Can access be enabled only when we approve a support session?
Vendors that take security seriously will welcome these questions.
A Vendor Access Review Checklist
- ☐ Current list of every vendor with remote access.
- ☐ Signed BAAs where vendors handle patient information.
- ☐ Individual vendor accounts with multifactor authentication.
- ☐ Access limited to the systems each vendor supports.
- ☐ Remote sessions approved and closed after use.
- ☐ Session logs retained and reviewed.
- ☐ Old or unused vendor tools removed.
- ☐ Vendor access reviewed at least annually.
A Brief Example
A dermatology practice discovered during a review that a former practice management vendor still had a remote access tool installed on the front-desk computer, three years after the practice switched systems. The tool had a saved password and could connect at any time. Removing it took fifteen minutes. Leaving it in place could have exposed the entire office.
Make Vendor Access Work for You
Vendors are partners in patient care, and they need reliable ways to help you. With the right controls, practices can keep that support fast while closing a major security gap.
Maise Technology helps healthcare organizations review vendor access as part of our compliance services. Learn more on our IT services for healthcare organizations page. To review your practice's vendor connections, Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice regarding HIPAA.
Utah medical practices face a familiar mix of disaster risks. Winter storms knock out power along the Wasatch Front. Spring runoff can flood lower-level offices. Wildfire smoke and summer heat strain equipment. And like practices everywhere, Utah clinics face a growing threat from ransomware.
Any of these events can make your electronic health record unavailable. When that happens, a practice still has patients in the waiting room, prescriptions to manage, and appointments to keep. A strong disaster recovery plan is what keeps a bad day from becoming a bad month.
What HIPAA Expects
The HIPAA Security Rule includes a contingency plan standard. Covered entities must have a data backup plan, a disaster recovery plan, and an emergency mode operation plan. The rule also addresses testing those plans and identifying which applications and data are most critical.
For a small practice, that doesn't mean a binder the size of a phone book. It means having clear, written answers to how you'll protect patient data, restore systems, and keep caring for patients during a disruption.
Five Ways to Strengthen Your Practice's Recovery
1. Know where your patient data actually lives
Many Utah practices now use cloud-based EHRs. That shifts some backup responsibility to the vendor, but not all of it. You still need to know:
- How often your EHR vendor backs up data, and how quickly they can restore it.
- Whether local systems, such as imaging, lab interfaces, or scanned documents, are backed up separately.
- What happens if your office internet goes down even though the EHR is working fine.
2. Protect at least one backup from ransomware
Ransomware attackers deliberately look for backups to delete or encrypt. Keep at least one backup copy that's offline, immutable (meaning it can't be changed), or otherwise isolated from your everyday network.
3. Plan for internet outages, not just disasters
For cloud-based practices, a cut fiber line can be as disruptive as a server failure. A backup internet connection, often a cellular option, can keep the front desk and providers connected through common outages.
4. Prepare an EHR downtime kit
Every practice should have a simple downtime kit that staff can use when the EHR is unavailable:
- A printed or offline copy of the day's schedule, updated each evening.
- Paper encounter forms and prescription pads where permitted.
- A list of key phone numbers for pharmacies, labs, and referral partners.
- Instructions for entering paper records once systems return.
5. Test the plan
Testing doesn't have to interrupt patient care. Try restoring a single file or a test database after hours. Run a short tabletop exercise during a staff meeting: "It's 8 a.m. and the EHR is down. What do we do?" You'll quickly find gaps.
Setting Recovery Targets
Two terms help practices decide how much protection they need:
- Recovery time objective (RTO): how long a system can be down before patient care or operations are seriously affected.
- Recovery point objective (RPO): how much data you could afford to lose and re-enter, measured in time.
A practice might decide the EHR needs to be back within four hours, while the shared drive for administrative documents can wait a day. Those decisions guide what kind of backup and recovery tools make sense.
Regional Considerations for Utah Practices
Utah practices should consider risks specific to their area:
- Earthquake planning: The Wasatch Fault runs beneath many Utah communities. Store offsite or cloud backups somewhere that wouldn't be affected by the same local event.
- Winter weather: Plan for staff who can't get to the office and for providers who may need secure remote access.
- Multi-location groups: Practices with clinics in Salt Lake, Davis, Weber, and Cache counties should decide whether one location can temporarily support another.
A Utah Practice Disaster Recovery Checklist
- Written backup, disaster recovery, and emergency mode plans.
- At least one ransomware-resistant backup copy.
- Confirmed EHR vendor recovery commitments.
- Backup internet connection.
- EHR downtime kit at every location.
- At least one test per year, documented.
Keep Caring for Patients When Systems Fail
Disasters rarely give advance notice. The practices that recover fastest are the ones that planned on a calm day. Maise Technology helps healthcare organizations build recovery plans through our disaster recovery services. You can learn more about our healthcare work on our IT services for healthcare organizations page, and about our local support on our Salt Lake City managed IT services page.
Want to review your practice's recovery readiness? Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice regarding HIPAA compliance.
The front desk of a medical office might be the busiest workstation in the building. In a single morning, the receptionist checks in patients, answers phones, verifies insurance, scans documents, schedules follow-ups, and handles faxes and emails from labs, pharmacies, and other practices.
That combination of speed, volume, and trust makes the front desk a prime target for phishing. Attackers don't need to break through firewalls if they can convince a busy employee to click a link or enter a password.
The challenge is training staff to slow down for suspicious messages without slowing down patient care. Here's how practices can strike that balance.
Why the Front Desk Gets Targeted
Front-office staff interact with more outside parties than almost anyone else in the practice. They're used to receiving unexpected documents, referrals, and requests. Phishing messages blend right in when they look like:
- A referral from another provider with an attached "patient file."
- An insurance company asking staff to log in and verify a claim.
- A voicemail or fax notification with a link to "listen" or "view."
- A message from the EHR vendor about a required password reset.
- A patient asking for help with the portal, along with a suspicious link.
One wrong click can give an attacker access to email, scheduling systems, or even the EHR.
What HIPAA Expects
The HIPAA Security Rule includes a security awareness and training standard for workforce members. Practices are expected to train staff on security matters that fit their roles, including protection from malicious software and password management. Training is also a natural place to address phishing, since it's one of the most common ways health information is exposed.
Training That Fits a Busy Front Desk
Long annual slideshows rarely change behavior. Short, practical, and frequent training works better for people who are constantly interrupted.
Keep sessions short
Ten to fifteen minutes is plenty. Many practices hold a quick session during a staff huddle once a month instead of one long annual meeting.
Use real examples from healthcare
Generic phishing examples about package deliveries don't resemble what front desk staff see. Show them fake referral emails, fake insurance portals, and fake EHR alerts.
Teach one simple rule
Instead of a long list of warning signs, give staff one dependable habit: "If a message asks you to log in, open an unexpected file, or change payment details, verify it another way first." That might mean calling the sender at a known number or checking with the office manager.
Run gentle phishing simulations
Simulated phishing emails show who might need more help. The goal isn't to embarrass anyone. When someone clicks, the response should be a short, private learning moment.
Celebrate reporting
Make it easy to report a suspicious message, and thank people who do. Staff who fear blame are more likely to stay quiet after a mistake, which gives attackers more time.
Protecting the Front Desk With Technology
Training works best when technology catches what people miss. Helpful protections include:
- Multifactor authentication on email and the EHR, so a stolen password alone isn't enough.
- Email filtering that blocks known malicious links and attachments.
- External email banners that warn staff when a message comes from outside the practice.
- Individual logins instead of a shared front-desk account.
- Automatic screen locks when staff step away to help a patient.
Weak or reused passwords make phishing more damaging. Our article your password is the key under the doormat explains why.
A Front-Desk Phishing Checklist
- Each staff member has their own login.
- Multifactor authentication is on for email and the EHR.
- Staff know the "verify another way" rule.
- A simple reporting process exists, such as a report button or a designated person.
- Short training happens at least quarterly.
- Training completion is documented for HIPAA records.
A Realistic Scenario
A receptionist receives an email that appears to come from a local specialist's office. It says, "Updated records for your patient attached. Log in to view." The login page looks like the practice's email provider.
Because she learned the "verify another way" rule during last month's huddle, she calls the specialist's office at the number in the practice's contact list. They never sent the email. She reports it, the office manager blocks the sender, and patient check-in continues without missing a beat.
That's the goal: security that fits naturally into the workflow.
Supporting Your Team
Front desk staff are your first line of defense, and they deserve tools and training that make the job easier, not harder. Maise Technology helps practices put practical cybersecurity protections in place. Learn more on our IT services for healthcare organizations page.
Have questions about training your staff? Get In Touch.
Short answer: Yes. Under the HIPAA Security Rule, every covered health care provider that handles electronic protected health information must conduct an accurate and thorough risk analysis. That includes a three-provider family practice, a solo therapist, and a small dental office. Size changes how detailed the analysis needs to be, but not whether it's required.
Below, we explain what a security risk analysis is, what it usually covers, how often to do one, and how small practices can get it done without stopping patient care.
What Is a HIPAA Security Risk Analysis?
A security risk analysis is a structured review of how your practice protects electronic patient information, often called ePHI. It answers three basic questions:
- Where does patient information live and travel in our practice?
- What could realistically go wrong with it?
- How likely and how harmful would each problem be?
The requirement comes from the HIPAA Security Rule's administrative safeguards at 45 CFR 164.308(a)(1)(ii)(A). The U.S. Department of Health and Human Services publishes guidance on risk analysis that explains what regulators expect.
Isn't This Just for Hospitals?
No. This is one of the most common misunderstandings we hear from small practices. HIPAA applies to covered entities based on what they do, not how big they are. If your practice bills insurance electronically, you're almost certainly a covered entity.
The rule is designed to scale. HHS expects a small practice's analysis to reflect its size, budget, and technology. A clinic with five computers and a cloud-based EHR won't need the same documentation as a hospital system. It still needs a real analysis, written down.
What a Risk Analysis Usually Covers
A useful analysis looks at technology, people, and procedures together. Common areas include:
- Where ePHI is stored: EHR systems, imaging software, billing platforms, email, scanned documents, and personal devices.
- Who can access it: staff accounts, shared logins, former employees, vendors, and remote access.
- How it's protected: passwords, multifactor authentication, encryption, and screen locks.
- Backup and recovery: whether you can restore patient records after a ransomware attack or hardware failure.
- Physical security: front-desk screens, unlocked server closets, and paper records near computers.
- Vendors: business associates who handle patient data on your behalf.
For each risk, the analysis should note how likely it is and how much harm it could cause. That's what turns a list of worries into a plan.
Risk Analysis vs. Risk Management
These two terms are related but different. The risk analysis identifies and rates risks. Risk management is what you do about them. HIPAA requires both. Finding a problem and leaving it alone doesn't meet the intent of the rule.
A practical approach is to rank findings by priority and assign each one an owner and a target date. For example, "Turn on multifactor authentication for the EHR" might be a high-priority item for this month. "Replace the aging front-desk computer" might be planned for next quarter.
How Often Should a Practice Do One?
The HIPAA Security Rule doesn't set an exact schedule. It expects risk analysis to be an ongoing process. Many practices review their analysis at least once a year. You should also update it after major changes, such as:
- Switching EHR or practice management systems.
- Opening a new location.
- Moving to cloud services.
- Experiencing a security incident.
- Adding remote work or telehealth.
What About the Proposed HIPAA Security Rule Changes?
HHS proposed significant updates to the HIPAA Security Rule in January 2025. As of this writing, those changes have not been finalized, and federal regulators have signaled that final action won't come until at least mid-2027. The current Security Rule, including the risk analysis requirement, remains fully in effect. Practices shouldn't wait for new rules to address the requirements already on the books.
Free Tools and Where They Fit
The Office of the National Coordinator for Health IT offers a free Security Risk Assessment Tool designed for small and medium-sized providers. It walks you through questions and helps organize your answers.
The tool is a solid starting point. Keep in mind that it records what you tell it. If nobody on your team knows how backups are configured or which vendors still have remote access, the results will have gaps. That's where an outside review often helps.
Frequently Asked Questions
Is a vulnerability scan the same as a risk analysis?
No. A vulnerability scan checks computers for technical weaknesses. It can be one input to a risk analysis, but it doesn't cover people, procedures, vendors, or physical security.
Do we need an outside company to do it?
HIPAA doesn't require outside help. Many small practices still use a third party because staff are busy and an independent view tends to catch blind spots.
What happens if we never did one?
Start now. A current, documented analysis with an active remediation plan is far better than none. The HHS Office for Civil Rights has repeatedly cited missing risk analyses in enforcement actions.
Getting It Done Without Disrupting Patients
Most small practices can complete a solid analysis with a few short interviews, a review of systems, and a written report with priorities. It doesn't need to take your front desk offline.
Maise Technology helps practices meet compliance requirements with practical, plain-language findings. You can also read about our approach on our IT services for healthcare organizations page, or see how a cybersecurity risk assessment works in general.
Have a question about where your practice stands? Get In Touch and we'll point you in the right direction.
This article provides general information and is not legal advice. Consult qualified counsel about your practice's specific HIPAA obligations.
