HIPAA Compliance Services

What HIPAA compliance services include

HIPAA compliance services cover the work a practice needs to meet the HIPAA Security Rule for electronic protected health information (ePHI). That work is a written risk analysis, a plan to fix what it finds, required policies, business associate agreements, and the technical safeguards that make those policies real ¹. Most providers sell this as a project (the assessment and paperwork) followed by ongoing IT support that keeps the controls running.

For a small practice, "HIPAA compliance" on the IT side comes down to three things:

• You know where ePHI lives. The EHR, practice management system, email, scanned documents, imaging, billing exports, backups and staff phones.
• You have assessed the risks to it in writing. The rule calls this risk analysis and marks it required ¹.
• You run safeguards and can prove it. Policies and records must be kept for 6 years from creation or the date last in effect, whichever is later ¹.

The rule groups its standards into administrative safeguards (45 CFR 164.308), physical safeguards (164.310) and technical safeguards (164.312) ¹. Each standard has implementation specifications that are either required or addressable. Addressable does not mean optional: the practice must assess whether the specification is reasonable and appropriate and, if not, document why and adopt an equivalent measure where reasonable ¹. Our HIPAA compliance checklist walks through every standard. This page covers what to buy and what to expect from the firm you hire.

The rule applies to covered entities and to the business associates that handle ePHI for them ¹. An IT provider with access to your systems is normally one of those business associates.

The HIPAA security risk assessment comes first

The HIPAA security risk assessment (the rule's term is risk analysis) is the one deliverable no provider should skip, because it is required and because OCR keeps citing its absence. The rule calls for an "accurate and thorough assessment of the potential risks and vulnerabilities" to the confidentiality, integrity and availability of ePHI ¹.

Recent OCR actions show the pattern:

• July 2026: OSF Healthcare System paid $552,250 after a ransomware breach. OCR cited a failure to conduct an accurate and thorough risk analysis and called it its 21st ransomware enforcement action ⁵.
• September 2026: Ambry Genetics paid $700,000 and accepted a two-year corrective action plan after a phishing attack affecting 225,000 people, again with the risk analysis cited ⁶.
• August 2025: BST & Co. CPAs, an accounting firm, paid $175,000 in what OCR called the 10th enforcement action in its Risk Analysis Initiative ⁷. HIPAA reaches vendors, not only clinics.
• Small practices too: Northeast Surgical Group settled for $10,000 after a ransomware investigation in January 2025 ⁸.

A usable risk analysis report includes an inventory of the systems and locations that hold ePHI, the threats and weaknesses for each, the safeguards already in place, a likelihood and impact rating, and an overall risk level. It ends with a risk management plan: who fixes what, by when. The rule requires that risk management step too ¹. A scanner printout or a yes/no questionnaire with no ratings is unlikely to meet the "accurate and thorough" standard.

Update the analysis when something material changes: a new EHR, a move to the cloud, a new office, a merger or a security incident. The rule's evaluation standard calls for periodic technical and nontechnical review, including after environmental or operational changes ¹. Our cybersecurity risk assessment guide covers methods and frameworks in more depth.

What HIPAA compliant IT services should deliver every month

HIPAA compliant IT support is the ongoing work that keeps the safeguards true after the paperwork is done. A provider running your IT should be able to show evidence for each of these on request:

• Business associate agreement. Any provider that creates, receives, maintains or transmits ePHI for you needs a written BAA, and the rule requires those contracts ¹. The provider should also help you keep a list of every other vendor with a BAA: EHR, billing, cloud backup, email, e-fax.
• Access controls. Unique user IDs, an emergency access procedure, automatic logoff and prompt removal of departed staff ¹. Add multi-factor authentication on email, remote access and the EHR; Microsoft research found MFA cuts the risk of account compromise by 99.22% ¹⁵.
• Encryption. Encryption at rest and in transit is addressable under the current rule, so you must either encrypt or document an equivalent ¹. For laptops, phones, backups and email that carry ePHI, encrypting is almost always the simpler path.
• Audit logs and activity review. The rule requires audit controls that record activity in systems holding ePHI, plus regular review of records such as audit logs and access reports ¹. Logs nobody reads do not meet the review requirement.
• Backups and contingency plans. A data backup plan, disaster recovery plan and emergency mode operation plan are all required ¹. Ask for a restore test report, not a dashboard screenshot. See backup and disaster recovery.
• Malware protection and patching. Protection from malicious software is an implementation specification under security awareness and training ¹. In practice that means managed endpoint protection and regular patching; our managed detection and response guide covers the options.
• Training records. Security reminders, phishing awareness and sign-off sheets, filed with your documentation.

Treat "HIPAA certified" marketing as a claim to check, not a credential. The Security Rule places obligations on covered entities and business associates; it does not create a certificate a vendor can hold ¹. What counts is what the provider will sign and what evidence it produces. If Microsoft 365 runs your email, our Microsoft 365 support page covers the settings that matter.

The proposed HIPAA Security Rule changes (not final)

The HIPAA Security Rule update is still only a proposal, and HHS says the current Security Rule remains in effect while the rulemaking continues ⁴. HHS issued the proposed rule on December 27, 2024 and published it in the Federal Register on January 6, 2025 ². The federal regulatory agenda lists it as a long-term action with final action targeted for July 2027, a date that is not binding ¹¹.

As proposed, the update would:

• remove the distinction between required and addressable specifications ³
• require a written technology asset inventory and a network map ³
• require encryption of ePHI at rest and in transit, and multi-factor authentication, each with limited exceptions ³
• require vulnerability scanning at least every six months and penetration testing at least every 12 months ³
• require a compliance audit at least once every 12 months ³
• require written procedures to restore certain systems and data within 72 hours ³
• require business associates to verify their technical safeguards to covered entities at least every 12 months ³

If finalized as written, compliance would be due 180 days after the final rule's effective date ². None of this is law yet, and the final text may change. Most items on the list (MFA, encrypted and tested backups, endpoint protection, incident response plans) already appear among the controls insurers look for ¹⁶, so building them now is rarely wasted money. Our page on cyber insurance requirements lists what underwriters check.

HIPAA consultant, compliance company or managed IT provider

Small practices usually need two kinds of help: someone to assess and document, and someone to run the systems. One firm can do both, but know which role you are paying for.

When the same company writes the risk analysis and runs your IT, ask how it keeps the two apart, and whether its own tools and remote access are in scope. A good pattern for a small practice: have the risk analysis done or reviewed independently on a regular schedule and after major changes, then hold the IT provider to the remediation plan it produces. Larger groups often add a virtual CISO.

To compare IT firms, use the questions in our guide on how to choose an MSP. The healthcare IT page and dental office IT page cover practice-specific systems such as imaging and practice management software.

HIPAA compliance cost for a small practice

We have not found a neutral published survey of HIPAA risk analysis or compliance program prices, so we do not print one. Quotes vary with the number of locations, systems and staff, and with whether remediation is included.

What we can source are the pieces that usually make up the budget:

• Managed IT that carries the daily safeguards: published provider guides put fully managed IT at about $100 to $250 per user per month ¹². See managed IT pricing.
• Security leadership: one vCISO provider publishes retainers of about $1,500 to $4,000 per month for organizations with 1 to 50 employees ¹³.
• Penetration testing, which the proposed rule would make yearly: one security firm's 2026 guide puts small external network tests at $5,000 to $10,000 ¹⁴. See penetration testing.

Set that against enforcement. OCR reported 152 cases settled or resolved with a civil money penalty, totaling $144,878,972, as of October 31, 2024 ¹⁰. Settlements announced in 2026 include $140,000 for a dental practice's Privacy Rule case ⁹ and $700,000 for the Ambry phishing breach ⁶. Breach response, notification letters and downtime come on top of any settlement.

Ask every bidder for a fixed price tied to a written scope (locations, systems, users), a sample report, and separate prices for remediation work.