"HIPAA-compliant" is one of the most misused phrases in IT services marketing. It appears on MSP websites, cloud storage products, and email services — often without clear explanation of what compliance actually requires from the technology, the vendor, and the organization using it. This guide explains what HIPAA's Security Rule actually demands of your IT infrastructure, what your MSP must provide (and sign), and the specific technical and administrative controls that auditors and HHS/OCR enforcement actions focus on. Note that HHS has proposed a substantial overhaul of the Security Rule, with final action now delayed to at least July 2027 — our piece on vetting an MSP selling "2026 HIPAA readiness" covers what changed in the timeline and which proposed requirements are worth implementing early.
What HIPAA's Security Rule Covers
HIPAA's Security Rule covers electronic protected health information (ePHI) — any health information in electronic form that is created, received, maintained, or transmitted by a covered entity (healthcare providers, health plans, healthcare clearinghouses) or their business associates. The rule establishes three categories of safeguards:
Administrative safeguards (addressing policies, procedures, and personnel): security officer designation, risk analysis, risk management, workforce training, access management, and security incident procedures.
Physical safeguards (addressing physical access to systems containing ePHI): facility access controls, workstation use policies, workstation security, and device and media controls (including disposal of hardware that stored ePHI).
Technical safeguards (addressing the technology that controls access to ePHI): access controls (unique user IDs, emergency access procedures, automatic logoff, encryption), audit controls (hardware/software that records access to ePHI), integrity controls (preventing unauthorized alteration), and transmission security (encryption in transit).
Importantly, HIPAA does not specify particular technologies or products. It specifies required and addressable implementation specifications. "Required" means mandatory; "addressable" means you must either implement the specification or document why an equivalent measure serves the same purpose. This flexibility means HIPAA compliance is organizational, not just technical.
The Business Associate Agreement: Non-Negotiable
Any vendor that creates, receives, maintains, or transmits ePHI on your behalf is a Business Associate under HIPAA. Your MSP — if they have any access to systems, servers, or storage containing ePHI — is a Business Associate. Microsoft (for Microsoft 365 in healthcare use), Google (for Google Workspace in healthcare use), your backup vendor, your EMR hosting provider — all Business Associates who must sign a Business Associate Agreement (BAA) before they have access to ePHI.
A BAA is a contract between a covered entity and a business associate (or between two business associates) that specifies the permitted uses and disclosures of ePHI, requires the business associate to implement appropriate safeguards, and requires notification of breaches. Without a signed BAA, your use of any vendor that touches ePHI is a per se HIPAA violation.
Any MSP that claims to support HIPAA clients but won't sign a BAA is either not actually HIPAA-literate or is trying to avoid the liability. Walk away.
What Your MSP Must Actually Provide
A signed BAA is necessary but not sufficient. The MSP must also have the operational capability to maintain the safeguards they're agreeing to in the BAA. Key operational requirements:
Access control documentation. User accounts with minimum necessary access, documented access provisioning and de-provisioning process, evidence that terminated employees lose access within a defined period.
Encryption. ePHI at rest and in transit must be encrypted using NIST-approved encryption methods. This applies to laptops and mobile devices, backup media, cloud storage, and email containing ePHI. NIST SP 800-111 specifies approved encryption for storage; NIST SP 800-52 for transmission.
Audit logging. Systems containing ePHI must generate audit logs tracking access and modifications. Logs must be retained and reviewed. Your MSP must be able to produce audit logs as evidence for HHS/OCR investigations.
Breach detection and notification. Your MSP must have a documented process for identifying potential breaches, investigating them, and notifying you within a timeframe that allows you to meet your 60-day notification obligation to HHS/OCR.
Security Risk Analysis. HIPAA requires covered entities to conduct a security risk analysis — identifying ePHI assets, threats, and vulnerabilities. Your MSP should be able to support this analysis and provide documentation of the IT environment's security posture. The risk analysis is the single most commonly cited missing item in HHS/OCR enforcement actions.
Device Encryption and Disposal
Lost or stolen laptops and storage media are one of the most common sources of HIPAA breaches — specifically because unencrypted devices trigger mandatory breach notification even for small incidents. A laptop containing an unencrypted spreadsheet with patient data that is left in a car qualifies as a breach.
HIPAA-compliant IT requires full-disk encryption on every laptop, workstation, and mobile device that accesses or stores ePHI. BitLocker (Windows) and FileVault (macOS) are standard implementations; BYOD mobile device management (MDM) with encryption enforcement is required for personal devices used to access ePHI.
Hardware disposal must also follow HIPAA requirements. Drives containing ePHI cannot simply be donated, sold, or discarded — they must be degaussed or physically destroyed, with documentation of the disposal process retained.
Frequently Asked Questions
Does a medical practice need a HIPAA security officer?
Yes. HIPAA requires covered entities to designate a security officer responsible for developing and implementing security policies. In a small practice, this is often the practice manager or a designee — it does not require a dedicated full-time security professional. However, the person must actually perform the security officer functions (conducting risk analysis, maintaining policies, training workforce) not just hold the title.
Does Microsoft 365 sign a HIPAA BAA?
Yes. Microsoft signs BAAs for Microsoft 365 under its Online Services Terms. Not all Microsoft 365 services are HIPAA-eligible — Microsoft publishes a list of in-scope services. Confirming that the specific 365 features you use for ePHI (Exchange Online, SharePoint, Teams) are covered is necessary.
What are the penalties for HIPAA non-compliance?
HHS/OCR enforces HIPAA through civil monetary penalties ranging from $100 to $50,000 per violation (per occurrence), with annual caps by violation category. Willful neglect violations carry a minimum penalty of $10,000 per violation. Enforcement actions have increasingly targeted small practices — the $50,000 fine for a solo practice that failed to conduct a security risk analysis is a real outcome. State attorneys general can also bring HIPAA enforcement actions.
← Incident Response | PCI Compliance for Restaurants and Retail →