HIPAA Compliant IT Services for Healthcare Providers

Key Takeaways

• BastionX implements and maintains Security Rule safeguards based on your risk analysis. Formal assessments and audits are outside our scope. Your organization stays responsible for its risk analysis and periodic evaluation, done internally or with qualified outside support.
• The current Security Rule requires audit controls, activity review, unique user IDs, and security incident procedures. Encryption is addressable, which means you must assess it and document your decision. It does not mean optional.
• The January 2025 proposal would require MFA, encryption, and 72-hour restoration for certain systems. HHS has not finalized it, so it is still a proposal, not a requirement.
• OCR's Risk Analysis Initiative is producing settlements. Its first, a $90,000 settlement with an Oklahoma ambulance authority, followed a ransomware attack affecting 14,273 people.
• BastionX runs managed IT and cybersecurity as one team and signs a BAA when its services make it a business associate. Your organization keeps its own HIPAA obligations.

Stop Managing Gaps and Start Implementing HIPAA Controls

HIPAA compliant IT services close the gaps you already know about.

Your last risk assessment handed you a list. Maybe it flagged incomplete audit logging, inconsistent access controls, or workforce devices nobody fully manages. Knowing what's broken is the easy part. Fixing it, and keeping it fixed, without pulling your staff away from patient care is where the work is.

The gap between identifying a problem and remediating it can leave known risks unresolved when responsibilities, resources, and deadlines are unclear. Advisory work tells you where you stand. Implementation changes your posture.

HIPAA compliance: Meeting the HIPAA requirements applicable to your organization, including the Privacy, Security, and Breach Notification Rules. This page focuses on the administrative, physical, and technical safeguards that protect electronic protected health information (ePHI) under the Security Rule.

The stakes are large. According to HHS's 2024 Report to Congress on Breaches of Unsecured Protected Health Information, 663 breaches affecting 500 or more people exposed the health information of more than 242 million individuals in 2024. About 192 million of those came from a single incident, the Change Healthcare ransomware attack. HHS also noted that many breaches could have been prevented through proactive compliance rather than fixing security issues after exploitation.

Proactive means controls are built, monitored, and maintained before an auditor or an attacker forces the issue. BastionX delivers managed IT and cybersecurity from one team, so the people managing your endpoints are the same people watching them. If you already have a list of findings, that list is where we start.

The Technical Requirements: What HIPAA Compliant IT Looks Like in Practice

HIPAA compliant IT support is a set of safeguards your systems enforce every day, backed by records that show they work.

The HIPAA Security Rule requires administrative, physical, and technical safeguards. The following are selected operational priorities, rather than a complete compliance checklist:

• Audit controls and activity review. Section 164.312(b) requires mechanisms to record and examine activity in systems containing or using ePHI. Section 164.308(a)(1)(ii)(D) separately requires regular review of system activity records.
• Access controls. Unique user identification and emergency access procedures are required. Automatic logoff is addressable. Access authorization should reflect job responsibilities and applicable minimum-necessary requirements.
• Encryption at rest and in transit. Encryption is addressable under the current rule. Organizations must assess whether it is reasonable and appropriate, implement it when it is, and document their rationale and any reasonable and appropriate equivalent alternative when it is not. Addressable does not mean optional.
• Authentication and MFA. The current rule requires identity verification but does not specifically require MFA across all systems. MFA should be evaluated through risk analysis and risk management. The January 2025 proposal would add specific MFA and encryption requirements, with limited exceptions. Those proposed provisions are not current requirements.
• Security incident procedures. Organizations must identify and respond to suspected or known incidents, mitigate harmful effects where possible, and document incidents and outcomes. Exercises help evaluate readiness.

OCR enforcement shows why risk analysis has to lead to documented action. Bryan County Ambulance Authority in Oklahoma paid $90,000 after a ransomware incident affecting 14,273 individuals, the first enforcement action announced under OCR's Risk Analysis Initiative. OCR found the organization had not conducted a compliant risk analysis. The settlement also required corrective measures, including risk analysis, risk management, policy updates, and workforce training.

Zero Trust: A security approach that does not grant implicit trust based solely on network location or device ownership. Access decisions consider identity, policy, and available context, with access reassessed as conditions change and the technology supports it.

Zero Trust can support HIPAA safeguards through least-privilege access, authentication, segmentation, and monitoring. HIPAA does not require a Zero Trust architecture or a specific ZTNA product. Compliance depends on how your organization implements and maintains its applicable safeguards, policies, and procedures.

Help desk capabilities vary by provider and service agreement. Ask who manages access permissions, who reviews activity records, who investigates suspicious behavior, and who documents the fix. Your team should be able to explain which activities are recorded, how records are reviewed, and how identified issues are addressed. If nobody can produce last quarter's privileged-access records, find out why before an investigator asks.

HHS does not recognize private Security Rule certifications as proof of compliance. Independent assessments can help evaluate safeguards, but a certificate does not remove an organization's obligations or prevent an OCR investigation.

Why Integrated IT and Cybersecurity Works for Healthcare

Coordinating IT management and cybersecurity helps healthcare organizations assign responsibility, address findings, and maintain supporting records.

When those functions sit with different teams, every finding needs a handoff, and every handoff needs an owner. Black Book's 2024 industry report, published in December 2023, found that nearly 85% of surveyed executives expressed concern about breach readiness when cybersecurity rested solely with the CIO. That points to a need for dedicated security oversight, whoever provides it.

BastionX connects help desk and security operations through shared procedures for identity verification, access management, incident escalation, and remediation. When an alert fires, the people investigating it can also correct the configuration and track the fix. Responsibilities and service coverage are defined in the engagement.

SOC records can support compliance evidence, alongside risk analyses, policies, training records, agreements, and other documentation. Records must be collected, retained, reviewed, and made available through deliberate processes. BastionX's own 24/7 U.S.-based SOC collects and correlates security logs from the systems in the engagement as part of its daily work.

One team also means one contract and one set of escalation paths to manage.

Essential Services: Help Desk, Backup, and Disaster Recovery

The HIPAA Security Rule requires covered entities and business associates to implement applicable administrative, physical, and technical safeguards. Support, backup, and recovery services should be designed around those requirements and your organization's risk analysis.

OCR enforcement addresses both implementation failures and gaps in required policies, procedures, and documentation. When evaluating a managed IT provider, confirm what the provider implements, what evidence it maintains, and which responsibilities remain with your organization.

HIPAA Compliant Help Desk

Support access to systems containing ePHI should be authorized, appropriately restricted, and recorded. BastionX configures technician access and remote support procedures for the systems covered by the engagement.

Remote connectivity runs on CipherNet, BastionX's own fork of an open source WireGuard mesh platform, which we maintain, host and operate. Deployment includes configuring access policies and the network connectivity each environment needs.

• Technician authentication and MFA through supported access tools
• Permissions limited to authorized support responsibilities
• Connection and support activity records retained under documented policies

HIPAA Compliant Data Backup

HIPAA compliant data backup protects ePHI and gives you a reliable way to restore it. The Security Rule requires a data backup plan for maintaining retrievable exact copies of ePHI.

BastionX defines backup schedules, retention, access restrictions, encryption, and recovery procedures for the systems in the engagement. Where supported and configured, immutable copies restrict alteration or deletion during a defined retention period, which matters when ransomware goes looking for your backups. Offline or isolated copies add further separation from production systems.

• Encryption at rest and in transit using supported security settings
• Documented immutability, isolation, and retention settings
• Monitored backup jobs and scheduled restoration tests

HIPAA Compliant Disaster Recovery and Contingency Planning

Contingency Plan: Policies and procedures for responding to emergencies affecting systems containing ePHI, including data backup, disaster recovery, and maintaining critical operations while protecting ePHI.

The current Security Rule does not impose a universal 72-hour restoration deadline. The January 2025 proposal would introduce a 72-hour restoration requirement for certain systems and data, but that provision is not in effect.

BastionX develops recovery runbooks, schedules testing, and supports recovery under the engagement's agreed scope, so your plan gets exercised instead of filed. Recovery objectives reflect clinical needs, system dependencies, available infrastructure, and your risk analysis.

• Documented recovery time objectives (RTO) and recovery point objectives (RPO)
• Scheduled DR testing with documented results
• Recovery support from our 24/7 U.S.-based SOC under agreed procedures

Endpoint Hardening and MDM

Endpoint hardening reduces exposure by configuring supported devices, restricting unnecessary functions, and addressing vulnerabilities. BastionX uses Microsoft Intune for supported device management and Microsoft Entra Conditional Access to apply access policies to supported resources. Cloud workloads get controls appropriate to their platforms.

The CIS Critical Security Controls help prioritize security activities. Product-specific CIS Benchmarks can guide configuration settings, adapted to your operational requirements.

• Device compliance policies and wipe or retire actions where supported by the platform and enrollment type
• Conditional Access policies using identity and available device-compliance signals
• Patching and restrictions on unnecessary services or ports within the managed scope

The Cost of Compliance vs. The Cost of Noncompliance

Managed IT and security services can make routine security spending more predictable while helping reduce the likelihood and impact of incidents.

Healthcare organizations are spending accordingly. Black Book's 2024 industry report found an 18.7% increase in healthcare enterprise spending on security risk management technology, managed services, and outsourcing between 2022 and 2023.

An agreement defines recurring fees, included services, and additional charges. An incident has no such ceiling. Its cost depends on the affected systems, recovery needs, notification obligations, and any enforcement action. Bryan County Ambulance Authority's $90,000 settlement also came with a three-year corrective action plan.

Using one provider for IT and security can simplify coordination and cut duplicated work. Whether it costs less than two depends on comparable service scope, licensing, staffing, and response commitments, so compare like for like.

HIPAA generally requires a Business Associate Agreement (BAA), or another permitted arrangement, when a covered entity engages a business associate to handle protected health information on its behalf.

Business Associate: A person or organization outside the covered entity's workforce that performs certain functions or services involving protected health information on the entity's behalf. The definition also includes certain subcontractors and is not limited to electronic information.

BastionX executes a BAA when its services make it a business associate. Relevant subcontractors also require appropriate agreements. Business associates have direct HIPAA obligations, and the client keeps its own compliance responsibilities. Clear service responsibilities and appropriate agreements matter whether you use one provider or several.

From the field

Rashid Ahmed, CISSP, CISO & CTO

I spent 17 years at Payomatic, progressing through technology and security leadership roles to become CISO. My work included implementing PCI DSS controls to support Level 1 validation requirements, implementing NYDFS Part 500 requirements, managing incident response and vendor risk, and reporting to executive leadership. I also worked with auditors on security controls supporting SOC 2 examinations.

Across those programs, the pattern held. An assessment produces findings. Findings only close when someone owns each one, puts a control into operation, and keeps evidence that shows it working. HIPAA has its own requirements and its own enforcement process, and we treat them that way. The discipline of turning findings into maintained controls is the same, and it's how we approach HIPAA implementation.

What the First 30 Days Look Like

During the first 30 days, BastionX works with your team to understand your environment, take over support, and identify what needs attention first. We review user access, devices, Microsoft 365, network configurations, backups, and existing security controls. If you have a HIPAA risk assessment, we read it under NDA and map its findings to remediation work.

We then put the agreed monitoring and patching services in place and build a prioritized improvement plan with clear responsibilities. You receive an inventory of systems and devices, an access-control summary, and an action plan for identified risks. Initial onboarding typically takes two to four weeks, depending on the size and complexity of your environment and access to the outgoing provider. Scope and timing follow your agreement.

Frequently Asked Questions

What are HIPAA compliant IT services?

Managed IT and security services designed around the HIPAA Security Rule's safeguards and your risk analysis. They cover work such as access management, audit logging, backup, recovery testing, endpoint management, and security monitoring. The provider implements and maintains agreed controls. Your organization keeps its compliance obligations.

Does BastionX do HIPAA risk assessments or audits?

No. BastionX implements and maintains safeguards. Your organization can perform its risk analysis and periodic evaluation internally or bring in qualified outside support, such as PKF O'Connor Davies (PKFOD). Bring us the findings, and we'll build an agreed remediation plan.

Can a vendor certify my organization as HIPAA compliant?

No. HHS does not recognize private Security Rule certifications as proof of compliance. Independent assessments can help evaluate safeguards, but they do not remove your obligations or prevent an OCR investigation.

Does HIPAA require MFA and encryption?

Under the current rule, encryption is addressable: you must assess it, implement it when reasonable and appropriate, and document your decision either way. MFA is not specifically required, but your risk analysis should evaluate it. The January 2025 proposal would require both, with limited exceptions. It is not yet in effect.

Is the 2025 HIPAA Security Rule update in effect?

No. HHS published the proposal on January 6, 2025, and has not issued a final rule. Its proposed provisions, including MFA, encryption, and 72-hour restoration requirements, are not current requirements.

Are HIPAA compliance services the same as HIPAA consulting?

Not at BastionX. Our HIPAA compliance services cover implementation: configuring, monitoring, and maintaining the safeguards your risk analysis calls for, and keeping the records that show they work. Consulting engagements and formal assessments go to firms such as PKFOD.

Will BastionX sign a Business Associate Agreement?

Yes, when our services make us a business associate. Relevant subcontractors also require appropriate agreements.

What should a HIPAA compliant help desk do differently?

It should verify identity before granting support access, limit technician permissions to what each task requires, and keep records of support activity under documented policies. Ask any provider to show you how those records are reviewed.

How We Researched This Guide

This guide draws on the HHS Security Rule guidance, the regulation text at 45 CFR Part 164, Subpart C, and the business associate definition at 45 CFR 160.103. Proposed changes are described from the HHS notice of proposed rulemaking published January 6, 2025, and their status was checked in November 2026. Enforcement details come from HHS's Bryan County Ambulance Authority resolution agreement and HHS's 2024 Report to Congress on Breaches of Unsecured Protected Health Information. Spending and readiness figures come from Black Book Market Research's 2024 State of the Healthcare Cybersecurity Industry. Implementation guidance also reflects NIST SP 800-66 Rev. 2.

The implementation sections draw on Rashid Ahmed's experience developing security programs, implementing safeguards, and supporting audits in regulated environments. The guide separates legal requirements from implementation choices such as security operations centers, Zero Trust architecture, and specific tools.

BastionX's service descriptions explain how the company implements, monitors, and maintains security controls. Each engagement defines the services provided and the responsibilities retained by the client.