--- title: "HIPAA Compliance: The Difference Between \"We're Careful\" and \"We Can Prove It\"" description: "What HIPAA-compliant IT services actually require: BAAs, real risk assessments, encryption, access controls, and audit logs." image: https://mann.cloud/hubfs/TEMPLATE%20(2).png --- [Skip to the main content.](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#main-content) [![M-Side Mann IT Wide](https://mann.cloud/hs-fs/hubfs/Logos/M-Side%20Mann%20IT%20Wide.png?width=2210&height=488&name=M-Side%20Mann%20IT%20Wide.png "M-Side Mann IT Wide")](https://mann.cloud) [![M-Side Mann IT Wide](https://mann.cloud/hs-fs/hubfs/Logos/M-Side%20Mann%20IT%20Wide.png?width=2210&height=488&name=M-Side%20Mann%20IT%20Wide.png "M-Side Mann IT Wide")](https://mann.cloud) - [HOME](https://mann.cloud) - [ABOUT US](https://mann.cloud/about-us) - [INDUSTRIES](https://mann.cloud/industries) - [SERVICES](https://mann.cloud/services) - [BLOG](https://mann.cloud/blog) [![CONTACT US](https://no-cache.hubspot.com/cta/default/49254179/interactive-222557696573.png)](https://mann.cloud/hs/cta/wi/redirect?encryptedPayload=AVxigLKQT03QH6zqKrqacyg%2F5YTPY%2Fov%2F4NrETY8mLaFZOO5CAvIHdCiS16zAt3GI8VLfq7sBqlbZz351l6sHikAw3Loce%2F8SiSdQ9ORwH0cWS2s7Mw4idA%2BVxbvafDPlJImMrbobux2cBOuR3AENbAwbB501bwb23UzFgCNFXA1nWqcBC46IOCieZlQYexNxp8IynbBiMM%3D&webInteractiveContentId=222557696573&portalId=49254179) Toggle Menu Toggle Menu [![CONTACT US](https://no-cache.hubspot.com/cta/default/49254179/interactive-222557696573.png)](https://mann.cloud/hs/cta/wi/redirect?encryptedPayload=AVxigLKQT03QH6zqKrqacyg%2F5YTPY%2Fov%2F4NrETY8mLaFZOO5CAvIHdCiS16zAt3GI8VLfq7sBqlbZz351l6sHikAw3Loce%2F8SiSdQ9ORwH0cWS2s7Mw4idA%2BVxbvafDPlJImMrbobux2cBOuR3AENbAwbB501bwb23UzFgCNFXA1nWqcBC46IOCieZlQYexNxp8IynbBiMM%3D&webInteractiveContentId=222557696573&portalId=49254179) - [HOME](https://mann.cloud) - [ABOUT US](https://mann.cloud/about-us) - [INDUSTRIES](https://mann.cloud/industries) - [SERVICES](https://mann.cloud/services) - [BLOG](https://mann.cloud/blog) 7 min read # HIPAA Compliance: The Difference Between "We're Careful" and "We Can Prove It" [Chris Mann](https://mann.cloud/blog/author/chris-mann) : Published October 20, 2026 [IT Support](https://mann.cloud/blog/tag/it-support) [Compliance](https://mann.cloud/blog/tag/compliance) ![HIPAA-Compliant IT Services](https://mann.cloud/hs-fs/hubfs/TEMPLATE%20(2).png?width=900&height=600&name=TEMPLATE%20(2).png) "HIPAA compliant" is either a checkable list or a sales phrase. Here's how to tell which one you're getting.  --- **TL;DR:** Plenty of IT providers will call themselves HIPAA compliant in a sales conversation. Fewer can show you what's backing that claim up. Encryption that's actually configured and verified, individual logins instead of one shared password, audit trails that survive long enough to matter. Here's the specific, checkable list every provider serving your practice should be able to prove, not just say.  --- Anyone can say they're healthy. Feel fine, sleep okay, no complaints. But that's a feeling, not a result, and it's exactly why a doctor still pulls bloodwork at your yearly physical instead of taking your word for it. "I feel fine" and "my numbers came back clean" are two different claims, and only one of them can actually be checked. IT providers who describe themselves as "HIPAA compliant" work the same way more often than practices realize. Plenty of vendors will say the phrase in a sales conversation without a signed Business Associate Agreement, a documented risk assessment, or the technical controls to back it up. The words cost nothing. The paperwork and the actual controls behind them are what make the claim real, and they're also what protect your practice if the Department of Health and Human Services (HHS) or its Office for Civil Rights (OCR) ever comes asking. That distinction matters more now than it used to. More of a practice's daily operations run through cloud tools than ever, which means more vendors are touching patient data and more opportunities for a gap between what a provider says and what they've actually built. A vague "yes, we're compliant" doesn't hold up the same way it might have a few years ago, not with the volume and sophistication of the threats practices are actually facing. None of this means you need to become a compliance expert yourself. It means knowing which five or six things to ask about, specifically, so you can tell a provider who's built the real thing from one who's borrowing the language. This post is narrower and more specific than a general overview: the exact list your IT provider needs to check off before "HIPAA compliant" means anything more than a phrase in a proposal. ### Table of Contents 1. [Legal Contract: The BAA That Actually Covers Subcontractors](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#LegalContract) 2. [Risk Assessment: What "Full" Really Means](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Risk) 3. [Data Encryption: What Should Be Non-Negotiable](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Data) 4. [User Access: Beyond a Shared Password](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#User) 5. [Audit Trails: The Log That Has to Survive Six Years](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Audit) 6. [How to Ask a Provider to Prove Each One](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Howto) 7. [The List That Separates Compliant From "Compliant"](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#TheList) 8. [Key Takeaways](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Key) 9. [Frequently Asked Questions](https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it#Frequently) ## Legal Contract: The BAA That Actually Covers Subcontractors Every IT provider working with your practice needs a signed Business Associate Agreement. Not a general services contract with HIPAA mentioned somewhere in a paragraph. An actual BAA. HHS is specific about what one has to spell out: what the provider's allowed to do with your ePHI, a requirement that they implement Security Rule safeguards, a requirement that they report any breach or unauthorized disclosure back to you, and here's the part people miss: a requirement that any subcontractors they bring in meet that same standard. That last piece is where a lot of agreements fall short. If your IT provider uses a third-party backup service or a remote monitoring tool, that vendor needs to be covered too. Either your provider's already got an agreement with them, or there's a documented chain of responsibility you can actually trace. A provider who can't explain where their subcontractors fit into this picture hasn't finished the job. Doesn't matter if you've got a signed BAA with their name on it sitting in a file cabinet somewhere. ## Risk Assessment: What "Full" Really Means A "basic vulnerability scan" and a full Security Risk Assessment get described interchangeably in a sales pitch sometimes, and they're not the same thing. Not even close. A vulnerability scan checks your systems against known technical weaknesses. That's it. A full risk assessment, following the structure in NIST Special Publication 800-66 Revision 2, goes a lot further. It finds everywhere ePHI lives across your systems, documents realistic threats and vulnerabilities, evaluates your existing safeguards, assigns risk levels, and produces a written record with an actual remediation plan attached. Not just a list of problems somebody hands you and walks away from. The remediation tracking part matters more than people expect. A risk assessment that finds a problem and stops there isn't finished; it's half a job. HHS guidance expects this to feed into an ongoing risk management process, which means issues get tracked until they're actually resolved, with documentation showing they were. If your current provider runs a scan but can't produce a written assessment with tracked remediation, ask them straight up whether that's been completed, and if not, when. ## Data Encryption: What Should Be Non-Negotiable The HIPAA Security Rule treats encryption as an "addressable" specification, and that word trips people up every time. It doesn't mean optional. It means your practice has to evaluate whether encryption is reasonable and appropriate for your situation, and for pretty much every modern practice handling ePHI electronically, it is. The practical version: any HIPAA-compliant provider should be building toward encryption of data at rest across servers and endpoints, plus encrypted transmission for data in transit, including email that has patient information in it. If a provider's answer to "Is our data encrypted?" comes out vague, that's worth pressing on. "Optional" encryption, or the kind that was never actually configured and verified, isn't the same thing as encryption you can document and defend if anyone ever asks. If you want to understand how this fits into the bigger picture of IT support for healthcare practices, check out our previous post. ## User Access: Beyond a Shared Password Shared logins are one of the most common gaps in practices that haven't had a healthcare-focused IT review. It's an easy habit to fall into. Onboarding a new front desk employee is faster with an existing login than setting one up from scratch, and nobody's had a problem yet, so it doesn't feel urgent. We covered this same gap in our post on things your IT provider should already be doing, because it's one that keeps showing up no matter how many times it gets flagged. The standard your practice should be working toward is multi-factor authentication combined with unique user IDs for every staff member, role-based permissions so someone only has access to what their job actually requires, and automatic logoff after a period of inactivity. Beyond the security benefit, this is also what lets you actually answer the question "who accessed this patient's record and when," which you can't do if three people are logging in under one shared name. ## Audit Trails: The Log That Has to Survive Six Years Basic system event logs tell you that something happened. A proper audit trail tells you who did it, what they touched, and when, and it has to stick around long enough to actually matter. For ePHI specifically, that means centralized logging, often through a SIEM system, tracking every time a patient record gets viewed, exported, or modified. And it needs to be kept for an extended stretch, not the default 30 or 90 days most systems ship with out of the box. This is one of those areas where "technically logging something" and "logging what you'd actually need during an investigation" drift pretty far apart. A provider should be able to tell you exactly what's being logged, where those logs live, and how long they're kept, without having to go check. If you're curious how this factors into what you're actually paying for, our post on what managed IT for medical practices costs breaks down where audit logging usually shows up on a quote. ## How to Ask a Provider to Prove Each One None of the five things above should require you to just take somebody's word for it. Here's the thing about a provider who's actually built a real HIPAA-compliant setup: none of these questions rattles them. They've answered them before, probably more than once, and they've got the receipts ready to go. Ask to see a copy of your BAA. If one's not in place yet, a good provider will tell you exactly why and when that's changing, not dance around it. Ask them to walk you through your most recent risk assessment document, not describe it from memory, but actually pull it up. Ask what's encrypted and how, and expect a plain answer, not a shrug or a "should be." Ask them to describe your current access control setup, who has access to what, and why. And ask exactly what your audit logging captures and how long it sticks around, because "we log stuff" isn't an answer you can bring to an auditor. If any of those five turns into a vague answer, a "let me check on that," or worse, a change of subject, that's the real signal. Not the word "compliant" showing up in a sales deck or a homepage, because that costs a provider nothing to say. A provider who's done the actual work wants to show you. One who hasn't will try to talk around the gap. ## The List That Separates Compliant From "Compliant" "HIPAA compliant" is either a checkable list or it's a sales phrase, and the only way to tell the difference is to make a provider walk you through each item instead of taking the label at face value. A signed BAA that actually covers subcontractors, a documented risk assessment with tracked remediation, real encryption, individual access controls, and retained audit logs. Those aren't extras. They're the specific things HHS and NIST guidance point to when they describe what protecting ePHI actually takes. Skipping any one of them isn't a small gap. It's the difference between a provider who can hand you documentation the day OCR comes calling and one who's hoping nothing ever forces the question. That gap doesn't show up on a monthly bill. It shows up later, usually at the worst possible time, in the form of patient notification obligations, a possible investigation, and remediation costs nobody budgeted for. Mann IT builds Michigan businesses' IT around documentation, not around a phrase in a sales deck. Every safeguard we put in place gets written down, tracked, and kept current, so when you ask what's covered, the answer isn't a guess or a general reassurance. It's a specific record we can show you, the same kind of record that should exist behind any real compliance claim, in any industry that has to prove it. If you want a straight answer on whether your current setup would actually hold up to a real look, we're happy to give it to you. [**Get in touch with Mann IT**](https://mann.cloud/contact-us) and we'll lay out each item for you directly. ### Key Takeaways - "HIPAA compliant" should mean a specific, checkable list, not a phrase in a sales conversation, and a provider who's built the real thing should be able to prove every item on it - A BAA needs to explicitly cover your provider's subcontractors, not just the provider itself, since that's the piece most agreements quietly leave out - A full risk assessment includes documented remediation tracking, not just a list of findings someone hands you and walks away from - Encryption is "addressable," which means your practice has to justify not doing it, not that it's optional or a nice-to-have - Individual logins and retained audit logs are what let you actually answer who accessed a patient record and when, not just that someone did - A provider confident in their own setup will answer direct questions about each of these without hesitation, showing you documentation instead of just reassuring you - The gap between claiming compliance and proving it usually doesn't show up until something's already gone wrong ### Frequently Asked Questions **1. How long do HIPAA-related audit logs actually need to be kept?**There's no single fixed number in the Security Rule itself, but a lot of practices retain audit logs for six years to align with HIPAA's general documentation retention requirement. Ask your provider specifically what their retention policy is and make sure it's written down somewhere. **2. What if our current IT provider says they're compliant but won't show us documentation?**Ask directly for a copy of your BAA and your most recent risk assessment. A provider that can't produce either one isn't compliant yet, no matter what they've said in conversation. **3. Is a vulnerability scan the same thing as a HIPAA risk assessment?**No. A vulnerability scan checks for known technical weaknesses. A full risk assessment covers where your ePHI lives, realistic threats, current safeguards, risk levels, and a documented remediation plan. A lot of providers run the first one and call it the second. - [Tweet](https://twitter.com/share) Mann Information Technology LLC [info@mann.cloud](mailto:info@mann.cloud) 690 Vine Ct, Ann Arbor, MI 48103 (734) 822-2729 - [About Mann IT](https://mann.cloud/about-us) - [Get Support MAC](https://startcontrol.com/mann) - [Get Support WINDOWS](https://startcontrol.com/mann/start) - [Contact us](https://mann.cloud/contact-us) - [(734) 822-2729](tel:7348222729) - [Email Us: info@mann.cloud](mailto:info@mann.cloud) [![MannTechLogo-Vector-NoText](https://mann.cloud/hubfs/Logos/MannTechLogo-Vector-NoText.png)](https://mann.cloud) - Privacy Policy © 2026 Mann I.T. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Chris Mann", "url" : "https://mann.cloud/blog/author/chris-mann" }, "dateModified" : "2026-10-20T13:00:04.682Z", "datePublished" : "2026-10-20T13:00:04.000Z", "headline" : "HIPAA Compliance: The Difference Between \"We're Careful\" and \"We Can Prove It\"", "image" : [ "https://mann.cloud/hubfs/TEMPLATE%20(2).png" ], "mainEntityOfPage" : { "@id" : "https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mann.cloud/hubfs/Logos/M-Side%20Mann%20IT%20Wide-Brand%20Kit.png" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : [ { "@type" : "Person", "name" : "Chris Mann", "url" : "https://mann.cloud/blog/author/chris-mann" } ], "dateModified" : "2026-10-20T13:00:04Z", "datePublished" : "2026-10-20T13:00:04Z", "description" : "What HIPAA-compliant IT services actually require: BAAs, real risk assessments, encryption, access controls, and audit logs.", "headline" : "HIPAA Compliance: The Difference Between \"We're Careful\" and \"We Can Prove It\"", "image" : [ "https://49254179.fs1.hubspotusercontent-na1.net/hubfs/49254179/TEMPLATE%20%282%29.png" ], "inLanguage" : "en", "keywords" : "IT Support, Compliance", "mainEntityOfPage" : { "@id" : "https://mann.cloud/blog/hipaa-compliance-the-difference-between-were-careful-and-we-can-prove-it", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "name" : "Mann I.T." } } ```