Good IT support for a medical practice runs in the background every day. Here's what it should already include.
TL;DR: Good IT support for a medical practice isn't something you evaluate once a year and forget about. It's a set of habits a provider either has running quietly in the background or doesn't, and the difference usually only shows up the day something actually breaks. This post walks through seven of those habits, the specific, checkable ones that separate a healthcare-ready provider from one that's just generally competent, so you can tell which one you've got before you need to find out the hard way.
A car doesn't need a new engine every year. It needs the boring stuff handled on schedule: oil changed, tires rotated, filters swapped, long before any of it turns into something you can feel from the driver's seat. Skip enough of that maintenance and eventually something fails, usually somewhere a lot less convenient than your own driveway, and usually costing a lot more than the maintenance would have.
IT support for a medical practice works the same way. The habits that actually protect patient data aren't dramatic. Nobody throws a party for a tested backup or a server that got patched on time. They're just the maintenance that happens whether or not anyone's watching, quietly running in the background of a practice that's otherwise busy taking care of patients.
That's exactly why this stuff is so easy to miss. A practice can look perfectly fine on the surface, phones ringing, patients seen, bills going out, while the maintenance underneath has quietly stopped happening months ago and nobody's noticed yet. Threats have gotten more sophisticated and more automated over the past few years, which means the gap between "looks fine" and "actually protected" has gotten wider, not narrower.
And it's not only a security problem. Every one of these habits ties back to something HIPAA actually expects a practice to have in place, whether that's a signed agreement with a vendor, a backup that's been verified rather than just scheduled, or a record showing who accessed a patient's file and when. Skip the maintenance long enough and you're not just more exposed to an attack. You're also further from being able to prove, on paper, that your practice did what it was supposed to.
This is the most practical post in the series: seven specific things your IT provider should already be doing, today, without you having to ask.
This is the one most practices assume is handled, but haven't actually double-checked. Every vendor touching patient data, your cloud storage, your e-fax service, your remote monitoring tool, needs a signed Business Associate Agreement, and that agreement needs to extend to their subcontractors too. A good IT provider keeps an active list of every vendor your practice uses that touches ePHI and tracks the status of each agreement, instead of assuming it got handled once during onboarding and never looking at it again.
Here's the thing about BAAs specifically: they're easy to sign and easy to forget about. Somebody gets it done during setup, files it away, and three years later, nobody remembers it exists, let alone whether the vendor's subcontractors are covered too. If nobody can hand you that list today, that's the first thing worth asking about. We go deeper on exactly what a real BAA needs to cover, subcontractors included, in our post on HIPAA-compliant IT services.
Shared logins are common, and honestly, understandable. Somebody's covering the front desk on a busy morning and it's just faster to use the login that's already sitting there than to wait on IT to set up a new one. Everybody's done it, and most of the time, nothing bad happens because of it. That's exactly the problem.
It's also one of the fastest things an attacker can exploit, and one of the hardest gaps to explain after the fact, because there's no way to know who was actually logged in when something happened. If three people share one login and something goes wrong, you're not troubleshooting an incident; you're trying to solve a mystery, working backward through a shift schedule, trying to guess who was at that desk. Multi-factor authentication and individual credentials for every staff member should be standard by now, not a project sitting on next year's roadmap waiting for a slow month that never comes. It's also one of the cheapest fixes on this whole list, which makes it a strange one to still find missing.
A backup that runs every night but's never been tested is a guess dressed up as a plan. It feels like protection. It looks like protection on a dashboard somewhere. But until somebody's actually tried to restore from it, you don't know if it works; you're just hoping it does.
Here's the standard to hold your provider to: backups that are immutable, meaning nobody, not even ransomware that gets into your systems, can alter or delete them, stored off-site, and tested on a real schedule so someone can actually tell you, with confidence, how fast you'd be back up and running. Ask when the last test happened and what the result was. "It's running" and "we tested it and had you restored in four hours" are two very different answers, and it's the second one you're actually paying for. We got into what tested backups add to the cost of a managed IT plan in our post on what managed IT for medical practices costs.
Guest Wi-Fi, connected medical devices, and the server holding your patient records shouldn't be sitting on the same flat network together. Think of it like keeping the waiting room separate from the back office. A patient scrolling on their phone in your lobby has no business being on the same network as the system holding everyone's charts, even if nothing ever goes wrong.
Segmenting them, usually with VLANs, means a compromised device on one side can't just wander over and reach what's on the other. It's invisible when it's working, which is exactly why a practice can go years without knowing whether it's actually in place until somebody finally asks, usually after something's already gone sideways somewhere else in the system. It's one of those setups that costs almost nothing to get right upfront and quite a bit to fix after a scare.
Security patches exist because somebody found something broken. The gap between a patch getting released and your practice actually applying it is a window an attacker can walk right through, and that window should be measured in hours, not the weeks it takes if patching's a manual, occasional task instead of something automated and monitored.
A healthcare-focused provider treats critical patches like they're time-sensitive, because they are, not something that gets batched into whatever maintenance window is convenient that month. This is a good example of something our previous post on IT support for healthcare practices touches on as part of the bigger safeguard picture: patching isn't a one-time setup you check off and forget. It has to run on an ongoing basis, month after month, or the gap just opens back up.
It's not enough to just generate logs somewhere and let them pile up. Your provider should maintain centralized, searchable logging, often through a SIEM system, that can answer one specific question fast: who accessed this patient's record, and when.
Basic system logs scattered across individual devices don't answer that question in any usable timeframe, especially not during an actual investigation when speed is the whole point. Picture trying to piece together what happened by checking ten different machines one at a time while an auditor waits. That's not a system, that's a scavenger hunt, and it's not one you want to be running when the stakes are this high. A provider who's set this up right can pull the answer in minutes instead of days, which matters more than it sounds like until you're the one waiting on it.
Laptops and phones leave the building. Staff work from home, travel between locations, or just set a device down somewhere and lose track of it, and most of the time, that has nothing to do with anyone doing anything wrong. It happens.
Managed endpoint detection and response, paired with mobile device management that can remotely lock or wipe a lost device, is what separates "someone left their laptop in a coffee shop" from "we just had a reportable breach." This should be running around the clock, not something anyone has to remember to go check on, because the moment somebody remembers to check is usually well after the device is already gone. A device that's monitored and wipeable turns a stressful afternoon into a five-minute phone call.
None of these seven things are complicated on their own. Signed BAAs, unique logins, tested backups, network segmentation, fast patching, searchable audit logs, and monitored endpoints. What separates a healthcare-ready IT provider from a generalist one isn't sophistication, it's consistency: doing all seven, all the time, without anyone having to ask twice.
That consistency is the whole point. Any one of these habits can slip for a while without anyone noticing, and that's exactly when it matters most. A missed patch, an untested backup, a shared login that nobody thought twice about. Each one on its own feels small, but they're the difference between a practice that's actually protected and one that just looks fine on the surface, right up until the day it isn't.
This is where Mann IT does things differently. We don't treat these seven habits as a checklist to run through once and forget about. They're built into how we manage every Michigan business we work with, checked on a real schedule, documented, and maintained whether or not anyone's asking. When we tell you your backups are tested, we mean we tested them. When we say MFA is enforced, we mean every login, every staff member, no exceptions carved out because someone was in a hurry. That's not a sales pitch; it's just how we'd want our own systems run if the roles were reversed.
Most practices don't actually know which of these seven their current provider is quietly skipping until something forces the question. We'd rather you find out now, on your own terms, than later on someone else's. Have a conversation with Mann IT and we'll tell you straight, no guessing required.
1. How do we find out if our current provider is actually doing all seven of these?
Ask directly, one at a time. A provider confident in their setup answers specifically, with details. Vague answers or a "we'll check on that" for more than one or two items is a clear signal that something's missing.
2. Is remote wipe capability something we have to opt into separately?
It depends on the provider, but it should be part of a standard mobile device management setup for any practice handling patient data on laptops or phones. If it's an add-on you've never heard mentioned, ask whether it's currently in place.
3. How often should patches actually be applied?
Critical security patches should go out within hours to days of release, not on a monthly or quarterly schedule. Non-critical updates can follow a more relaxed cadence, but your provider should be able to explain the difference clearly when you ask.