HIPAA for IT providers and MSPs
What HIPAA means for IT support companies and MSPs with healthcare clients: why you are a business associate, the BAA chain through your tool stack, securing your own access, and ransomware response.
On this page
HIPAA for IT providers and MSPs: at a glance
An IT managed service provider (MSP) that creates, receives, maintains or transmits a practice's ePHI — or routinely accesses systems holding it — is a HIPAA business associate — remote management, backups and help-desk access are enough, even if staff rarely look at patient data. The MSP needs a BAA with each healthcare client, BAAs with its own vendors that handle client PHI (backup, RMM, cloud), Security Rule safeguards for its own access, and a breach-reporting process. An IT vendor with no access to PHI is not automatically one. Ransomware hitting a client is presumed a breach unless an assessment shows otherwise.
| Status | Business associate when you maintain or routinely access a client's ePHI; not automatic without PHI access |
|---|---|
| Not a conduit | The conduit exception covers transmission only, not IT support or storage |
| BAA chain | Clients → you → backup, RMM, cloud and security tool vendors |
| Your own safeguards | Risk analysis, MFA on admin tools (recommended), access logging, offboarding |
| Ransomware | Presumed breach unless a four-factor assessment shows low probability of compromise |
Why an MSP is a business associate
A business associate creates, receives, maintains or transmits PHI on behalf of a covered entity (45 CFR 160.103). An MSP that manages a practice’s servers, workstations, email or backups maintains or can access PHI to provide its service — that makes it a business associate, regardless of how often technicians actually see patient data. A vendor that only sells software or services with no access to PHI does not become a business associate just by having healthcare customers. The conduit exception applies only to services that merely transmit data, like an internet provider; HHS has said it doesn’t cover entities that store PHI, such as cloud services (FAQ 2077).
The BAA chain through your stack
Your BAA with each client promises safeguards that depend on your own vendors. Map them:
| Tool | Handles client PHI? | Needs a BAA with you? |
|---|---|---|
| Backup and disaster recovery | Yes — copies of client data | Yes |
| Cloud hosting, Microsoft 365 or Google Workspace tenants you administer | Yes | Yes — usually the client signs with the provider directly |
| Remote monitoring and management (RMM), remote access | Can access endpoints with PHI | Usually yes |
| Security tools (EDR, email filtering, SIEM) | May process files, emails, logs with PHI | Check per tool |
| Ticketing and documentation | Only if PHI ends up in tickets | Keep PHI out, or yes |
Securing your own access
For attackers, an MSP’s remote tools are a way into every client at once. The Security Rule applies to your own systems: a documented risk analysis, unique technician accounts, access control and audit logs for client access, and fast offboarding. We recommend MFA on every remote management and admin console.
Ransomware and incidents
HHS’s ransomware guidance says that when ransomware encrypts ePHI, a breach is presumed unless a four-factor assessment shows a low probability of compromise. Agree in advance with each client who investigates, who decides, and how fast you report — HIPAA’s outer limit for your notice to the client is 60 days after discovery (164.410), and the client generally keeps the duty to notify patients and HHS. The contingency plan standard (164.308(a)(7)) requires backups and recovery plans; test restores regularly.
Selling compliance to clients
Many MSPs help practices with HIPAA. Be clear in contracts about which safeguards you operate and which remain the practice’s responsibility — the practice still needs its own risk analysis, policies and training.
Main risks
- Supporting healthcare clients without signed BAAs.
- Remote management, backup or security tools from vendors that won't sign a BAA.
- Shared technician accounts and admin access without MFA — the MSP becomes the attack path into every client.
- Offsite backups that are unencrypted or untested.
- No agreed process for telling clients about incidents, so the 60-day limit is missed.
Requirements that matter most here
- Business associate →§ 160.103Who counts as a HIPAA business associate, common examples including SaaS and cloud vendors, subcontractors, and what business associates must do.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- Audit controls and activity logs →§ 164.312(b)Systems holding ePHI must record activity so you can review who accessed what. When choosing a tool, check that you — not only the vendor — can see sign-ins and access to records, and for how long.
- Encryption of ePHI →§ 164.312(a)(2)(iv)Encryption is "addressable", not optional: you encrypt ePHI at rest and in transit where reasonable and appropriate, or document why not and use an equivalent alternative where that is reasonable. For email and cloud tools, encrypting is almost always the reasonable choice.
- HIPAA password and MFA requirements →§ 164.312(d)What the HIPAA Security Rule actually says about passwords and multifactor authentication today, what HHS has proposed, and what we recommend for a small practice or company.
- Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
- HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
Solutions to look at
- HIPAA hosting and cloud platforms →ToolCloud platforms and managed hosts that sign a BAA — and the big difference between infrastructure you secure yourself and hosting where the provider runs the safeguards for you.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
- HIPAA risk assessment software →ToolTools for the security risk analysis HIPAA requires — from the free HHS SRA Tool to paid platforms with guidance, remediation tracking and expert help. What each covers and what it costs.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Is an IT company a business associate under HIPAA?
Yes, if it maintains or can access systems containing a covered entity's PHI to provide its services — servers, EHR workstations, backups, email. HHS treats IT vendors with that access as business associates.
Can an MSP sign a BAA and still use subcontractors?
Yes, but each subcontractor that handles the client's PHI — backup providers, remote management platforms, cloud hosts — needs a BAA with you.
Who notifies patients after a ransomware attack on a client?
The MSP must notify the client (the covered entity) as its BAA requires and within HIPAA's 60-day limit; the client generally keeps the duty to notify patients and HHS.