HIPAA requires any IT provider handling your practice’s patient data to sign a Business Associate Agreement and build out the Security Rule’s administrative, physical, and technical safeguards, not just print “HIPAA compliant” on a homepage. No federal agency hands out a certificate that makes that true. The compliance lives in the paperwork and the controls, not the marketing.
Ask five IT companies if they’re HIPAA compliant and five will say yes. Ask the same five to produce a signed Business Associate Agreement template, and the number drops. Fast.
VJNetworks has managed systems touching protected health information since 2008. Eighteen years of watching healthcare practices get this wrong in the same handful of ways, mostly because nobody explained what the law actually asks for versus what a sales page implies. We cover the full healthcare IT and compliance program we run for practices elsewhere. This post is narrower. It’s about the specific obligations that fall on your IT provider, and how to tell whether yours is actually meeting them or just saying the right words.
There’s No Government Stamp That Says “HIPAA Certified”
HHS does not certify vendors. No registry. No seal. No exam an IT company passes to earn the label. When a provider tells you they’re “HIPAA certified,” they mean something informal, maybe a third-party security audit, maybe nothing at all beyond good intentions. HHS’s own guidance on business associates defines the legal category instead: any vendor that creates, receives, maintains, or transmits protected health information on a covered entity’s behalf is a business associate, and business associates carry direct legal liability under HIPAA. Not contractual liability borrowed from you. Their own.
That distinction matters more than it sounds like it should. A vendor who thinks HIPAA is your problem, something they’re helping you with as a courtesy, is a vendor who hasn’t read the rule, because the IT company handling your ePHI is regulated the same way you are. If they don’t know that, ask why.
The Business Associate Agreement Is Not Optional Paperwork
Under 45 CFR 164.502(e) and 164.504(e), a covered entity has to get written assurances from any business associate before that vendor touches PHI. In practice, that’s a signed BAA. It has to name what the vendor can and can’t do with the data, require them to implement real safeguards, and obligate them to report back if something goes wrong. Skip it and both sides are out of compliance the moment the vendor’s laptop connects to your network. Not eventually. Immediately.
VJNetworks signs a BAA with every healthcare client, no exceptions, and no upcharge for the paperwork. It’s table stakes. Not a premium feature. If your current provider hesitates, stalls, or tries to talk you out of needing one, that hesitation is the answer to whether they understand what they’re agreeing to.
A narrow carve-out exists for pure “conduits,” an internet provider that never actually accesses the data it’s carrying, for example. A general IT company with admin access to your servers, your backups, your email, is not a conduit under any reasonable reading. That exception gets stretched by vendors who’d rather not deal with a BAA. Don’t let it stretch that far for yours.
The Three Safeguards, and Which Ones Actually Land on Your IT Provider’s Desk
HIPAA’s Security Rule breaks into administrative, physical, and technical safeguards. Practices tend to assume all three are the IT provider’s job. Some of it is. A meaningful chunk isn’t, and knowing the split helps you figure out what you’re actually paying for.
| Safeguard category | What HIPAA requires | Whose desk it lands on |
|---|---|---|
| Administrative | Risk analysis, workforce training, sanction policy, incident response procedures, contingency planning | Shared. The practice owns policy and training. A competent IT provider runs the technical half of the risk analysis and documents what it finds. |
| Physical | Facility access controls, workstation security, device and media disposal | Split. You control who walks into the building. Your IT provider controls how old servers, drives, and devices get wiped or destroyed. |
| Technical | Access control, audit logging, transmission security, encryption | This one’s on the IT provider. Full stop. If they’re weak here, the rest of the program doesn’t hold up. |
The administrative risk analysis deserves a second look, because OCR enforcement data points at it more than any other failure. Practices that get investigated almost always have something written, usually a three-year-old PDF done once and never revisited, and HIPAA doesn’t set a fixed calendar for how often to redo it. OCR treats a stale, unchanged analysis close to the same as no analysis at all. Systems change. Staff turns over. Vendors get added. The risk analysis has to move with them.
Encryption Isn’t Actually Mandatory Yet. That’s About to Change
Here’s the part almost nobody explains correctly. Under the current Security Rule, encryption of data at rest and in transit is what’s called an “addressable” specification, not a required one. A practice can technically decline to encrypt if it documents a reasonable justification and puts an equivalent safeguard in its place. Addressable has never meant optional. It means assessed, and most practices skip the assessment and just skip the encryption.
That loophole is closing. HHS published a proposed rule in January 2025 that would eliminate the required-versus-addressable split almost entirely, making encryption, multi-factor authentication, network segmentation, and regular penetration testing flat-out mandatory. Still proposed, as of today. Not final. Not enforceable. The comment period closed back in March 2025, hospital and provider groups pushed back hard on the projected cost, and HHS’s own target for a final rule has already come and gone without one. Nobody outside HHS knows exactly when it lands.
Waiting for the final version before acting is the wrong bet anyway. Encrypt now. Enforce MFA now. The direction of travel isn’t ambiguous, even if the effective date is.
What Happens When Your Vendor Is the One Who Gets Breached
This is the scenario most practices never think through. Not their fault, usually. Your IT provider gets compromised, not you directly, and your patients’ data goes out the door through their systems. Who’s on the hook?
Both of you. In different ways. The breach notification rule gives a business associate an obligation to notify the covered entity without unreasonable delay and no later than 60 days after discovering the breach. That’s the clock your IT provider is bound by. Your own clock, to notify affected patients and, for breaches touching 500 or more people, to report to HHS, also runs on a 60-day standard, and it starts ticking from when you find out. A slow, vague, or defensive vendor eats into time you don’t have.
2025 was the worst year on record for large healthcare breaches. 772 of them, reported to HHS’s own breach portal, beating the previous record of 746 set in 2023. Of those, 128 originated at a business associate rather than at the healthcare provider directly. Roughly one in six. Your IT vendor isn’t a background player in this risk. They’re a direct point of exposure, which is exactly why the BAA and the safeguards checklist above aren’t formalities.
The cost backs that up. IBM’s 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, the most expensive of any industry the report tracks, for the fourteenth year running, longer than any other industry has held that unwelcome title. Average time to identify and contain one: 279 days. Nine months of exposure. Before anyone even knows it happened, in the typical case.
What to Actually Ask Your IT Provider This Week
Not a full audit. A gut check, roughly in the order it matters most.
- Can they produce a signed BAA right now, not “we’ll get to it”?
- When was the last risk analysis actually done, and does it reflect your current systems, not the ones you had two years ago?
- Is ePHI encrypted at rest and in transit today, addressable or not?
- Do they enforce MFA on every system touching patient data, including the ones that feel like an afterthought?
- Who has admin access to your systems, and is every login tied to one specific person?
- What’s their actual breach notification commitment in writing, and does it beat the 60-day legal floor?
- How is old hardware disposed of, and who verifies the drives were actually wiped?
If any answer is a shrug, that’s data. VJNetworks only works with two EHR platforms directly by name in this space, PointClickCare and AccuCare, and we’d rather say that plainly than pretend to cover every system on the market. A vendor who claims universal expertise in every healthcare platform is usually stretching the truth somewhere.
Where Practice Managers Get This Wrong
Does using Microsoft 365 or a “HIPAA compliant” cloud host automatically make us compliant?
What actually makes a vendor a “business associate” under the law?
If our IT provider gets breached, are we liable too?
Is a signed BAA enough on its own?
How do we verify an IT provider’s HIPAA claims instead of just taking their word for it?
One sitting won’t cover it. Shouldn’t, really. It does need to happen before the next renewal, not after an incident forces the question. We support healthcare practices in Rockland, Westchester, and Bergen County as part of our broader cybersecurity program, built around exactly the gaps this post walks through.
A free IT assessment from VJNetworks checks your practice against the safeguards in this post. Written findings either way, no pressure attached.
Managing PHI-touching systems since 2008 · BAA signed with every healthcare client · a real person responds within 15 minutes