Healthcare focused managed IT: how it differs from generic MSP services

Most managed service providers can keep a medical office's computers patched, its printers working and its email flowing. On a quiet Tuesday, a general MSP and a healthcare focused one can look identical.

The difference shows up in four places: the contract, the schedule, the records they keep, and the day something goes wrong. If you run a clinic, dental office or other practice, here is what a healthcare focused provider does that a generic one usually doesn't, and the questions that tell you which kind you have.

It signs a business associate agreement before it touches anything

Any IT company that can reach your patient data is a business associate under HIPAA. Remote access to a workstation with the EHR open counts. Since the 2013 HIPAA Omnibus Rule, business associates have been directly liable for complying with the Security Rule, not just responsible to you under a contract.

A healthcare focused MSP treats the business associate agreement as the first document in the relationship, not paperwork to chase later. It also has agreements in place with its own vendors that can touch your data, such as backup, monitoring and remote access tools, because HIPAA requires that chain to continue. A general MSP may sign your BAA when asked, but often can't tell you which of its own tools store or transmit your data. Our HIPAA services page covers what that agreement should include.

It plans around patient care, not office hours

A law firm can live with a server restart at 4 p.m. A clinic with a full schedule can't. A healthcare focused provider schedules patching and changes around clinic hours, knows which systems the front desk and exam rooms can't work without, and keeps a written downtime procedure so staff can register patients and document care when the EHR or the internet is down.

It also works directly with your EHR, practice management, imaging and lab vendors. When charts load slowly, someone has to work out whether the cause is your network, a workstation or the vendor's servers, and then hold the right party to it. With a generic MSP, that problem often bounces between the vendor and IT while staff wait.

It knows what to do with devices it can't patch

Medical offices run equipment that ordinary business networks don't: imaging systems, lab analyzers, ECG carts, and vendor managed cameras and phone systems. Many run old operating systems that the manufacturer won't allow anyone to update. A generic MSP tends to ignore them, or tries to patch them and breaks the vendor's support agreement.

A healthcare focused provider keeps an inventory of these devices, puts them on their own network segment so a compromised front desk PC can't reach them, and controls how vendors connect for remote support. In one Big Sky test of a rural Montana clinic, two outside vendors had left equipment and management interfaces open to the internet without anyone at the clinic knowing. The rural clinic case study shows how that was found and fixed.

It keeps the records an auditor will ask for

HIPAA expects you to know who can reach patient data, to review activity, and to keep your risk analysis current. A healthcare focused MSP builds that into its routine:

• Access by role, so a biller doesn't have clinical access and a provider's everyday account doesn't carry admin rights.
• Same day offboarding when someone leaves, covering the EHR, email, remote access and any shared passwords.
• Audit logs that are turned on, kept, and actually reviewed.
• Records of patches, backups and restore tests that you can hand to an auditor or insurer.
• Real input to your HIPAA security risk analysis, because the MSP knows your systems better than anyone.

A general MSP may do some of this. The test is whether they can produce the records when you ask, not whether they say they do the work.

It responds to incidents as if there will be an investigation

When ransomware or a compromised mailbox hits a practice, the instinct is to wipe and restore. That can destroy the evidence you need to work out which patients' records were reached. Meanwhile the HIPAA breach notification clock keeps running: notice to affected patients is due without unreasonable delay and no later than 60 days after the breach is discovered.

A healthcare focused provider preserves evidence first, works alongside your attorney and insurer, and helps you answer the questions OCR and your carrier will ask. A generic MSP usually restores service quickly and calls in a forensics firm later, if at all. Our incident response team images systems before anything is wiped.

Its people are trained on patient data

The technician who connects to the front desk computer sees whatever is on the screen. Staff who support healthcare clients should have current HIPAA training, work under confidentiality terms, and look only at what the task requires. At Big Sky, every employee who supports healthcare clients and handles ePHI trains continuously, with certificates kept on file for clients to inspect.

Questions to ask your current or next MSP

• Will you sign our BAA, and which of your own vendors have signed one with you?
• When is your maintenance window, and how do you keep work out of clinic hours?
• Which of our devices can't be patched, and how are they isolated?
• How fast do you remove access when someone leaves, and can you show us the last one?
• Where are our audit logs, how long are they kept, and who reviews them?
• What happens in the first hour of a suspected breach, and who preserves the evidence?
• What will you contribute to our risk analysis this year?

If the answers are vague, you have a general MSP. That can be fine for many businesses. For a practice that holds patient records, it leaves gaps you carry alone.

Where to start

Pull out your current IT agreement and your BAA, then ask the questions above. If you'd like a second opinion, our healthcare managed IT team will walk through your setup and tell you plainly where the gaps are.