Most Houston healthcare practices learn what HIPAA actually requires the hard way — during the first security questionnaire from a health system partner, the first breach investigation letter from the Office for Civil Rights, or the first cyber-insurance renewal that comes back with specific technical conditions.
The goal of this piece is to map what the HIPAA Security Rule actually requires, in plain English, and what that translates to for the managed IT provider you choose.
The three HIPAA safeguard categories
The Security Rule (45 CFR Part 164, Subpart C) breaks into three categories of required safeguards. Each has both "required" and "addressable" implementation specifications — the addressable ones give flexibility in how you implement, not whether.
Administrative safeguards. Policies, procedures, and the named roles that operate them. The workhorses here are a written Security Management Process, a designated Security Officer, a Risk Analysis updated when the environment changes, workforce training, and a documented incident-response plan.
Physical safeguards. How physical access to systems containing PHI is controlled. Facility access controls, workstation security, and device-and-media controls. For cloud-hosted EHRs, most of this is inherited from the cloud vendor's controls (verified via BAA) — but for on-premise systems, you own it.
Technical safeguards. The actual technical controls: access control, audit controls, integrity controls, transmission security. This is where most IT-side failures happen because it's the section that requires continuous operational work rather than written documentation.
What "operationalized HIPAA" means in practice
A compliant IT environment isn't a binder on a shelf. It's a set of ongoing practices. These are the ones that matter:
MFA on every PHI-touching system. The EHR. The patient portal's admin surface. The Microsoft 365 tenant. Every remote-access path. Every administrative portal for every system that touches protected health information. Not "MFA where convenient" — MFA everywhere, with an access-log trail proving it's enforced.
Encryption at rest and in transit. Full-disk encryption on every endpoint. TLS on every PHI-bearing transmission, including email where PHI appears. Encrypted backups. Encrypted off-site copies.
Access review and de-provisioning. Stale accounts are one of the most common findings in HIPAA audits. When an employee leaves or changes roles, their access is reviewed and reduced. That review is documented — when, by whom, what changed.
Audit logging. Access-control decisions logged and retained. Who accessed what PHI, from what device, at what time. Retained long enough to reconstruct an incident timeline.
Tested backups. Backups that have been restored. Not "we have backups" — "we tested a restore of the EHR on [date] and the RTO was [hours] and the RPO was [minutes]." Ransomware has made tested backups the single most important HIPAA-adjacent control.
Breach-response readiness. A documented incident-response plan. Tabletop-tested at least annually. The 60-day HHS notification clock (per the Breach Notification Rule) understood in advance, not during the scramble. Privacy counsel relationship established before the event.
Business Associate Agreements. A current BAA with every vendor that touches PHI — including the MSP. Written BAAs that reflect the actual data flows, not generic boilerplate. Updated when vendors or services change.
What a HIPAA-aware MSP actually does
When we engage with a Houston healthcare practice through our HIPAA Managed IT service, the baseline delivery covers:
Signed BAA on every engagement. Real BAA, not boilerplate. Reflects the services we perform, the data we touch, and the obligations we carry. Reviewed by your counsel before contract signing.
Continuous evidence collection. MFA reports pulled monthly. Access-review records timestamped. Backup-restore test results documented. Training completion tracked per employee. DMARC enforcement reports archived. When OCR or a partner auditor asks, the evidence is ready the same day — not scrambled together the week of the request.
Breach-response infrastructure. Documented IR playbook tuned to your practice. Annual tabletop exercises (quarterly for regulated-heavy practices). Relationships with cyber-insurance carriers and privacy counsel established in advance.
Multi-location identity. For multi-site practices (common in Houston — primary-care practices expanding across Montgomery and Harris counties, dental groups with multiple locations), centralized identity with single-sign-on, a single MFA policy, and conditional access that treats both sites as one identity domain while keeping site-specific controls intact.
EHR and portal reliability. Active monitoring on patient portals and EHR availability. An alert before the front desk starts getting calls, not after.
Clinical-trial support. For practices that participate in clinical trials (see our Woodlands Family Psychiatry case study), the documented trial-data segmentation and CRO-sponsor questionnaire responses that trial sponsors expect.
What to look for in a Houston healthcare MSP
Five questions that cut through the pitch and tell you whether an MSP is actually HIPAA-aware or just uses the word:
- "Can I see a sample BAA before contracting?" A real MSP will send one on request. A BAA that says "Company will comply with HIPAA" in vague language is a warning sign.
- "How do you document MFA enforcement across my environment?" The answer should involve a monthly report you can see. If the answer is "we turn it on and trust it," that's a fragile control.
- "When was your last restore test on a healthcare environment?" Specific dates and measured RTO/RPO numbers. "We have backups" is not the answer you're looking for.
- "Walk me through what happens the first hour of a breach." The answer should include preserving evidence, notifying your counsel and cyber carrier, and starting the 60-day HHS clock. If the answer includes "call the lawyer and figure it out," the response plan hasn't been tested.
- "How many of your engineers have worked inside a HIPAA environment for over three years?" Continuity of experience matters more than a certificate. HIPAA-aware practice is learned through time.
Where this fits
- /services/cybersecurity/hipaa-managed-it — The full HIPAA Managed IT service definition, including what's covered and how evidence is produced.
- /industries/healthcare — The wider healthcare vertical we serve across The Woodlands and Houston metro.
- /case-studies/woodlands-family-psychiatry — A multi-location behavioral-health practice with clinical-trial participation, published case study.
- /services/cybersecurity/compliance — SOC 2 / HIPAA / CMMC audit readiness as a discrete engagement for practices preparing for a specific framework audit.
HIPAA is not a marketing label. It's a continuous operational discipline that shapes how your IT environment runs every day. The MSP you pick either does the work or doesn't — and the difference shows up when something goes wrong.
Talk through your situation.
The articles cover the general shape. Your specific situation deserves a real conversation.
Related