Managed IT for Medical & Dental Practices
IT for practices where downtime means a waiting room: the EHR and imaging always reachable, every device encrypted, HIPAA evidence kept as you go, and a business associate agreement signed.
Overview
Patients notice IT when it stops.
A practice runs on a handful of systems: the practice management and EHR software, imaging, e-prescribing, the phones and the front desk workstations. When one of them slows down, the schedule slips and the waiting room fills. Most of those failures are predictable, from a full disk to an expired certificate to an update that was never tested, which is why we monitor them before they become a phone call.
HIPAA's Security Rule asks every covered entity for a risk analysis, safeguards that match it, and documentation that they are in place. That is less a one-time project than a way of running IT: devices encrypted and patched, access removed when staff leave, backups tested, and training recorded. Done as part of the managed service, the evidence accumulates on its own.
Capabilities
What's included
- Security risk analysis supportThe risk analysis the Security Rule requires, repeated when the practice changes, with a plan for each finding.
- Encrypted, managed workstationsEvery device enrolled, encrypted and patched, including the imaging and front desk machines nobody wants to touch.
- Backup and recoveryDaily backup of servers, workstations and cloud mail, with restores tested so the EHR can come back on schedule.
- Email security and archivingFiltering, encryption for messages that carry patient information, and retention that matches HIPAA's documentation rules.
- Access control and offboardingUnique sign-ins, multifactor where it is supported, and accounts removed the day someone leaves.
- Vendor coordinationWe work with your EHR, imaging and phone vendors, so you are not the go-between when something breaks.
How We Work
Our approach
- 01
Assess
Inventory every system that stores or touches patient information, and the vendors behind them.
- 02
Secure
Encryption, patching, access and backup brought to standard across the practice.
- 03
Run
Daily monitoring and help desk, with clinical systems prioritized during patient hours.
- 04
Document
Risk analysis, policies and reports kept current, ready when an auditor or insurer asks.
What You Get
Commitments
A business associate agreement with every covered entity we serve.
Per managed device, month to month.
Encryption, patch and backup reports produced on request.
To Get Started
What we need from you
- The EHR, practice management and imaging software you use
- How many workstations, servers and locations the practice has
- Your most recent risk analysis, if one exists
Common Questions
Questions we get asked
Will you sign a business associate agreement?
Yes. Atlas signs a business associate agreement with every covered entity it serves, because an IT provider with access to systems holding patient information is a business associate under HIPAA. We also help you keep an inventory of your other vendors that handle patient data and confirm each of them has signed one.
Can you make us HIPAA compliant?
No provider can certify a practice as HIPAA compliant, and you should be wary of one that offers to. What we do is implement and run the technical safeguards the Security Rule describes, support your risk analysis, and keep the documentation that shows the safeguards are in place. Compliance remains the practice's responsibility; we make it practical to meet.
Do you support dental imaging and practice management software?
We support the workstations, servers, network and backups that imaging and practice management software run on, and we work directly with the software vendor when an issue is inside the application. Imaging machines often run older software with specific requirements, so we document them, protect them on the network and patch them as far as the vendor allows.
What happens if our server or EHR goes down during clinic hours?
Clinical systems are monitored, so many problems are caught before staff notice them. When something does fail during patient hours it is treated as urgent, worked remotely first and on site where we are able to be. Tested backups mean recovery is a known procedure with a known timeline rather than an improvisation, which is the part practices most often discover too late.
References
Standards referenced
Tell us about
your practice.
Tell us how many people and devices you have and what rules you answer to. We respond within one business day with a scope and a monthly price.