HIPAA-Compliant IT for Medical Practices: From the Security Rule to Audit Evidence

The Security Rule in Plain Language

The HHS summary of the HIPAA Security Rule groups its requirements into three categories of safeguards for electronic protected health information (ePHI):

• Administrative: a risk analysis and risk management plan, a designated security official, workforce training, access management, and incident response procedures.
• Physical: facility access controls, workstation security, and secure disposal of devices and media.
• Technical: access controls, audit controls, integrity protections, authentication, and transmission security.

Each safeguard needs to be implemented and documented. A practice with good tools but no written record of its policies, decisions, and reviews will struggle to show compliance.

Start With the Risk Analysis

The risk analysis is the requirement OCR enforces most visibly. HHS runs a dedicated Risk Analysis Initiative, and its April 2026 HHS announcement of four ransomware settlements noted 13 completed investigations under that initiative. A defensible risk analysis includes:

• An inventory of every system that creates, receives, maintains, or transmits ePHI, including the EHR, practice management, billing, imaging, email, and mobile devices.
• An assessment of threats and vulnerabilities for each, with likelihood and impact.
• A written risk management plan with owners and dates.
• Evidence that the plan is being carried out, and a review whenever the environment changes, such as a new EHR, a new location, or a security incident.

Technical Safeguards That Matter Most

Inside Microsoft 365 and a practice’s device fleet, the technical safeguards translate into a clear set of controls:

• Multi-factor authentication on every account, including front-desk, billing, and clinical staff, who are among the most frequently phished.
• Endpoint detection and response on every device, monitored around the clock rather than just generating alerts.
• Encryption at rest on every laptop and workstation, BitLocker on Windows and FileVault on Mac, and in transit for email and file sharing.
• Conditional Access that checks device compliance and sign-in risk before granting access to ePHI.

These are the same controls a strong managed cybersecurity program runs for any regulated business. What HIPAA adds is the requirement to document them and review them. Ransomware is the threat that tests them most often in clinics, as we covered in our guide to medical office ransomware hardening.

Backup and the Contingency Plan

The Security Rule requires a contingency plan covering data backup, disaster recovery, and emergency mode operations. Most practices have backups; far fewer have tested restores. Immutable, off-site backups of the EHR, the practice management system, document storage, and the Microsoft 365 tenant, restored on a schedule with results logged, close one of the most common gaps in this category.

Audit Logs and Documentation Retention

The Security Rule requires audit controls that record activity in systems containing ePHI. It does not set a single retention period for those logs, but it does require that policies, procedures, and assessments be retained for six years. In practice, that means turning on the Microsoft 365 unified audit log and sign-in logging, keeping them long enough to investigate an incident, and storing risk analyses, policies, and review records for the full six years.

Workforce Training

A security awareness and training program is part of the administrative safeguards. Role-based modules, simulated phishing, and completion records give a practice evidence that training happened, which both OCR and cyber insurers ask for. Our security awareness training program runs on KnowBe4 with tracked completion.

How VirtuWorks Supports HIPAA-Compliant IT

Every managed engagement starts with a Microsoft 365 Tenant Security Baseline, enforced MFA and Conditional Access, Microsoft Defender on every managed device monitored by our in-house Security Operations Center, patching through VirtuWorks Autopilot, backup monitoring, and 365-day sign-in log retention. VirtuWorks executes Business Associate Agreements with healthcare clients.

Practices that need formal compliance management add the Compliance and AI Readiness Add-On, $59.99 per user per month on any managed plan. It adds the annual HIPAA risk assessment with a written remediation plan, controls and audit evidence mapped to HIPAA, monthly per-device compliance reports, security awareness training for practices of 25 or more users, and vulnerability remediation tracked to closure. More detail on EHR support and clinical workflows is on our healthcare IT support page.

Where to Start

If your practice cannot produce a risk analysis from the last twelve months, start there, then confirm MFA covers every account and that a backup restore has actually been tested. Schedule a Call and we will review where your practice stands against the Security Rule and what to fix first.