IT for healthcare and rehab practices

What HIPAA actually asks of your IT

HIPAA is not a product you can buy, and no vendor can make you compliant on their own. What the Security Rule does is set out safeguards you have to have in place and be able to evidence. Most of the technical half lands on whoever runs your IT.

In practice that means a handful of concrete things. Access has to be limited to the people who need it, with unique logins rather than a shared password taped under a monitor. Activity has to be logged so there is an audit trail. Data has to be protected in transit and at rest. There has to be a documented backup and recovery plan that someone has actually tested. And there has to be a process for removing access when a staff member leaves, on the day they leave.

None of that is exotic. What catches practices out is that it has to be documented and demonstrable, not just true. We keep that documentation as part of the service rather than assembling it in a panic when someone asks.

One thing worth being plain about: we handle the technical safeguards. Your policies, training and the administrative side belong with you and your compliance advisor. We are an IT company, not a law firm, and anyone telling you their software makes you compliant is selling something.

A Business Associate Agreement, signed before we touch anything

Any IT provider with access to systems holding patient information is a business associate under HIPAA, and that relationship is supposed to be covered by a signed agreement setting out how that information is handled.

We sign one. If a provider is reluctant to, or does not know what you are asking for, that tells you something useful about how they treat the rest of it.

Why rehab and therapy spaces break ordinary Wi-Fi

A therapy gym is one of the more hostile Wi-Fi environments in small-business work, and it is almost always designed as though it were an office.

The rooms are large and open, which sounds easy until you realise a single access point at one end has to cover forty or fifty feet of floor with equipment, mirrors and metal frames in between. Treatment bays divided by curtains behave like one big room for signal and like separate rooms for privacy. Staff carry tablets and walk while they document, so they roam constantly between access points, and a network that has not been tuned for roaming drops the session every time they cross a boundary.

The symptom a practice notices is documentation that will not save, or a therapist who has to walk back to the front desk to finish notes. The cause is nearly always access point density and roaming configuration rather than the internet connection, which means paying the provider for more bandwidth does not fix it.

Segmenting a clinical network

This is where most of the real security work happens, and it is largely invisible once done.

Clinical systems, the front desk, staff devices, guest Wi-Fi for patients in the waiting room and any connected equipment all belong on separate segments that cannot freely reach one another. A patient on your guest network should have no path to the machine running your practice management software. A smart TV in the waiting room should not be on the same network as anything clinical.

We see the opposite constantly: one flat network where everything can talk to everything, a guest password that has not changed in three years, and a printer with a web interface reachable from the car park. Splitting that apart is usually a day of work and it is the single highest-value security change available to most practices.

Cameras in a clinical setting

Practices ask for cameras for good reasons: entrances after hours, medication storage, parking areas, and liability cover in the gym if a patient falls.

The design conversation is about where they do not go. Treatment rooms, changing areas and anywhere a patient would reasonably expect privacy are off limits, and footage that captures patients is information you then have to protect and control access to like any other record. That is a strong argument for recording on site rather than to a third-party cloud tier, and for locking the recorder somewhere only named staff can reach.

We will design around what you actually need to see and tell you plainly when a camera position creates more risk than it removes. Confirm the specifics with your compliance advisor; we will build to what you decide.

Ransomware is the scenario that decides everything

Healthcare gets targeted because downtime is intolerable, which makes payment more likely. For a small practice, the difference between a bad week and an existential event comes down to decisions made long before anything happens.

Specifically: whether backups are isolated from the network that gets encrypted, whether anyone has ever restored from them, how long a full restore actually takes, and whether staff have somewhere to write down appointments while systems are down. We plan for all four, and the test restore is part of the service rather than an optional extra, because an untested backup is a hope rather than a plan.