Why HIPAA Reaches Your MSP Directly
HIPAA was written for covered entities: health plans, clearinghouses and providers such as clinics, dental offices and therapy practices. The regulation also defines a business associate, and the definition includes anyone providing management, administrative or consulting services to a covered entity where the service involves protected health information (PHI). An MSP that runs a clinic's servers, email, backups or line-of-business application touches PHI every day, so it is a business associate.
That status is not something your client grants or withholds. It follows from what you do. If your techs can open the practice management database, restore a mailbox or see a scanned intake form on a file share, you are in scope whether or not anyone has mentioned HIPAA in the sales process. The same definition covers subcontractors that create, receive, maintain or transmit PHI on behalf of a business associate, which is how your own vendors end up in scope too.
The Business Associate Agreement Comes First
Before you log in to a healthcare client's environment, you need a signed business associate agreement. The BAA sets out what you may do with PHI, requires you to safeguard it, obliges you to report breaches and security incidents, and requires you to flow the same terms down to any subcontractor who handles PHI for you.
Many small practices do not know they should ask for one, and some MSPs would rather not raise it. That is the wrong way round: without a BAA, the practice is out of compliance for letting you in, and you are carrying obligations without the contract that defines them. Make the BAA part of your standard paperwork for any client in healthcare, and add it to your client onboarding checklist so nobody starts work without it.
Read what you sign. Client-drafted BAAs sometimes add unlimited liability, very short notification windows or audit rights that go well beyond the regulation. Your lawyer and your insurer should both see the template you intend to use and any client version that departs from it.
The agreement also governs the end of the relationship. A BAA must require you to return or destroy the PHI you hold when the contract ends, where that is feasible, so your offboarding process needs a step for it: backups, exported mailboxes, ticket attachments and copies on your own file shares. When a healthcare client leaves, document what you returned, what you destroyed and when, and keep that record with the rest of your HIPAA documentation.
What the Security Rule Expects You to Show
As a business associate you are directly subject to the HIPAA Security Rule for the PHI you handle. In practice, that means running your own security program to the standard you probably already sell, and being able to prove it with documents rather than assurances. The regulation requires that documentation to be kept for six years from its creation or from when it was last in effect, whichever is later.
- A written risk analysis of how PHI flows through your tools and your clients' systems, reviewed when things change.
- Access control: unique accounts for every tech, least privilege, and prompt removal of people who leave, which scripts like disable stale AD accounts and audit local admins help evidence.
- Multifactor authentication on every path into client systems, measured with MFA coverage.
- Patching and vulnerability management you can report on, such as patch compliance rate.
- Backups that work and are tested, tracked through backup success rate and restore test pass rate.
- Audit logging of who accessed what, retained long enough to investigate an incident.
- Security awareness training for your own staff, with records.
- Written policies and an incident response plan that your team has actually rehearsed.
Who Owns What
The compliance obligation is shared, and disputes after an incident usually come down to who was supposed to do what. Put the split in writing at onboarding, not after the first audit request.
| Area | Healthcare Client (Covered Entity) | Your MSP (Business Associate) |
|---|---|---|
| Privacy Rule obligations to patients | Owns them: notices, patient access requests, minimum necessary policy | Supports them only as the BAA and your scope require |
| Risk analysis | Must perform one for its whole organization | Must perform one for your own operations and contribute technical findings to theirs |
| Technical safeguards in client systems | Decides and funds them | Implements, operates and reports on what is in your scope |
| Breach notification to patients and HHS | Owns it | Must notify the client promptly with the facts it needs |
| Vendors and subcontractors | Signs BAAs with its direct vendors | Signs BAAs with your subcontractors that handle PHI |
Scope matters most for the gaps: the practice's own line-of-business vendor, a doctor's personal phone, the billing company. Name what you do not manage, because an unmanaged device full of PHI will still be the first thing the client blames on IT.
Breach Response: Your Clock Starts at Discovery
Under the Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovering a breach. The 60 days is a ceiling, not a target, and a BAA can set a shorter window, so read yours. Discovery counts from when your organization knew, or should reasonably have known, so an alert that sat unread in a queue does not buy you time.
- Contain the incident and preserve logs before anyone starts rebuilding machines.
- Identify which systems and which PHI may have been accessed, and whose.
- Notify the client's designated contact within the window your BAA sets.
- Give the client what it needs to make its own notifications: what happened, when, what data, and what you have done.
- Record every step, because the documentation is part of the evidence later.
Rehearse this before you need it. A short tabletop exercise with your service desk and escalation team, run against a realistic scenario such as a compromised mailbox at a clinic, will show who does not know the notification path, which logs you do not keep long enough, and which client contact details are out of date. Fix those gaps and record that you ran the exercise, since it is also evidence of a working incident process.
A detection gap is a notification gap. If nobody watches client environments outside business hours, you may not discover a breach until long after it happened. That is one reason healthcare clients are where monitored detection and response earns its place, covered in do I need a SOC for my MSP.
Your Own Tools and Subcontractors
Your RMM, PSA, backup platform, remote access tool, email security vendor and any help desk overflow partner may all create, receive, maintain or transmit PHI on your behalf. Each of them needs to sign a BAA with you before they touch healthcare data. Check which vendors will sign one and on which product tiers, because some offer a BAA only on higher plans.
Watch the quieter paths too. Screenshots attached to tickets, exported reports in a tech's downloads folder and diagnostic files uploaded to a vendor's support portal can all contain PHI. Your PSA should not become an unmanaged copy of your clients' patient records.
Changes on the Way and What to Charge
HHS published a proposed overhaul of the Security Rule in the Federal Register on January 6, 2025. As reported by The HIPAA Journal in July 2026, it is still not final, with final action now expected in July 2027. The proposal would make controls such as encryption, multifactor authentication, network segmentation and anti-malware protection mandatory, and would ask covered entities to verify their business associates' technical safeguards. If it lands in anything like that form, your clients will ask you for evidence more often.
All of this costs you time: onboarding paperwork, documentation, audit questions, and stricter change control. Price healthcare clients for it rather than absorbing it into a standard tier. How MSPs price their services covers tier design, and the article on onboarding a client in 30 days shows where the BAA and the risk review fit in the first month.
Common Questions
Can an MSP be fined directly under HIPAA?
Yes. Business associates are directly liable for certain HIPAA violations, including failing to safeguard electronic PHI and failing to report breaches, so enforcement can reach your MSP and not only your client.
Is there such a thing as HIPAA certification for an MSP?
There is no official HIPAA certification issued by the government. Third-party assessments and attestations exist and can help in a sales process, but they do not replace your own risk analysis and documentation.
Does encrypting client data take my MSP out of scope?
Not if you administer the systems or hold the keys, because you can still access the PHI. Encryption reduces the harm of a lost device or stolen backup, but it does not change your role as a business associate.
What if a healthcare client refuses to sign a BAA?
Treat it as a reason not to take the work. Operating without one leaves both parties out of compliance and leaves you with obligations that no contract defines.
Do dental offices and therapists count as covered entities?
Usually yes, if they conduct standard electronic transactions such as billing insurance. Ask how the practice bills, and assume healthcare clients are covered unless their counsel tells you otherwise.
Do I need extra insurance for healthcare clients?
Check that your cyber and errors and omissions policies cover regulatory investigations and breach costs arising from client work. Some insurers ask specifically about healthcare clients and BAAs at renewal.