Why HIPAA Is Your Problem, Not Just Your Client's
Providing IT to a practice, clinic or any other covered entity makes your MSP a business associate. That means you carry obligations in your own right, not only through your contract, and a regulator investigating a breach can come to you rather than through the client. HHS guidance lists the things a business associate is directly liable for, including complying with the Security Rule, notifying the client of a breach, and signing agreements with its own subcontractors.
In practice the obligations land on the MSP in three places: the tools you run, the people you employ and the vendors you use. A remote support session that records the screen, a technician with a personal phone full of client screenshots, or a documentation platform holding passwords and patient spreadsheets are all ways patient data ends up in your environment. Map those paths for each healthcare client and decide which ones you can close rather than defend.
For the full walk through of scope, risk analysis and liability, read how HIPAA applies to MSPs. This entry covers the parts that change day to day operations.
What It Asks of an MSP in Practice
The reassuring part is that the controls are the ones a competent MSP already runs. The difference is evidence: HIPAA expects you to show what you do and when you last checked it.
| Control | Evidence worth keeping |
|---|---|
| Access management | Onboarding and offboarding tickets, MFA coverage per client, a periodic review of admin accounts. |
| Patching and endpoint security | Patch compliance reports and EDR alert handling records. |
| Backup and recovery | Backup job history and restore tests that actually succeeded. |
| Contracts | A signed BAA for each healthcare client and each subcontractor that touches their data. |
| Disposal | Records of drives wiped or destroyed when hardware leaves service. |
The Misunderstanding That Costs MSPs
Compliance is not a certificate. There is nothing to pass and nothing to hang on the wall. It is an operating discipline judged on whether your controls actually worked when something went wrong, so the useful question is not whether a client is compliant but whether you could demonstrate it on a bad week.
That shapes how you sell it. A healthcare client is buying your ability to produce evidence on demand, so the reporting, documentation and breach response process belong in the price, and a QBR is a natural place to show the evidence you gathered that quarter.
Common Questions
Is there a HIPAA certification for MSPs?
No official one exists. Third party assessments and attestations are available, but they describe your controls rather than grant a government certification.
Does HIPAA apply outside the United States?
It applies to covered entities and their business associates handling protected health information under US law. A non US MSP serving a US healthcare client can still be a business associate.
Do I need a risk analysis for every client?
Each covered entity needs one, and clients often lean on their MSP to produce it. Your own environment, where you hold client data, needs its own as well.
Can my technicians work from home on HIPAA clients?
Yes, if the same safeguards follow them: managed devices, MFA, encrypted connections and no local copies of patient data.