HIPAA consists of three primary pillars:

• The privacy rule sets standards for when and how protected health information (PHI) can be used or disclosed. It grants patients rights over their own data, including the right to access and amend their records.
• The security rule focuses specifically on electronic protected health information (ePHI). It mandates administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of data.
• The breach notification rule requires organizations to notify affected individuals, the Department of Health and Human Services (HHS), and in some cases, the media, following a breach.

HIPAA compliance for MSPs requires signing a business associate agreement (BAA). As business associates, MSPs can face civil penalties ranging from $145 to $73,000 per violation, with a maximum annual penalty of $2.19 million per category.

HIPAA compliance services for MSPs should focus on four main areas that map to HIPAA's Administrative, Physical, and Technical safeguards.

User education

Human error plays a part in 60% of breaches. With the large number of communications, invoices, and patient records flowing through healthcare networks, all it can take is a temporary lapse in judgment, such as clicking on a malicious link, to kick off a devastating breach.

While HIPAA requirements for security awareness training were somewhat vague, proposed 2026 security rule updates would make specific training modules (like phishing simulations and password hygiene) mandatory. Managed security awareness training (SAT) delivers engaging, story-driven episodes and phishing simulations built on current threat intelligence from millions of protected endpoints and identities, so training reflects real-world attacks instead of stale templates. By helping organizations build a security-conscious culture, MSPs can turn a major vulnerability into an additional security layer.

Authentication and access controls

With so much valuable data handled by healthcare organizations, it's essential to tightly control who has access to what. Enforcing multi-factor authentication (MFA) everywhere is one of the most effective ways to do this. MFA might have prevented the record-breaking (190 million individuals) 2024 Change Healthcare breach, which has been linked to a legacy server lacking MFA. For high-risk healthcare organizations, phishing-resistant MFA solutions are preferred, such as FIDO2 security keys (YubiKeys), access badge integrations, or biometric authentication.

For HIPAA compliance, this must be paired with role-based access control (RBAC) to ensure that users only have the permissions necessary for their specific job function. This control should also have a "break-the-glass" workflow where privileges can be temporarily elevated for emergencies and later automatically revoked.

Audit logging and monitoring

Audit logs of login attempts, file access, and data modifications are central to HIPAA compliance. Beyond collecting these logs, HIPAA requires regularly reviewing them to detect unauthorized activity.

Security information and event management (SIEM) is crucial for this, aggregating data from across the environment to connect the dots between signals. This can help detect sophisticated attacks that might otherwise go unnoticed until it's too late.

Following a breach, HIPAA-regulated organizations must demonstrate what happened. Aside from proving compliance, this forensic investigation can potentially save a substantial amount in notification costs and reputational damage if investigators can show a limited attack scope.

Endpoint security across clinical systems

Endpoints—the workstations, laptops, and tablets used at the point of care—are prime sources of vulnerabilities in a clinical network. A successful phishing attack can turn a single device into a beachhead for a larger attack. While traditional antivirus (AV) is an important first line of defense against known threats, it most likely won't catch modern polymorphic and fileless malware or living-off-the-land (LotL) techniques. That's where Managed EDR becomes essential.

EDR monitors behaviors, not just signatures. If a clinical workstation starts encrypting files or reaching out to suspicious infrastructure, Managed EDR can quickly contain the endpoint, using features like host isolation and SOC-guided remediation to keep an infection from spreading through the hospital network.

An MSP HIPAA compliance checklist needs to go beyond merely ticking off technical controls to navigating the operational realities of a dynamic hospital environment. There's an inherent tension between making systems both highly secure and highly available when clinicians need them.

Maintaining uptime while enforcing safeguards

In a healthcare context, maintaining operations is non-negotiable. In addition to endangering lives, downtime can cost hospitals $1 million or more per day. Defense-in-depth is all about resiliency and layers of protection. If a ransomware attack gets by the primary layers of defense, a hospital must be able to recover quickly. An MSP must design a system with redundant data paths and automated cloud backups. HIPAA requires disaster recovery (DR) plans to be tested regularly.

Managing vendor and remote access

The healthcare supply chain is a complex web of providers, telemedicine platforms, insurers, billing firms, and other third parties. Increasingly, attackers are targeting these vendors to gain access to potentially thousands of downstream clients (as seen in the Change Healthcare attack). In 2024, 88% of major healthcare breaches involved third parties.

An MSP should maintain a comprehensive list of every outside supplier with network access, categorized by risk level based on the type of data they handle. They should also implement zero-trust network access (ZTNA) to ensure that vendors can access only necessary systems and data.

Documenting processes for audits

Under the proposed HIPAA updates, the Office for Civil Rights (OCR) would place greater emphasis on proactive, periodic audits—including audits of business associates. Healthcare organizations would also be required to complete a formal gap analysis every 12 months.

For MSPs supporting healthcare clients, this raises the stakes for documentation. During an audit or after a breach, it is not enough to say safeguards were in place. Organizations must be able to prove it. That means maintaining the compliance artifacts that show which controls were active, when they were active, and how they were monitored.

MSPs also play an important role in supporting annual risk assessments. This often includes running technical vulnerability scans, identifying gaps such as unpatched servers, and documenting "predisposing conditions" that could increase the likelihood of a security incident.

If the proposed HIPAA rule changes are finalized, the burden will become even higher. Safeguards that were previously considered "addressable" would become "required." In practice, that means organizations would have far less flexibility to skip a control or rely on an alternative workaround. Nearly every safeguard would need to be implemented, documented, and ready to defend during an audit.

Data protections

Under the proposed HIPAA rule changes, ePHI must be protected whether it's "at rest" (stored on a disk) or "in transit" (moving across the network). For data at rest, encryption (ideally AES-256) ensures that if a laptop containing PHI is stolen or a hospital database compromised, the bad actor is blocked from accessing the data.

Under "Safe Harbor" rules, the incident may be exempted from breach notification requirements. For the ease of care, when a doctor logs in (e.g., using a badge tap), the electronic health record (EHR) system temporarily "unlocks" the patient's data in the computer's RAM and locks it again after logging off.

All data moving over the internet, from patient emails to data sent to a cloud lab, must be encrypted using secure protocols like TLS 1.2 or 1.3 (preferred).

Healthcare IT environments are notoriously complex, often leading to blind spots that attackers exploit.

Limited visibility into medical devices

Hospitals often have hundreds of connected medical devices, such as heart monitors, infusion pumps, and bedside tablets. Unlike standard PCs, these devices are often "black boxes" that IT teams can't install software on. There is also a legacy software problem for many expensive medical devices (e.g., MRI machines), which run on outdated operating systems that are no longer supported. These often can't be patched, making them targets for attackers. Adding to the complexity is shadow IoT. Biomedical teams may add devices to the network without notifying IT, resulting in unmonitored devices.

Logs collected but not reviewed

HIPAA requires organizations to implement audit controls and regularly review activity across systems that contain or access protected health information. In practice, that means logs cannot simply be collected and stored. They need to be actively monitored so suspicious activity can be identified, investigated, and escalated before it becomes a larger incident.

For many healthcare IT teams, that is easier said than done. Without a 24/7 SOC and properly tuned detection tools, teams can quickly become buried under thousands of daily alerts. The result is alert fatigue, missed signals, and logs that go untouched until after a breach has already occurred.

MSPs help close that gap by turning raw log data into actionable security outcomes. With continuous monitoring, alert triage, and expert investigation, they can help healthcare organizations prove that audit controls are not only in place, but actively reviewed and acted upon.

Huntress helps MSPs support HIPAA-required security safeguards, like continuous monitoring, log retention, and incident response, without the overhead of building their own 24/7 SOC. Our Managed EDR, ITDR, and SIEM provide continuous detection and monitoring of endpoints and identities—all backed by a 24/7 team of security experts. Managed SAT helps build a security-conscious culture to address human vulnerabilities.

Huntress Managed SIEM centralizes logs and supports long-term retention aligned with HIPAA requirements. Smart filtering retains only security-relevant log data, saving on storage costs. Our Managed SIEM streamlines reporting by retaining the events and incident history auditors and cyber insurers expect to see, making it easier to demonstrate that systems were monitored and that meaningful alerts were investigated and addressed.

Because Huntress products are classified as "tools" that do not access, use, or disclose protected health information on behalf of covered entities—and only encounter PHI incidentally—partners typically do not need a BAA with Huntress under HHS guidance. This lets MSPs add an enterprise-grade security layer without introducing a vendor whose core service processes ePHI.