By Bill Ledebuhr, Director of Operations, Fantastic IT · October 23, 2026
Before you choose a managed IT provider for your medical practice, get clear answers to five questions: who can access your systems, whether your backups have been tested, who answers when the EHR (electronic health record) goes down, who owns each task between you, the provider, and your EHR vendor, and what the full service costs. Ask for the answers in writing: a sample access report, a recent restore test, and a responsibility table.
Medical practices have IT needs most offices don’t. The EHR usually belongs to an outside vendor, patient data falls under HIPAA, and the schedule stops when systems go down. The questions below show how a provider handles each of those before you sign.
1. Who has access to our systems, and how is it controlled?
Your practice needs a clear process for giving people access, changing permissions, and removing access when they leave. That includes your provider’s technicians.
Ask prospective providers:
- Does each staff member and technician have an individual account?
- How do you limit access according to someone’s role?
- Where do you enforce multifactor authentication, including remote and administrator access?
- How do you secure emergency administrator credentials?
- Who reviews access logs, and how often?
- How quickly can you disable an account and revoke active sessions after an employee leaves?
Ask for a walkthrough of a typical employee departure. Your office manager should know who submits the request, who approves it, which systems are covered, and how completion is confirmed. Email, remote access, and the EHR may each require separate steps. Before signing, request a sample access report and a departure checklist, since documents are easier to assess than a general promise.
A practice in Los Angeles County shows what’s at stake. On three consecutive Sundays in February and March 2018, ransomware hit the Center for Orthopaedic Specialists, which serves western Los Angeles County and eastern Ventura County. Its IT vendor managed the servers running its EMR, but the practice had no business associate agreement with that vendor. Staff shared a generic login with administrator access, and the remote desktop was open to the internet, according to HHS’s determination.
The third attack used administrator credentials stolen during one of the first two, which hadn’t been changed. The attacks exposed records for 85,000 patients. HHS cited the missing agreement and the weak access controls and imposed a $240,000 civil money penalty on the practice’s parent organization, Providence Medical Institute (HHS 2024 breach report).
2. What is backed up, and when did you last prove it could be restored?
“We back everything up” needs a follow-up question: what does “everything” include? Your practice might have a cloud EHR, scanned records on a local server, billing files, email, and diagnostic images in a separate application. Each can have different backup arrangements.
Ask for a written inventory showing:
- Which systems and data are protected.
- How often backups run and how long they are kept.
- Who investigates failed backup jobs.
- How backup access is separated from everyday administrator access.
- Whether copies are protected against alteration or deletion.
- When restoration was last tested and what the test showed.
HHS’s ransomware guidance calls for frequent backups, periodic test restorations, and offline backups, because ransomware can disrupt online copies.
Two terms will come up in these conversations:
- Recovery point objective is how much recent data you plan to tolerate losing. An hourly backup schedule could still leave a gap of recent work, depending on when the last successful backup finished.
- Recovery time objective is the target time for getting a system or service working again.
Ask providers to translate both into your workday: “If this server fails at 10 a.m., what information could we lose, and when can staff use it again?” Then request the latest restore test report. Check that the test restored a working application, including everything it depends on. Copying files back is a lower bar.
A cloud EHR still needs a recovery plan
Ask your EHR vendor and your IT provider to explain who restores what. Who restores the hosted application? Who restores your internet connection, workstations, interfaces, and locally stored documents? Can your practice get a usable export of its data?
HHS specifically lists backup, recovery, and data availability as issues to address when using cloud services for electronic protected health information.
3. Who answers when patients are waiting?
A provider can monitor systems around the clock and still handle phone calls, on-site visits, and emergencies on different terms. Ask how its availability shows up in the service agreement for your locations and hours. Our technicians are available 24/7/365, and any provider should be able to put its coverage in writing.
Test it with a specific situation: “Our whole office loses EHR access at 7:15 a.m. Who answers, how soon does troubleshooting begin, and who contacts the EHR vendor?” Then ask:
- What qualifies as a critical incident?
- Is the promised response an acknowledgment or active technical work?
- What are the escalation and update intervals?
- When is an on-site visit available?
- Is after-hours emergency work included?
- Who keeps our practice manager informed?
Response time and restoration time are different commitments. A technician may start work promptly while the recovery depends on replacement equipment or another vendor, and your agreement should explain those dependencies.
For everyday support, ask how staff reach help and how the provider spots recurring problems. A front desk employee should have a simple way to report an issue without becoming the practice’s unofficial IT coordinator.
4. What responsibilities are yours, ours, and the EHR vendor’s?
Ask for a responsibility table before signing, and use it to find gaps and assign an owner to each task.
| Area | What to clarify |
| Account access | Who approves permissions, makes changes, and checks completion? |
| Backups | Who protects each system, reviews failures, and tests recovery? |
| Updates | Who patches workstations and servers, and who approves changes to clinical equipment? |
| EHR problems | Who opens the vendor ticket, coordinates troubleshooting, and updates staff? |
| Security incidents | Who contains the incident, preserves evidence, and contacts practice leadership? |
| Compliance support | Who supplies technical evidence, supports risk analysis, and tracks corrective work? |
| Ending the agreement | Who transfers credentials, documentation, licenses, and data, and at what cost? |
Any provider whose work involves protected health information is a business associate under HIPAA, so get a signed business associate agreement. HHS explains that covered entities generally need written assurances that their business associates will safeguard that information.
The contract should also describe the compliance work included. Ask whether the provider helps with risk analysis, supplies system inventories and access records, documents fixes, or trains staff. Your practice still has its own responsibilities under HIPAA.
Small practices face these issues too. In April 2025, HHS announced a $25,000 settlement with Comprehensive Neurology, a small New York practice, after ransomware made its network and patient records inaccessible, potentially affecting 6,800 people. HHS found the practice had failed to conduct an accurate and thorough risk analysis. Ask every provider: “Who helps us identify risks, and who makes sure the corrective work gets done?”
5. What will the complete service cost?
Ask every provider to price the same list of users, devices, locations, applications, and support requirements. Otherwise, you may be comparing very different services.
Have each proposal separately list onboarding, hardware, software licenses, backup storage, after-hours work, on-site visits, projects, and incident recovery. Ask how shared workstations and part-time staff are counted, and how annual increases work. Then ask: “What could appear on an invoice beyond this monthly fee?”
We charge one flat monthly fee and put it in a written proposal based on your practice’s setup.
Put the provider through a practical walkthrough
Before choosing, schedule a short meeting around three situations:
- A departing employee needs access removed immediately.
- A critical system needs to be restored from backup.
- The EHR becomes unavailable during patient hours.
Ask the provider to explain who acts, what evidence they produce, what the practice must do, and what each situation costs.
How Fantastic IT helps medical practices
We support practices with a 24/7/365 help desk, monitoring, backups, and on-site support for one flat monthly fee. We’re glad to walk through the three situations above with your practice manager before you decide. See how we work with medical practices.
Related: HIPAA compliance for non-medical businesses: why it still matters · IT services for law firms