Administrative Safeguards
Policies, workforce training, sanctions and an assigned security official. This is the group that decides who is accountable, and without it the technical work has no owner.
WHY ITS
An Extension of Your Practice
ITS is a managed service provider and a managed security service provider that works in healthcare IT. We handle the complexity so your team does not have to.
Healthcare Specific Expertise
Our team knows HIPAA from the Security Rule through to Business Associate Agreements, and translates it into practical safeguards.
Cyberattacks do not wait for office hours. Our network and security operations centers watch your systems day and night.
Proactive Protection
Instead of reacting to problems we prevent them, with continuous updates, automated backups and recovery plans that get tested.
A Dedicated Support Team
You work with a consistent group of ITS specialists who know your systems, your workflows and your priorities.
Backups are where HIPAA gets specific, and we have already written the detail rather than repeating it here: see HIPAA data backup requirements and the service behind it, backup and disaster recovery. If you want the vertical rather than the framework, that is managed cybersecurity.
THE SECURITY RULE
What HIPAA Actually Requires of Your IT
The Security Rule is organized into administrative, physical and technical safeguards. These are the six requirement areas that land on the people who run your systems, named the way the rule names them.
Requirement areas summarized from the HIPAA Security Rule at 45 CFR Part 164, Subpart C.
Risk Analysis and Risk Management
A written analysis of the risks to electronic protected health information, and a plan saying which of those risks you are treating first. It is a recurring obligation, not a one off project.
Access Control and Audit Controls
Unique logins, access by role, automatic logoff and audit records of who reached what. A log nobody reads is not a control, which is why review is part of the requirement.
Contingency Plan
A data backup plan, a disaster recovery plan and an emergency mode operation plan, with restores you have actually run. Care delivery does not pause while you rebuild.
Business Associate Agreements
Every vendor that touches electronic protected health information needs an agreement in place, and you need to know which vendors those are. ITS signs one with every healthcare client.
Breach Notification
Written procedures for spotting, containing and reporting a breach, plus the records that show what happened and when. The plan is worth more than the paperwork on the day you need it.
CLIENT RESULTS
What Clients Say About Working With Us
Two ITS clients on what changed once somebody owned the security work. The first is a healthcare provider and says so in his own words.
ITS led significant, transformational changes at Eastern Plumas Health Care to ensure we weren’t susceptible to attacks. Looking back, prior to that partnership, we had a lot of risks on campus. I’m glad nothing happened, but I’m even more proud that after implementing those systems, we’ve avoided data breaches and HIPAA violations throughout our five-year partnership.
We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.
Protecting Patient Data Does Not Have to Feel Overwhelming
A working session on your safeguards, your documentation and your Business Associate Agreements, with the gaps written down and yours to keep. No obligation at the end of it.