How HIPAA IT Requirements Shape Technology Decisions for Medical Practices

Will Decatur
Aug 13
17 min read

Every technology choice a medical practice makes, from the email platform your front desk uses to the cloud backup running quietly in the background, is filtered through one lens: HIPAA. Healthcare organizations face a technology challenge that most other industries do not, because every IT decision intersects with patient safety, regulatory compliance, and clinical workflow in ways that demand specialized expertise. That reality shapes budgets, vendor relationships, and day-to-day operations in ways that many practice managers underestimate until a problem surfaces.

IBM reported that the average healthcare data breach cost reached approximately $9.77 million in 2024, the highest average among all industries studied. That number alone should reframe how practices think about technology spending. Compliance is an investment with a measurable return, not a line item to minimize.

This article walks through exactly how HIPAA IT requirements influence the technology decisions your medical practice makes, what the evolving regulatory landscape means for your infrastructure, and how to build a technology foundation that protects patients and keeps your practice out of the crosshairs of enforcement action.

Key Takeaways

HIPAA's three rules govern every IT decision: The Security Rule requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information. Every IT purchase must align with one or more of these safeguards.
Healthcare data breaches are frequent and expensive: As of mid-2026, 772 healthcare data breaches affecting 500 or more individuals were listed on the HHS Office for Civil Rights breach portal, involving the exposure or theft of the protected health information of 139,721,832 individuals in 2025 alone. If your practice has not audited its IT controls recently, the odds are not in your favor.
Small practices bear disproportionate risk: In 2022, 55% of OCR settlements were imposed on small practices. Smaller healthcare providers are most often cited for missing risk assessment documentation, weak HIPAA compliance standards, and gaps in security awareness training. Size is not a shield.
Proposed rules will raise the technical bar significantly: HHS proposed the most significant Security Rule update in twenty years in January 2025, with an effective date that brings independent practices into direct scope for encryption mandates, multi-factor authentication requirements, annual penetration testing, and explicit AI tool risk assessment obligations. Start preparing now.
Vendor management is a compliance obligation, not just a business decision: A Business Associate Agreement (BAA) is a written contract between a covered entity and a business associate that sets the rules for how protected health information is used, disclosed, safeguarded, and returned or destroyed. Business associates include vendors and partners that create, receive, maintain, or transmit PHI on your behalf.

Quick-Start Prioritization Framework

Strategy	Best For	Effort Level	Time to Results
Conduct a HIPAA Security Risk Assessment	All practices, start here	Medium	Weeks
Implement Multi-Factor Authentication	Practices using EHR, email, VPN	Low	Days
Encrypt ePHI at rest and in transit	Practices on outdated systems	Medium	1-4 Weeks
Review and execute all BAAs	Practices adding or changing vendors	Low	Days
Deploy HIPAA-compliant cloud backup	Practices without tested disaster recovery	Medium-High	Weeks
Launch workforce security training	Practices with any staff turnover	Low-Medium	1-2 Weeks
Partner with a healthcare-focused MSP	Small-to-mid practices without IT staff	Medium	30-60 Days

Start here if you are:

A solo or small group practice: Begin with a risk assessment and MFA, these two steps address the most common OCR findings and are achievable without a dedicated IT team.
A growing multi-location practice: Prioritize cloud backup with tested recovery, vendor BAA management, and a managed IT partner who understands healthcare compliance.
A practice expanding into telehealth: Immediately evaluate your remote access security, encryption posture, and whether your telehealth vendor has signed a BAA.

Understanding the Three Rules That Drive Every IT Decision

The Security Rule: Your Technical Blueprint

The HIPAA Security Rule establishes a structured framework to protect electronic protected health information (ePHI), ensuring its confidentiality, integrity, and availability to authorized users. In practical terms, this rule is the reason your practice cannot simply use any software that seems convenient. Every system that touches ePHI must meet a defined set of administrative, physical, and technical standards.

The HIPAA Security Rule mandates covered entities to implement security safeguards to protect the confidentiality, integrity, and availability of ePHI through three core safeguards: technical, physical, and administrative. When practice managers ask why certain IT configurations are required, the answer almost always traces back to one of these three pillars. Technical safeguards cover encryption, access controls, and audit logs. Physical safeguards address workstation security and device disposal. Administrative safeguards govern policies, training, and risk management.

Pro Tip: The HHS Security Risk Assessment Tool, developed jointly by ONC and OCR, is a free resource designed specifically to help small and medium-sized practices work through their risk assessment. It does not replace professional guidance, but it is an excellent starting point for any practice that has never completed a formal assessment.

The Privacy Rule and Breach Notification Rule: The Other Two Pillars

The Security Rule is where most IT decisions originate, but the Privacy Rule and Breach Notification Rule create additional technology obligations. The Privacy Rule governs how patient information can be used and disclosed, which directly influences how your practice configures EHR access permissions, patient portals, and messaging systems. Regulators expect healthcare providers to maintain active, verifiable systems that protect patient information, document risk management efforts, and respond quickly to potential breaches.

The Breach Notification Rule establishes the obligation to notify patients, HHS, and sometimes the media when a breach occurs. The technology implication is significant: your systems must generate the audit logs and incident documentation that allow your practice to determine whether a breach occurred, what data was affected, and who was impacted.

How HIPAA Shapes Your EHR and Software Choices

What HIPAA-Compliant Software Actually Requires

Your electronic health record system is the single largest repository of ePHI in your practice. Every clinical note, lab result, prescription, and patient demographic passes through it daily. HIPAA requires EHR systems to implement access controls, audit logging, encryption, automatic logoff, integrity controls, and transmission security. When evaluating any EHR vendor, these are the non-negotiable capabilities to verify before signing a contract.

Unique user identification means every staff member must have individual login credentials with no shared accounts. Emergency access procedures must define how PHI can be accessed in urgent situations. Automatic logoff must terminate sessions after periods of inactivity. Audit controls must log all access to PHI, including who accessed what, when, and from where.

In my experience, the most common technical gap in small practices is the shared login. A single username and password used by the entire front desk team may feel convenient, but it defeats audit logging entirely, and the inability to attribute ePHI access to a specific individual is a serious compliance failure.

The Business Associate Agreement Requirement for Every Vendor

Your EHR vendor is a business associate under HIPAA. This means you must have a current Business Associate Agreement with your EHR vendor. This same requirement extends to your billing software provider, patient messaging platform, cloud storage vendor, and any IT support company that has access to systems holding ePHI.

If your staff routinely sends messages containing PHI using a third-party email service, that provider likely qualifies as a business associate, and a BAA is required. Major providers such as Microsoft (for Microsoft 365 in healthcare) and Google (for Google Workspace) offer HIPAA BAAs. Standard consumer email services do not. This distinction matters enormously for practices that have staff using personal Gmail accounts or standard consumer-tier email for anything related to patient care.

Pro Tip: Before onboarding any new vendor that will interact with patient data, make BAA execution a prerequisite to going live. Covered entities must actively monitor business associate compliance because they can be held liable for violations if they "knew, or by exercising reasonable diligence, should have known" of a pattern of activity constituting a material breach of the BAA. Many organizations mistakenly believe that a BAA is a "set it and forget it" solution. In reality, ongoing communication, monitoring, and enforcement are essential to ensure that business associates are actually following the agreed-upon security practices.

Encryption: The Requirement That Practitioners Most Misunderstand

What "Addressable" Really Means

One of the most consequential misunderstandings in healthcare IT compliance involves HIPAA's distinction between "required" and "addressable" specifications. HIPAA classifies encryption as "addressable" rather than "required," but this does not mean optional-organizations must implement encryption if it's reasonable and appropriate, or document why an equivalent alternative is being used instead. If you do not use encryption for ePHI, you must document an equivalent alternative. In practice, encryption is the standard.

Any HIPAA-compliant tool your practice uses should encrypt ePHI at rest (AES-256 or equivalent) and in transit (TLS 1.2+). These are not aspirational targets. They reflect what regulators and cyber insurers expect to see documented in your security controls. A practice that has chosen not to encrypt because the spec is "addressable" and has no documented justification for an equivalent alternative is sitting on significant liability.

Practical Encryption Requirements Across Your Systems

The proposed updates foremost among enhanced technical safeguards include the mandatory encryption of ePHI both in transit and at rest, the implementation of multi-factor authentication for all systems accessing ePHI, and the requirement to conduct regular security audits. Even as a proposed rule still pending finalization, this direction is clear: encryption is heading toward explicit mandatory status.

For a practical medical practice, encryption requirements touch multiple technology layers. Your EHR database needs encryption at rest. File transfers with labs, imaging centers, or insurance companies need encrypted transmission. Laptops and mobile devices used by providers need full-disk encryption. Encrypting backup files maintains data security and prevents unauthorized access to sensitive information, even in backup form. Implement access controls for backup systems to help maintain the integrity of your backup copies.

I've found that many practices have encryption enabled on their primary EHR but overlook the backup copies sitting on an unencrypted external drive in a desk drawer. That gap eliminates much of the protection encryption was meant to provide.

Multi-Factor Authentication and Access Controls

Why a Username and Password Are No Longer Enough

The Change Healthcare breach where a portal lacked MFA, is cited as a key example justifying the removal of the "addressable" provision in the proposed Security Rule update. That breach, affecting nearly 190 million individuals, is the most cited data point in the current push to make MFA mandatory across all systems accessing ePHI.

The current HIPAA Security Rule requires access controls and "reasonable and appropriate" technical safeguards but does not name MFA explicitly. HHS OCR's proposed 2026 update, published January 2025 and still proposed, not final, as of mid-2026, would make MFA an explicit requirement for systems accessing ePHI, with limited exceptions. Whether the rule is finalized this year or next, the direction is set. Cyber insurers already treat MFA as a baseline expectation, and practices without it face difficulty obtaining or renewing coverage.

The cost of implementing MFA across a small practice is typically under $500, a fraction of even the smallest HIPAA penalty. If your practice has not yet deployed MFA across your EHR, email, and remote access tools, that is the highest-ROI compliance investment available to you right now.

Role-Based Access and Unique User Identification

Beyond MFA, HIPAA's access control requirements shape how every user account in your practice is configured. Unique User Identification is required, assigning a unique ID to each user to track activity and prevent shared logins. Emergency Access Procedures are required, ensuring secure access to ePHI during crises like system outages.

The practical implication is that your IT systems need role-based access controls that limit each staff member to only the patient data relevant to their job function. A billing coordinator should not have the same access level as your practice administrator. A medical assistant should not have the ability to export full patient record sets. For third-party vendors and business associates, apply least privilege through time-limited accounts, MFA, and enhanced monitoring, especially when they require remote access to systems like EHRs or connected medical devices.

Pro Tip: Schedule a quarterly access control review. Pull a list of all active user accounts in your EHR and practice management systems, confirm each belongs to a current employee or authorized vendor, and verify that access levels still match each person's current role. Former employees with lingering active accounts are a persistent compliance risk.

Risk Assessments: The Foundation of HIPAA IT Compliance

What the Requirement Actually Demands

Every covered entity that creates receives, maintains, or transmits PHI has to conduct an accurate and thorough HIPAA risk assessment in order to comply with the Security Management requirements of the HIPAA Security Rule. This is the single most consistently cited deficiency in OCR investigations. OCR continues to enforce the current Security Rule, under which risk analysis remains the most frequently cited deficiency in OCR investigations.

While the federal regulation does not state a rigid calendar deadline, administrative guidelines and industry best practices dictate that a HIPAA security risk assessment must be completed at least once every 12 months, as well as immediately following major technical, operational, or physical changes within an organization. Think of it like this: your risk profile changes every time you add a telehealth platform, bring on a new vendor, add a location, or upgrade your EHR. Each of those events can create new vulnerabilities that your last annual assessment did not capture.

When to Trigger an Additional Assessment

Beyond the annual baseline assessment, medical practices should conduct targeted risk reviews when facing new EHR modules or software updates, cloud migrations or changes to data storage locations, telehealth platform implementations, medical device integrations, office relocations, staff restructuring affecting access controls, new business associate agreements, workflow modifications, or data breaches and security incidents.

Not only will a risk assessment reveal weaknesses in your business, allowing you to mitigate them before they become an issue, but your documented risk assessment results will be the first document you will be required to show an OCR auditor during a HIPAA audit or following a breach. Documentation is not just a bureaucratic requirement. It is your primary defense.

Backup, Disaster Recovery, and the 72-Hour Mandate

Why Your Current Backup May Not Be Enough

In January 2025, HHS published a notice of proposed rulemaking that would add explicit disaster recovery requirements: written procedures to restore critical systems and data within 72 hours, prioritized by a criticality analysis, plus regular testing of backup and recovery procedures. For many small practices running backups to an external drive or relying on a cloud backup they have never actually tested, this standard represents a significant gap.

Your practice must demonstrate the ability to fully recover all critical patient data within 72 hours of any incident, including ransomware attacks, hardware failures, or natural disasters. This requirement goes beyond simply having backups. You need documented procedures that prove your recovery capabilities through regular testing.

The distinction matters enormously. A backup that completes nightly but has never been tested for restoration provides minimal real-world protection. If a ransomware attack encrypts your EHR on a Tuesday morning, can your practice restore to a functional state by Friday? If your honest answer is "I'm not sure," your disaster recovery posture needs attention.

Building a Recovery Plan That Meets the Standard

Cloud backup naturally supports the industry-standard 3-2-1 rule: three copies of your data, on two different media types, with one copy stored offsite. This provides geographic redundancy and protection against local disasters. For enhanced ransomware protection, consider the 3-2-1-1-0 rule, which adds one immutable backup copy and zero errors through regular verification.

Disaster recovery procedures must ensure systems and ePHI can be restored within 72 hours of any loss or system failure. This requirement emphasizes the importance of HIPAA-compliant cloud backup solutions that can meet strict recovery time objectives. Practices in Southwest Florida are especially exposed to natural disaster risk. A hurricane that damages your office and your on-site backup simultaneously leaves you with nothing to recover from unless you have geographically redundant cloud storage with tested failover procedures.

Pro Tip: Run an actual backup restoration test at least once per quarter. Pick a non-production system, attempt a full restore, and document the time it took and any issues encountered. This test is far less painful than discovering a restoration failure during an actual incident, and the documentation becomes compliance evidence.

Workforce Training as a Technology Compliance Requirement

Who Must Be Trained and What They Must Know

HIPAA training for healthcare workers is a mandatory workforce training requirement that prepares staff to apply the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule to day-to-day handling of protected health information through role-appropriate instruction, onboarding training, periodic refreshers, and documented completion records.

The HIPAA Security Rule requires training on password management, phishing recognition, proper ePHI handling, and incident reporting. New hires must be trained before accessing ePHI, with annual refresher training recommended. This training obligation affects your IT choices directly. Any software tool used to deliver, track, and document training must itself meet HIPAA requirements if it handles employee records tied to PHI access.

Human error remains a leading cause of healthcare data breaches, making ongoing education critical for protection. A study published in May 2025 by JAMA Network Open reveals that hacking now plays a part in 81% of all HIPAA-reported healthcare data breaches, and many of those attacks begin with a phishing email that a trained employee would recognize. Your IT controls and your training program are not separate systems; they work together.

Documentation: The Compliance Record That Auditors Demand

Organizations must document all training with completion records for OCR audit readiness. This means a spreadsheet logging who attended an in-person session is not sufficient on its own. You need records that can demonstrate what training content each employee received, on what date, and that their role-specific obligations were covered. Annually as a refresher is the OCR-cited baseline for an ongoing program, supplemented by periodic security reminders.

Common HIPAA IT Mistakes That Trigger Enforcement

The Gaps OCR Finds Most Often

In my experience reviewing how medical practices handle IT compliance, a handful of failures appear over and over. Missing or outdated risk assessments top the list, followed closely by shared user credentials in EHR systems, unencrypted backup media, missing BAAs with vendors, and staff using personal devices for patient communications without any formal policy.

In 2025, 57.5% of data breaches occurred at healthcare providers. Practices themselves, not their vendors or insurers, bear the majority of breach events. That distribution reflects practices that believe their EHR vendor's compliance posture is sufficient, when in reality compliance requires active management of the entire technology environment.

Risk analyses older than three years provide no compliance protection and signal to regulators that the practice is not taking security seriously. If your last formal risk assessment was completed before COVID-era telehealth expansion, your assessment predates most of the technology your practice now runs. It is, functionally, describing a practice that no longer exists.

What a Strong Compliance Posture Actually Looks Like

A well-structured HIPAA IT compliance program for a medical practice combines documented policies with active technical controls and regular testing. HIPAA compliance is not a checkbox. It requires ongoing risk assessment, documented policies, technical safeguards, staff training, and vendor management.

Practices that manage this well typically work with an IT partner who understands healthcare compliance, not a general-purpose IT provider who treats practices the same as a retail business. Managed IT providers specializing in healthcare understand the unique challenges of medical practice technology and can provide cost-effective solutions. For practices in Southwest Florida, finding a local partner who can respond on-site, understands regional disaster risks, and has signed BAAs as part of their standard engagement is worth the effort.

For practices in Fort Myers, Naples, Cape Coral, and the broader Southwest Florida region, MET Florida, METFL offers managed IT services built around healthcare compliance requirements. MET Florida's managed IT services configure Microsoft 365 security, encryption, and MFA; patch and harden endpoints, servers, and mobile devices; implement secure backup, business continuity and disaster recovery, and retention policies; and enforce access controls and conditional access rules. With 15-plus years supporting EHRs, remote patient monitoring platforms, and compliance systems, MET Florida maintains audit-ready documentation, including all evidence, reports, and training records organized and continuously maintained.

Frequently Asked Questions

What is HIPAA IT compliance and why does it matter for my practice?

HIPAA IT compliance is the set of technical safeguards a medical practice must have in place to protect electronic Protected Health Information (ePHI). This includes encryption, access controls, audit logs, secure data backup, staff training, and vendor agreements. It matters because regulators enforce these requirements through financial penalties, and the average cost of a healthcare data breach far exceeds the cost of maintaining a compliant IT environment.

Do small practices really face HIPAA enforcement, or is it mainly large hospitals?

Small practices face enforcement at a disproportionately high rate. Independent medical practices - solo physicians, small group practices, family medicine offices, specialty clinics, represent the segment of the healthcare system that OCR enforcement data shows bears the highest proportional compliance risk. In 2022, small medical and dental practices accounted for 55% of OCR financial penalties. The assumption that OCR only pursues large health systems is one of the most dangerous misconceptions in small practice management.

How often does my practice need to complete a HIPAA risk assessment?

Administrative guidelines and industry best practices dictate that a HIPAA security risk assessment must be completed at least once every 12 months, as well as immediately following major technical, operational, or physical changes within an organization. This means adding a new EHR module, migrating to cloud storage, onboarding a new billing vendor, or expanding to a new location each triggers the need for a targeted reassessment, in addition to your annual full review.

Does my practice need a BAA with every IT vendor?

If a vendor or partner creates receives, maintains, or transmits PHI for you, a BAA is required, including for subcontractors that handle PHI downstream. This applies to your EHR provider, cloud backup vendor, billing service, patient messaging platform, and IT support company. Many organizations focus on obvious vendors, like billing services, but overlook others such as messaging platforms or cloud hosting providers. These less-visible vendors can still access PHI and, if not properly managed, can introduce significant vulnerabilities.

What does the proposed HIPAA Security Rule update mean for my IT setup?

The January 2025 HIPAA Security Rule Notice of Proposed Rulemaking remains proposed rather than final as of mid-2026, but it signals stricter future requirements for multifactor authentication, encryption, asset inventories, annual compliance audits, network maps, and tested incident response plans. Even if the final rule is delayed, starting with high-impact low-cost measures such as implementing MFA across all systems and conducting staff cybersecurity training provides immediate security benefits while building toward full compliance.

Can my general IT provider handle HIPAA compliance, or do I need a healthcare-specific partner?

Healthcare organizations face a technology challenge that most other industries do not. Generic IT support creates risk in a healthcare environment. A general IT provider can support your infrastructure, but HIPAA compliance requires a partner who understands how to configure systems specifically for ePHI protection, who can sign a BAA as part of their engagement, and who is familiar with healthcare-specific workflows and regulations. Practices that use general IT providers without healthcare experience frequently have compliance gaps they are not aware of.

Final Thoughts

HIPAA IT compliance is not a one-time project or an annual checkbox exercise. HIPAA requires more than a checklist. It is a living system, administrative, physical, and technical safeguards that evolve alongside your technology and workforce. Every technology decision your practice makes, every new vendor, every new device, every new workflow, needs to be evaluated through the lens of how it affects your ePHI environment and your compliance posture.

The good news is that building a strong HIPAA IT foundation is achievable for practices of any size. The combination of a current risk assessment, MFA across all systems, encrypted backups with tested recovery, properly executed BAAs, and ongoing staff training covers the vast majority of what OCR looks for. Adding a healthcare-focused managed IT partner to that equation means your compliance posture stays current even as regulations evolve.

For medical practices in Southwest Florida looking for a local IT partner who understands both the regulatory landscape and the regional risks your practice faces, MET Florida, METFL is available to help you assess where you stand and build a plan that protects your patients, your practice, and your reputation.

Sources

HIPAA Security Rule Overview, HHS.gov. The official HHS summary of Security Rule requirements. The Security Rule requires
2026 HIPAA Security Rule Update, Medcurity. Analysis of the proposed NPRM and its practical implications for healthcare organizations. https://medcurity.com/hipaa-security-rule-2026-update/
HIPAA IT Compliance Checklist for Small Medical Practices, RIT Company. A practical compliance framework for practices with 1-20 physicians. https://ritcompany.com/blog/hipaa-it-compliance-checklist-for-small-medical-practices/
2025 Healthcare Data Breach Report, HIPAA Journal. Annual analysis of OCR breach portal data and enforcement trends. https://www.hipaajournal.com/2025-healthcare-data-breach-report/
Largest Healthcare Data Breaches of 2025, HIPAA Journal. Detailed review of major 2025 breach events and affected individuals. https://www.hipaajournal.com/largest-healthcare-data-breaches-of-2025/
HIPAA Violation Statistics: 2026 Enforcement, Fines & Breach Data, FaxSIPit. Cumulative enforcement and breach statistics through early 2026. https://www.faxsipit.com/blogs/hipaa-violation-statistics
HIPAA Technical Safeguards, HIPAA Journal. Explanation of the five Security Rule technical safeguard standards. https://www.hipaajournal.com/hipaa-technical-safeguards/
HIPAA Access Control Requirements Explained, Censinet. Practical breakdown of access control implementation specifications. https://censinet.com/perspectives/hipaa-access-control-requirements-explained
EHR Compliance: HIPAA Requirements for Electronic Health Records, Medcurity. Technical requirements for EHR systems under current and proposed HIPAA rules. https://medcurity.com/hipaa-ehr-compliance/
HIPAA MFA Requirements in 2026, Medcurity. Analysis of multi-factor authentication under current and proposed Security Rule. https://medcurity.com/hipaa-mfa-requirements-2026/
Are Business Associate Agreements Still Required Under HIPAA?, Accountable HQ. Current BAA requirements and proposed rule implications. https://www.accountablehq.com/post/are-business-associate-agreements-still-required-under-hipaa-in-2025
HIPAA Business Associate Agreement, 2026 Update, HIPAA Journal. Comprehensive guide to BAA requirements and common oversights. https://www.hipaajournal.com/hipaa-business-associate-agreement/
HIPAA Encryption Requirements for Medical Practices, PHI Guard. Practical encryption standards for small clinics. HIPAA classifies
New HIPAA Rules: 72-Hour Data Restoration, Kobalt.io. Explanation of proposed backup and disaster recovery requirements. https://kobalt.io/hipaa-data-restoration-mandate-healthcare/
HIPAA-Compliant Disaster Recovery, Eon.io. Cloud disaster recovery planning framework for healthcare organizations. https://www.eon.io/blog/hipaa-compliant-disaster-recovery
How Often Should a Medical Practice Perform a Risk Assessment, Medical ITG. Guidance on risk assessment frequency and event-driven triggers. https://medicalitg.com/hipaa-compliance/how-often-should-a-medical-practice-perform-a-risk-assessment-3-2/
HIPAA Training Requirements, Updated for 2026, HIPAA Journal. Full breakdown of workforce training obligations under Privacy and Security Rules. https://www.hipaajournal.com/hipaa-training-requirements/
HIPAA Compliance for Independent Medical Practices: 2026 Guide, Patient Protect. OCR enforcement patterns and compliance requirements for small practices. https://patient-protect.com/post/hipaa-compliance-independent-medical-practices-2026
HIPAA Security and Business Associates: What You Need to Know, EPI Compliance. Overview of BA obligations and common vendor management oversights. Covered entities must actively monitor business associate compliance
Managed HIPAA Compliance for Small Practices, MET Florida. Overview of MET Florida's integrated managed IT and HIPAA compliance program. https://www.metflservices.com/post/managed-hipaa-compliance-for-small-practices