HIPAA IT Compliance for Reno Practices
HIPAA IT compliance is the technical work behind the Security Rule: access control, audit logs, encryption, backups and control of devices that hold patient data. Computer Services Reno sets up and maintains those safeguards for medical and dental offices in Reno, Sparks and Carson City, and we sign business associate agreements. Your practice owns its risk analysis.
Is the HIPAA Security Rule changing?
HHS published a proposed rewrite of the Security Rule in the Federal Register on January 6, 2025 (90 FR 898).1 As of November 2026 it is still a proposed rule, not a final one. The current Security Rule remains in effect, and it is the rule HHS enforces today.
The proposal would remove the split between "required" and "addressable" safeguards, and would call for encryption of patient data, multi-factor authentication, a written inventory of technology assets and a network map, vulnerability scans at least every six months and a penetration test at least once a year. None of that has a compliance date yet. Most of it is good practice under the current rule anyway.
Who does the HIPAA Security Rule apply to?
The Security Rule protects electronic protected health information (ePHI). It applies to two groups.2
- Covered entities: health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions, such as submitting claims or checking eligibility electronically. Most medical and dental offices that bill insurance fall in this group.
- Business associates: vendors that create, receive, keep or send ePHI on a covered entity's behalf. Billing companies, cloud services and IT providers with access to patient data are common examples.
A practice that never conducts those electronic transactions may not be a covered entity at all. That question belongs with your compliance advisor, not your IT provider.
What does the Security Rule ask for?
The rule groups its standards into three kinds of safeguards:3
- Administrative: the risk analysis, risk management, a security official, workforce training, incident procedures and a contingency plan.
- Physical: facility access, workstation use and security, and device and media controls.
- Technical: access control, audit controls, integrity, person or entity authentication and transmission security.
Some specifications are "required" and some are "addressable". Addressable does not mean optional: you implement it if it is reasonable and appropriate, or document why not and what you do instead.
Which HIPAA safeguards does IT support handle?
Most technical and physical safeguards come down to how computers, accounts and backups are set up and maintained. This table shows where an IT provider does the work and where the decision stays with your practice.
| Safeguard | What Computer Services Reno sets up and maintains | What your practice decides |
|---|---|---|
| Access control | Unique logins for each person, role-based permissions, automatic screen lock, prompt removal of departing staff | Who should see which patient data |
| Person or entity authentication | Multi-factor sign-in on email, remote access and admin accounts | Requiring staff to use it |
| Audit controls | Sign-in and activity logging turned on for key systems | Who reviews activity, and how often |
| Integrity | Patching, malware protection and permissions that limit who can change records | Which records need extra protection |
| Transmission security | Encrypted email options, secure Wi-Fi and encrypted remote connections | When staff must send messages securely |
| Encryption at rest | Full-disk encryption on laptops and covered workstations | Where patient data may be stored |
| Contingency plan support | Backups that run, are monitored and are tested with a restore | The written contingency plan and acceptable downtime |
| Device and media controls | Asset inventory, help with secure wiping before reuse or disposal | Policy on personal devices and removable media |
| Risk analysis | Not performed by us | Your responsibility, with your compliance advisor |
What does HIPAA require for backups?
The contingency plan standard requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, with testing and an assessment of which applications and data matter most.3 Practices write the plan. IT makes the plan real: backups of the practice management system, imaging and shared files, copies kept off-site or in the cloud, and restore tests on a schedule.
Our backup and disaster recovery service covers that work, and the restore tests produce dated records you can keep with your compliance file. The cost of getting it wrong is high: IBM's 2025 Cost of a Data Breach report put the average breach in the United States at $10.22 million.4
How fast must a practice report a HIPAA breach?
Under the Breach Notification Rule, a breach of unsecured protected health information generally requires these notices:5
- Affected individuals: without unreasonable delay, and no later than 60 days after discovery.
- HHS: within the same 60 days when 500 or more people are affected, or in a yearly report for smaller breaches.
- Prominent media outlets: when more than 500 residents of a state or jurisdiction are affected.
Your practice and its counsel decide whether an incident is reportable and send the notices. We help gather the technical facts, such as which systems and accounts were involved. Lost laptops are a common trigger, which is one more reason to encrypt them.
Will your IT provider sign a BAA?
An IT provider that can reach your patient data is a business associate, so HIPAA expects a business associate agreement before work starts. Computer Services Reno signs BAAs. Check the other vendors too: your email host, cloud backup service, practice software vendor and anyone with remote access to your network.
BAAs are part of everyday managed IT services for medical and dental offices (see healthcare IT services), along with help desk support, patching and monitoring that runs 24/7.
Which HIPAA IT basics should a small practice check first?
- Every staff member has their own login; no shared front-desk accounts
- Multi-factor sign-in on email and remote access
- Laptops and workstations that hold ePHI are encrypted
- Computers, servers and the firewall get regular updates
- Backups run nightly and a restore has been tested recently
- Logins of former staff are disabled on their last day
- Old drives are wiped or destroyed, with a record kept
- A signed BAA is on file for each vendor that touches patient data
How does a practice start on HIPAA IT work?
See where your IT stands
A free on-site IT assessment looks at your computers, network, backups and security and gives you a prioritized list of what to fix. It is a starting point, not a substitute for your formal HIPAA risk analysis, which your practice owns.
Close the technical gaps
Encryption, MFA, unique logins, patching and tested backups usually come first. The IT compliance overview explains how we split the work with you.
Keep it maintained
Staff, devices and software change every month. Ongoing support keeps the safeguards current. See managed IT pricing for how flat monthly quotes work.
This page is general information, not legal advice.
HIPAA IT compliance FAQ
See where your IT stands, at your office.
Book a free on-site IT assessment. A local technician comes to you, looks at your setup, and gives you a plain-English list of what to fix first. No cost, no contract.