Why the MSP is in scope
HIPAA's definition of a business associate turns on access, not intent. If you hold domain admin on a practice's network, run its backups, host its server, or can reach its EHR through a remote tool, you "maintain" or can "access" PHI on the practice's behalf. HHS has said the same about cloud providers that store encrypted data without the key: the ability to reach the systems is enough.
So an MSP with healthcare clients carries two sets of obligations: its own compliance as a business associate, and the technical controls it delivers to clients. Most MSPs are strong on the second and have never thought about the first.
What OCR found at two healthcare IT vendors
In January 2025 OCR announced two settlements that should be on every MSP owner's desk.
- Elgon Information Systems, $80,000. A Massachusetts provider of EHR and billing support services, hit by ransomware. OCR's finding: no accurate and thorough risk analysis of the risks to the ePHI it held for clients.
- Virtual Private Network Solutions, $90,000. A Virginia data hosting and cloud services provider. Same attack type, same finding.
Neither was a hospital. Neither was fined for a client's failure. Each was fined for not doing, for its own environment, what the rule requires of every business associate. Both got corrective action plans with OCR monitoring on top.
Telling clients to do a risk analysis is advice. Doing your own is the law.Your engineer
Your own program, as an MSP
| Requirement | What it means for an MSP |
|---|---|
| Risk analysis, 164.308(a)(1)(ii)(A) | Of your environment: the RMM, the PSA, the backup platform, technician laptops, the documentation system, remote access paths. Where client PHI could be reached, copied or cached. |
| Access control, 164.312(a) | Named technician accounts, MFA on every tool with client access, least privilege per client, same-day removal when a tech leaves. |
| Audit controls and review | Logs of technician sessions into client systems, reviewed. Clients will ask for these after an incident. |
| Encryption | Technician devices, backup repositories, data in transit between you and clients. |
| BAAs both ways, 164.314 | With each client before access; with your backup vendor, RMM vendor, cloud host and anyone else who could reach client PHI through you. |
| Breach reporting | Your client BAAs may give you 24 to 72 hours, not 60 days. Your incident plan has to meet the shortest one. |
| Training and documentation | Every tech trained, records kept, policies written, all retained six years. |
What you can and can't do for clients
MSPs are usually asked to "handle HIPAA". Be precise about what that means, because the gaps are where both of you get hurt.
- You can deliver the technical safeguards: MFA, encryption, patching, backups with tested restores, logging, endpoint protection, access removal. And you can produce the evidence for them.
- You can contribute the asset inventory and the technical half of the risk analysis.
- You can't own the client's risk analysis, policies, training, sanction policy, BAAs with its other vendors, or the Privacy Rule. Those need the practice's security officer and, usually, a compliance specialist.
- Don't say "HIPAA compliant" about your service or your client. Nobody certifies HIPAA compliance, and the phrase shows up in complaints.
Turning it into a service line
Practices want one throat to choke. The MSPs doing well in healthcare offer a bundle: the managed security stack they already run, plus a compliance program delivered with a partner who writes the risk analysis and policies and tracks the evidence. The MSP keeps the relationship and the recurring revenue; the partner carries the compliance expertise and the platform; the client gets one invoice and one phone number.
With AccuSights: we partner with MSPs on exactly that model. Your clients get the platform, the endpoint agent that collects device evidence from the machines you already manage, a named compliance engineer and the written risk analysis. You get a program to sell, a reviewer portal to show, and your own business associate obligations covered in the same place. The partner program.