Managed IT for Medical Practices

Yes — every healthcare client gets a signed BAA before I touch anything in your environment, and I keep a countersigned copy on file for both of us. HIPAA requires it for any vendor who can access or manage systems that store or transmit ePHI, and I won't start work on a practice's network without one in place. The BAA isn't just paperwork — it spells out exactly how I'm allowed to handle ePHI and makes me contractually liable alongside your practice if something goes wrong on my end. If your current IT provider can't produce a signed BAA when you ask for one, that's a compliance gap you're carrying right now, not a hypothetical one.

Yes. I manage the workstations, network, and Microsoft 365 environment your EHR or practice management system runs on — patching, uptime, printer and scanner integration, secure remote access for providers charting from home — and I coordinate directly with your EHR vendor's technical support when an issue is specific to the application itself. Most "the system is slow" or "I can't log in" calls turn out to be infrastructure issues anyway, which is exactly the layer I own. That division of labor means you're not stuck being the go-between on a support call, explaining the same problem twice to two different vendors who each think it's the other one's issue.

The HIPAA Security Rule requires a documented Security Risk Analysis, written security policies, specific technical safeguards — multi-factor authentication, audit logging, encryption at rest and in transit, role-based access controls — and a tested contingency plan covering backup, disaster recovery, and emergency operation. It's not a one-time checkbox; the Risk Analysis is supposed to be revisited whenever your systems or workflow change, and auditors specifically look for documentation, not just controls that happen to be in place. A lot of practices I assess have most of the technical pieces but nothing written down to prove it — which is functionally the same as not having it. My free IT assessment walks through exactly where you stand against each requirement, in plain English, not compliance jargon.

If you have tested, offsite, encrypted backups in place — which I set up and actually verify for every healthcare client, not just schedule and hope — recovery means restoring your systems from a known-good point, not deciding whether to pay criminals who have no obligation to actually unlock your data. I also help practices build and document the incident response plan HIPAA requires: who gets called first, how you isolate affected systems, how you notify patients if ePHI was exposed, and how you document the event. Practices with that plan written down before an attack recover in hours; practices without one spend the first day just figuring out who's in charge of the decision.

You get me — not a help desk ticket routed to whoever's free that day. I've spent over 40 years in IT, running Ask Erik Computer Services since 2006 and serving Lane County practices since I brought the business to Eugene in 2017. I'm a Microsoft Partner, AI-certified, and a BNI Hall of Fame member here in Eugene. For a medical practice, that means one person who already knows your EHR setup, your BAA status, and your compliance history — not a new technician relearning your environment every time something breaks. I document everything, explain it in plain English, and if something does break, I tell you why it broke and what we're changing so it doesn't happen again — not a vague "issue resolved" note from a ticketing system. My clients are practices that want a technology partner who remembers the conversation from six months ago, not the cheapest bid in a stack of proposals.