Practice administrators who are evaluating a Managed Service Provider (MSP) for the first time, or reviewing an existing contract, often ask the same question: what exactly does the MSP own? The answer matters more than the monthly price, because undefined scope creates gaps. Work that no one owns is work that does not get done consistently.
This post maps out three categories of responsibility for a properly structured managed IT engagement at a medical practice: what Onsite Technical Services operates and owns, what stays with the practice by nature and by regulation, and what requires a separate conversation and separate scope. Planning pricing for a properly managed medical practice runs approximately $200-$250 per user per month (planning guidance, not a quote). What you get for that range, and what you do not, is the substance of the rest of this article.
The Three-Category Framework for Medical Practice IT Scope
Scope confusion in managed IT contracts almost always comes from collapsing these three distinct categories into a single vague promise. A clear engagement separates them explicitly.
| Category | Who Carries the Responsibility | Examples |
| OTS-Owned | Onsite Technical Services | Monitoring, patching, MDR, backup, tenant administration, helpdesk, audit-log retention, BAA execution |
| Practice-Owned | The practice itself | HIPAA program, workforce training, administrative safeguards, privacy notices, written policies |
| Separately Scoped | Requires its own engagement or vendor relationship | Clinical and medical-device systems, physical security, EHR vendor relationship management |
What Onsite Technical Services Owns and Operates
The recurring managed IT engagement covers the technical safeguards and day-to-day IT operations that keep the practice running and support its HIPAA program. Here is what that work looks like in practice.
Monitoring and Endpoint Management
Every workstation, laptop, and server in the practice is enrolled in a centralized monitoring and management platform. Onsite Technical Services watches device health around the clock, not just during business hours. If a server goes offline or a workstation starts behaving abnormally, the team knows before staff start calling.
Endpoint patching is included. Operating systems and applications receive security updates on a managed schedule. Most breaches exploit known vulnerabilities that already have patches available. Patching is not optional maintenance; it is a foundational security control.
Managed Detection and Response (MDR)
Endpoint Detection and Response (EDR) watches every device continuously for attack behaviors, including suspicious encryption activity, credential theft, and lateral movement, not only known virus signatures. When something triggers, a live Security Operations Center (SOC) takes over. Real analysts triage the alert and act immediately if a genuine threat is confirmed. A breach at 2 a.m. does not wait until morning.
This also includes identity threat detection. Microsoft 365 accounts are the most targeted asset in a medical practice. The engagement monitors for compromised logins, impossible-travel sign-ins, and unauthorized account changes, catching an intruder who has stolen a password before they can reach patient records.
Advanced Email Protection
Email is the primary attack route into most organizations. The engagement includes protection that goes beyond basic spam filtering: sophisticated phishing, business-email-compromise attempts, and weaponized attachments and links are stopped before they reach a user's inbox. This directly reduces the likelihood that a staff member clicks something that opens the practice to a breach.
Endpoint and Microsoft 365 Backup
Microsoft does not fully back up your Microsoft 365 environment. Email, SharePoint files, OneDrive documents, and Teams data require a separate, independent backup. The engagement includes protected backup copies of both computer data and Microsoft 365 content, so if files are deleted, corrupted, or hit by ransomware, recovery is possible without permanent data loss.
Tenant Administration and Microsoft 365 Cloud Security
Microsoft keeps the Microsoft 365 platform running. Configuring it, securing it, and keeping it aligned with HIPAA-relevant technical controls is a separate, ongoing responsibility. Onsite Technical Services owns that work: security baselines, access policies, Data Loss Prevention (DLP) configuration, and identity governance. This is not a one-time setup; it is a recurring operational responsibility that changes as the practice grows, as staff turns over, and as Microsoft releases new capabilities.
Data Loss Prevention keeps sensitive patient information from leaving the environment improperly, whether by accident or by a departing employee copying files before their last day. It monitors how data is shared, emailed, and transferred, and blocks or flags movement that breaks the configured rules.
Business-Hours Helpdesk and After-Hours Incident Response
The helpdesk is available during business hours for day-to-day issues: a printer that stopped working, a provider who cannot access the EHR from a remote location, a new employee who needs their account set up. Response during business hours keeps clinical workflows moving.
Monitoring is 24/7/365. After-hours incident response is included separately for security events. To be direct about what this means: the helpdesk is staffed during business hours; 24/7 coverage applies to monitoring and incident response, not live helpdesk calls at midnight for a forgotten password.
Security Awareness Training
People are the most-targeted part of any organization. The engagement includes recurring training and realistic simulated phishing campaigns so staff learn to recognize and report the scams behind most breaches. This is a technical safeguard under HIPAA's Security Rule and a practical defense against social engineering.
Six-Year Audit-Log Retention
HIPAA requires that audit logs be retained for six years. The managed engagement captures and retains audit logs from across the environment for the full required period. This creates the trail needed to investigate an incident, respond to an audit, or demonstrate that access controls functioned as intended. The six-year retention requirement is separate from the one-year baseline endpoint SIEM retention that applies to general managed IT environments. For a medical practice, the HIPAA-tier standard applies.
Business Associate Agreement (BAA)
Any vendor that handles Protected Health Information (PHI) on behalf of a covered entity is required to execute a Business Associate Agreement. Onsite Technical Services executes a BAA as part of the managed IT engagement. This is not a checkbox on an intake form; it is a formal agreement that defines how PHI is handled, protected, and reported in the event of a breach.
Business Technology Reviews (BTRs)
Periodic Business Technology Reviews are included in the Standard Managed Services engagement. These are structured conversations between Onsite Technical Services and practice leadership about the technology environment: what is working, what has changed, what is coming, and what decisions the practice needs to make. They are part of recurring scope, not a billed add-on.
What the Practice Owns: HIPAA Program Responsibility
The practice remains responsible for its HIPAA compliance program. No IT provider can own this for you, and any provider that implies otherwise is misrepresenting how HIPAA works.
HIPAA separates technical safeguards from the broader compliance program for a reason. The technical safeguards (access controls, audit controls, encryption, integrity controls, transmission security) are the layer Onsite Technical Services implements, operates, monitors, and documents. The compliance program that governs the practice is owned by the practice.
Practice-owned responsibilities include:
- The HIPAA Security Rule risk analysis and risk management program. The practice must identify where PHI lives, how it flows, what the threats are, and what controls address those threats. This is a documented, ongoing program, not a one-time assessment.
- Workforce training and sanctions. Training staff on HIPAA policies, documenting that training, and enforcing sanctions for violations is the practice's responsibility. Security awareness training provided through the IT engagement supports this but does not replace the practice's formal HIPAA workforce training program.
- Administrative safeguards and written policies. Policies covering access management, incident response procedures, contingency plans, and business associate management must be written, maintained, and enforced by the practice.
- Privacy Rule compliance. Notice of Privacy Practices, patient rights requests, minimum-necessary standards, and the broader privacy program belong to the practice and, where applicable, a designated Privacy Officer.
- Breach notification decisions. If a security incident occurs, the practice, guided by its privacy and legal counsel, makes the determination about whether a breach notification is required and to whom. Onsite Technical Services provides technical facts and incident documentation to support that decision. OTS does not make the notification determination on the practice's behalf.
The clearest way to state this: Onsite Technical Services implements and operates the technical controls that support the practice's HIPAA program. The practice owns the program.
What Requires Separate Scope: Clinical Systems, Physical Security, and EHR Relationships
There is a third category that often causes confusion because it sounds like it should be included in managed IT but is not. These items require their own conversations and, in most cases, their own vendor relationships or separate project engagements.
Clinical and Medical Device Systems
Medical devices connected to the network (imaging systems, diagnostic equipment, infusion pumps, and similar devices) are frequently managed by the device manufacturer or a specialized biomedical engineering firm under separate service agreements. Many of these devices run operating systems that cannot be patched on a standard schedule, or that the manufacturer explicitly prohibits from third-party management.
Onsite Technical Services can provide guidance on network segmentation to isolate these devices and reduce risk, but direct management of clinical devices is outside the standard managed IT scope. If your practice has networked medical devices, the right approach is a segmentation discussion, not an assumption that those devices are covered under a per-user managed IT agreement.
Physical Security
Door access controls, badge readers, security cameras, and physical server room controls are physical safeguards under HIPAA's Security Rule. They are also outside standard managed IT scope. Physical security systems typically require their own vendor and their own service agreement. Onsite Technical Services can help coordinate where physical and network security intersect, but the physical security program is practice-owned and separately contracted.
EHR Vendor Relationships
The Electronic Health Record platform is the clinical core of most practices. EHR vendors manage their own infrastructure, their own support relationships, and their own update cycles. Onsite Technical Services supports the devices and network that the EHR runs on, and can help troubleshoot connectivity and access issues, but the EHR vendor relationship, including support contracts, training, and system upgrades, stays with the practice and the vendor.
If the EHR is cloud-hosted (which most modern platforms are), the EHR vendor is a business associate of the practice and should have its own BAA in place directly with the practice. That is separate from the BAA with Onsite Technical Services.
What Managed IT for a Medical Practice Costs: Planning Guidance
A properly managed medical practice IT engagement runs approximately $200-$250 per user per month. This is planning guidance, not a guaranteed quote. Actual pricing depends on the number of users, the complexity of the environment, and specific compliance requirements.
A few important notes on how this figure is structured:
- Per user, not per device. Clinical environments often have shared workstations and procedure-room devices. Pricing is based on users, not device count. Shared-use devices fold into the per-user rate rather than being billed as separate units.
- Network management is a separate line item. Firewall, switch, and wireless management is always billed separately from the per-user rate. The network management rate depends on who owns the hardware and the size and complexity of the network. It is never bundled into the per-user figure regardless of configuration.
- Microsoft 365 licensing is its own line. Microsoft licensing costs are billed directly on Microsoft's terms and are separate from the managed IT engagement fee.
- Projects and migrations are separate. A one-time EHR migration, a new-location buildout, or a major hardware refresh is project work billed separately, not absorbed into the recurring monthly rate.
When comparing this planning range against other proposals, the question to ask is not which proposal is cheaper. The question is which operational responsibilities are actually included, and who is performing the work that is not in a cheaper proposal. Work that is not in scope does not disappear. It either gets done by the practice, gets done inconsistently, or does not get done at all until something breaks.
How to Evaluate What an MSP Actually Owns
A useful set of questions to ask any managed IT provider before signing an agreement for a medical practice:
- Which of these items appear explicitly in your service agreement, and which are handled as best-effort or excluded entirely: endpoint patching, MDR with a live SOC, Microsoft 365 backup, HIPAA audit-log retention (six years), and BAA execution?
- What happens after hours if a security alert fires on a device? Is there a defined escalation path, or does it wait until the next business day?
- Who owns the Microsoft 365 tenant configuration? Is it reviewed and maintained on a recurring basis, or set up once at onboarding and left?
- Is network management included in the per-user price, or is it a separate line item? (If it is buried in the per-user price, what is the provider not including elsewhere to absorb that cost?)
- How do you handle medical devices on the network? Is that in scope, or does it require a separate conversation?
- What documentation do you provide that supports our HIPAA risk analysis and security program? Can you produce audit logs and evidence of technical controls on request?
These questions separate providers who can describe the work they perform from those who are selling a product bundle and calling it managed IT.
Frequently Asked Questions
Does managed IT make our practice HIPAA compliant?
No, and any provider who tells you otherwise is misrepresenting how HIPAA works. The practice owns its HIPAA compliance program, including the risk analysis, written policies, workforce training, and Privacy Rule obligations. A managed IT provider implements, operates, monitors, and documents the technical safeguards that support that program. Those are two different things, and the distinction matters if you are ever subject to an audit or a breach investigation.
Are our medical devices and clinical systems covered under a managed IT agreement?
Not under a standard per-user managed IT agreement. Medical devices (imaging systems, diagnostic equipment, networked clinical devices) are typically managed by the device manufacturer or a specialized biomedical firm under separate agreements, and many cannot be patched or managed by a third party. A managed IT provider can help segment these devices on the network to reduce risk, but direct management of clinical devices is outside standard scope and requires its own conversation.
What does 24/7 coverage actually mean for a medical practice?
Monitoring and after-hours incident response run 24/7/365. If a security event fires at 2 a.m., it does not wait until morning. The helpdesk itself is staffed during business hours for day-to-day support requests. These are two distinct things: a provider who says '24/7 helpdesk' is either overstating coverage or staffing a live helpdesk around the clock, which is worth clarifying before you sign.
Is our EHR system covered under managed IT?
Onsite Technical Services supports the devices, network, and Microsoft 365 environment that the EHR runs on. The EHR vendor relationship itself, including support contracts, system updates, and clinical configuration, stays between the practice and the vendor. If the EHR is cloud-hosted, the EHR vendor should also have a Business Associate Agreement directly with the practice, separate from the BAA with the managed IT provider.
How is medical practice managed IT priced, and what is not included in the per-user rate?
A properly managed medical practice IT engagement runs approximately $200-$250 per user per month as planning guidance (not a guaranteed quote). This is a per-user rate; shared clinical devices fold into it rather than being billed separately. Network management (firewall, switch, wireless) is always a separate line item and is never bundled into the per-user rate. Microsoft 365 licensing is also its own line, billed on Microsoft's terms. One-time projects, migrations, and hardware are billed separately from the recurring monthly engagement.
