HIPAA-compliant IT for Rockland County practices.
Nyack, Suffern, Spring Valley, New City, Pearl River. A practice here answers to the HIPAA Security Rule and to New York State, and the two do not overlap as neatly as most vendors imply.
Two rulebooks, and only one of them is federal.
Every practice holding protected health information answers to the HIPAA Security Rule. A practice in Rockland County also holds the private information of New York residents, which brings the SHIELD Act into scope.
The good news first: for SHIELD's data-security requirements, a business already subject to HIPAA is deemed compliant. The statute says so. What that safe harbour does not do is make the two identical.
- SHIELD's definition is wider than PHI. It reaches username-and-password pairs, security questions, biometric data and account numbers. A practice can hold New York private information that HIPAA never contemplated — in a scheduling tool, a payment portal, a staff HR folder.
- Notification duties still attach. A breach touching New York residents brings New York notification obligations regardless of how your HIPAA analysis reads, and the Attorney General enforces them.
So we scope both. Treating HIPAA as a complete answer to New York law is the most common mistake we are asked to unpick.
What the Security Rule actually requires of your IT.
Stripped of the vendor language, four things:
Risk analysis
An accurate, current assessment of where PHI lives and what could reach it. 45 CFR 164.308(a)(1)(ii)(A). It is the first thing an auditor asks for and the thing most practices cannot produce.
Access control
Unique accounts, least privilege, and a record of who can reach PHI — including every vendor and every former employee.
Audit controls
Logs that show who touched what, retained long enough to answer a question asked months later.
Agreements
A Business Associate Agreement with every vendor that can reach PHI. Including us — we sign before we get access, not after.
What we run, day to day.
Honest about scope.
What we do not do.
We are not your lawyer and not your Privacy Officer. We do not write your Notice of Privacy Practices, we do not sign off your risk analysis as though it were ours, and we will not tell you that buying managed IT makes a practice HIPAA compliant. It does not. Compliance is a programme; we cover the technical half of it and we are precise about where that half ends.
Verify us before you talk to us.
Every claim on this page is checkable without speaking to a salesperson. Our technician verification page lets you confirm that whoever contacts you actually works here, before they touch a workstation that holds PHI.
The questions practices actually ask.
For the SHIELD Act's data-security requirements, a practice already subject to HIPAA is treated as compliant — that is written into the statute. It does not end there. SHIELD defines private information more broadly than PHI, so a practice can hold New York private information that HIPAA never covered, and the notification duties to New York residents still attach. We scope both, rather than assuming one discharges the other.
Yes. If we can reach systems that hold PHI, we are a business associate and a BAA is required before any access. We sign one as a matter of course, and we will tell you which of your other vendors also need one.
We produce the technical evidence a risk analysis needs and we document what we run. The risk analysis itself is yours — the Security Rule puts it on the covered entity, and a vendor who claims to own it for you is selling you a document, not compliance.
Our office is in Fairfield, New Jersey and we work across Metro New York, so Rockland is routine rather than an exception. Most work is remote; when it is not, we agree the window before we commit to it.
Request a HIPAA posture review.
We will tell you what we can see and what we cannot, before any agreement. If managed IT is not what you need, we will say so.