Practical Managed IT Checklist for Multi-Provider Practices

SECTION 01 OF 12

Why growth creates IT risk

A single-provider office can often get by with informal IT. As providers, locations, and staff are added, the number of devices, accounts, and vendors multiplies. Imaging software, practice management systems, phones, Wi-Fi, and Microsoft 365 all need attention, and knowledge tends to live in one person’s head.

Healthcare organizations are frequent targets for phishing and ransomware. HHS’s 405(d) program publishes Health Industry Cybersecurity Practices that highlight common threats and practical mitigations for small and medium organizations. The checklist below draws on widely accepted basics.

SECTION 02 OF 12

1. Identity and access

• Every user has a unique account; no shared logins for clinical or administrative systems
• Multi-factor authentication enabled on email, remote access, and administrator accounts
• Administrator rights limited to people who need them
• Access reviewed quarterly against current staff lists
• Departing staff accounts disabled on their last day
• Vendor accounts documented and time-limited where possible

SECTION 03 OF 12

2. Devices

• Complete inventory of workstations, laptops, servers, and network devices with owner and location
• Operating system and third-party updates applied on a schedule
• Endpoint protection installed and reporting
• Disk encryption enabled on laptops and portable devices
• Screen lock policies applied
• End-of-life devices identified with a replacement plan

SECTION 04 OF 12

3. Backups and recovery

A backup that has never been restored is an assumption. HIPAA’s Security Rule includes contingency planning requirements, including data backup and disaster recovery planning.

• Critical systems and data identified
• Backups automated and monitored
• At least one copy isolated from the main network
• Restore tested periodically and documented
• Recovery steps written for key systems
• Vendor responsibilities for hosted systems understood

SECTION 05 OF 12

4. Email and phishing

• Email filtering enabled
• Domain authentication records configured (SPF, DKIM, DMARC)
• External email warnings enabled
• Staff trained to recognize and report phishing
• Process for verifying payment or banking change requests by phone

SECTION 06 OF 12

5. Vendors and systems

Keeping a simple register like this prevents the "who do we call?" scramble during outages and supports your risk analysis.

SECTION 07 OF 12

6. Network and Wi-Fi

• Guest Wi-Fi separated from clinical and business networks
• Default router and firewall passwords changed
• Firmware updated
• Remote access only through secured, MFA-protected methods

SECTION 08 OF 12

7. Policies and documentation

HIPAA requires covered entities to conduct an accurate and thorough risk analysis and implement reasonable safeguards. Documentation does not need to be elaborate, but it must exist and reflect reality. Keep written procedures for onboarding, offboarding, incident reporting, and device handling.

An IT provider can supply technical input and evidence, but the risk analysis and compliance decisions remain the practice’s responsibility. Security frameworks such as ISO/IEC 27001 can inform good practice, but adopting a framework does not by itself establish HIPAA compliance.

SECTION 09 OF 12

8. Incident readiness

• Staff know how to report a suspected incident immediately
• Contact list for IT provider, vendors, insurer, and legal counsel
• Steps to isolate affected devices
• Understanding of breach notification obligations
• Cyber insurance requirements reviewed

SECTION 10 OF 12

9. Onboarding new providers and staff

Each new hire is an opportunity to get access right from the start. Use a standard onboarding request that lists the systems the role needs, the permission level for each, and the hardware to be issued. Create accounts only after the request is approved, enable MFA during setup rather than later, and record the device in the inventory with the new owner.

Brief new staff on how to report suspicious emails and who to call for IT help. A ten-minute orientation prevents many of the habits that lead to incidents later.

SECTION 11 OF 12

10. Adding a new location

Opening a location multiplies every item on this checklist. Before opening day, plan the network design, internet redundancy, workstation imaging, printer and imaging equipment setup, phone system configuration, and vendor licenses for the new site. Confirm that backups cover the new location and that the vendor register includes local contacts.

Where physical installation is required, arrange qualified local technicians in advance. Remote IT providers can coordinate and configure, but cabling, mounting, and hardware swaps require someone on site. Document the new environment as it is built, not afterward. Then schedule a review a few weeks after opening to confirm that accounts, backups, security tools, and the inventory all match what was planned, and close any gaps you find before they become habits.

SECTION 12 OF 12

Using the checklist

Review the checklist quarterly with your office manager and IT provider. Mark each item as done, partial, or missing, assign an owner and date to each gap, and track progress. Most practices find a handful of high-impact gaps, often MFA coverage, offboarding, and untested backups, that can be closed quickly.