A written risk assessment
A review of where patient data lives, who can reach it, and what could go wrong. Refresh it yearly and after any big change, like a new EHR system or an office move.
Plain-English HIPAA IT: risk review, access, encryption, backups, training.
HIPAA-ready IT for Tampa Bay medical and dental offices
You run a practice, not a server room. HIPAA still expects your IT to protect every patient record, and an audit letter is a bad time to learn what that means. Radiant Technology Solutions, based in Tarpon Springs, builds and runs the IT side for practices across Tampa Bay.
What does HIPAA compliance mean for your IT?
HIPAA compliance for IT means your systems protect patient records the way the Security Rule asks: a documented risk assessment, access limited to the right people, encryption, tested backups, audit logs, a signed business associate agreement with every vendor touching patient data, and trained staff. Radiant builds and runs those controls; your practice stays accountable for compliance.
01
Cybersecurity
EDR, MDR, MFA, and training, explained in plain English and priced per device.
02Microsoft 365
Migration, licensing, Teams and SharePoint, security, and a real backup.
03Backup and disaster recovery
Local and cloud backups, tested restores, and a recovery plan built for Florida.
04Hardware and software
Business-grade computers and licenses, bought, set up, tracked, and replaced on time.
What you get
Which safeguards does your IT need to get right?
Access controls
Everyone gets their own login and only the records their job needs. Multi-factor login, a code on your phone after the password, shuts the door on stolen passwords.
Encryption
Encryption scrambles data so a lost laptop or an intercepted email is unreadable to whoever finds it. We switch it on for drives, email, and file sharing.
Backups you can restore
Copies of patient data kept safe from ransomware, and tested so you know a restore actually works. An untested backup is a hope, not a plan.
Audit logs
A record of who opened, changed, or exported patient data, and when. After an incident, logs answer the hard question: what was touched, and by whom.
Business associate agreements
A signed agreement with every vendor that stores or touches patient data, including your IT provider, cloud apps, and billing service. A missing one is an easy fix beforehand.
The details
What does HIPAA actually ask of your practice's IT?
The HIPAA Security Rule asks you to protect electronic patient records, which the law calls ePHI, in three ways. Administrative safeguards are your policies and training, physical safeguards are locks and devices, and technical safeguards are the settings on your systems.
It does not hand you a shopping list. Instead, it asks you to find your own risks, fix them in proportion to your size, and write down what you did and why.
That written record matters as much as the technology. When a regulator or a cyber insurer asks questions, a practice with notes, logs, and signed agreements stands on much firmer ground.
The rule is also changing. HHS proposed a major Security Rule update on January 6, 2025 that would make encryption and multi-factor login required for nearly everyone. As of September 2026 it is still a proposal, so we set practices up to meet it now rather than scramble later.
HIPAA reaches past the exam room, too. A law firm, billing company, or accounting office that handles patient records for a practice is a business associate and owes the same care. Our healthcare IT support page covers the day-to-day side of running a practice's technology.
You pay a flat monthly fee per device with no contract, and how month-to-month support works is spelled out in plain terms.
In their words
What do Tampa Bay businesses say about working with us?
Radiant Technology Solutions holds 5.0 stars on Google across 96 five-star reviews. Clients keep mentioning the same things: fast response and personal service.
As a small business owner, having reliable IT support is really important! Anytime we've had an issue, Radiant has been very responsive and always willing to go the extra step to help us out.
Ariane C.
What we work with
What protects patient data in a Radiant-managed practice?
Our Elite plan is the one we recommend for healthcare. Here is what it covers, in plain English.
- 01
EDR
Endpoint detection and response: software that spots an attack on a laptop and stops it.
- 02
MDR
Managed detection and response: people watching that software around the clock and stepping in.
- 03
Enhanced MFA
A second check at login, tightened for the systems that hold patient records.
- 04
Password management
A secure password manager, so staff stop reusing one password on every site.
- 05
Dark web monitoring
An alert when a staff email and password appear in a leaked list, so we reset it first.
- 06
Data loss prevention
Rules that catch patient data leaving by email or upload when it should not.
- 07
Cloud-to-cloud backup
A separate copy of your Microsoft 365 email and files, kept outside Microsoft's own systems.
- 08
Network gear
SonicWall, Cisco, and Ubiquiti firewalls and switches configured and patched, with Datto for backup.
Rather than hold someone hostage in a contract we work to earn their business every month.
Ron Slyker, CEO
How it works here
Can an IT company make your practice HIPAA compliant?
- 24/7Help desk for every client, every plan
- 0Contracts to sign, on any plan
No, and you should be wary of anyone who promises it. There is no official HIPAA certification, and HHS does not endorse any company's badge or seal.
Your practice stays the covered entity, the party the law holds responsible. Our job is to build and run the technical controls, keep the evidence, and tell you plainly where the gaps are.
Staff training is the piece people skip. Plenty of breaches start with one person clicking a convincing email, so our Elite plan includes security awareness training that teaches your team to spot the fake before they click.
We keep a record of that training too, because HIPAA expects proof that it happened, not just good intentions.
Not sure where your practice stands?
Book the free network assessment. We show you what looks good, what needs attention, and what to fix first. Rather talk it through? Call 727-493-4723.
How it works
How does Radiant get your practice HIPAA ready?
Here is what happens after the first call, whether your office is in Tarpon Springs or across the bay in Tampa.
- Step-01
Free network assessment
We walk your office, scan the network, and review who can reach what. You get a plain summary of what looks good and what needs attention.
- Step-02
Risk assessment and fix list
We document where patient data lives and rank each gap by risk, so the scary items get fixed first.
- Step-03
Controls go in
Multi-factor login, encryption, endpoint protection, email security, and backups get set up and tested on every device that touches patient data.
- Step-04
Agreements signed
We sign a business associate agreement with you and help you list the other vendors who need one.
- Step-05
Training and watching
Your team gets security awareness training, and our 24/7 help desk and monitoring keep an eye on things after your office closes.
- Step-06
Monthly report, yearly review
Each month you see what we found and fixed. Each year we redo the risk review so your documentation stays current.
Is this you?
Is this the right fit for your practice?
Our HIPAA IT support is built for you if:
- You run a medical, dental, therapy, or specialty practice with roughly 20 to 50 people.
- You handle patient records for a practice as a billing company, law firm, or accountant.
- You have never had a written risk assessment, or the last one is gathering dust.
- Staff share logins, or nobody is quite sure who still has access.
- You want a local team that picks up the phone and can be at your door in Palm Harbor, Dunedin, or Clearwater.
Frequently asked questions
Is there such a thing as HIPAA certification for an IT company?
No. HHS does not certify or endorse any company as HIPAA compliant, and no official certification exists for IT providers or practices. Some firms sell private badges, but they carry no legal weight. What counts is your documented risk assessment, the safeguards you put in place, signed business associate agreements, and proof you keep them current.
Does my IT company need to sign a business associate agreement?
Yes, if they can reach patient data, and almost every IT provider can. HHS names IT support and cloud providers as common business associates. The agreement spells out how they protect the data and how they report a breach. We sign one with healthcare clients and help you list your other vendors.
How often should a practice do a HIPAA risk assessment?
The Security Rule says the risk analysis must be accurate, thorough, and kept current, but it does not set a fixed calendar. Most practices treat once a year as the floor. Redo it sooner after a big change, such as a new EHR, an office move, a new cloud app, or a security incident, because each one shifts where patient data lives.
Is Microsoft 365 HIPAA compliant?
Microsoft 365 can support HIPAA, but only when it is set up for it. Microsoft offers a business associate agreement through its standard terms, and the rest is configuration: multi-factor login, email encryption, data loss prevention rules, and audit logging. Out of the box, several of those protections need someone to switch them on and tune them for a practice.
What are the penalties for a HIPAA violation?
Penalties are tiered by how careless the violation was, from not knowing up to willful neglect left uncorrected, and HHS adjusts the dollar amounts for inflation every year. Beyond fines, a breach can mean patient notification letters, state attorney general attention, and lost trust. A documented, good-faith program is your strongest protection on every one of those fronts.
Does HIPAA apply to a small practice?
Yes. The Security Rule applies to every covered entity that handles electronic patient records, whatever its size. What changes with size is the scale of the answer: a 12-person office can choose safeguards that fit its budget and risk, as long as the reasoning is written down and patient data is genuinely protected.