HIPAA-Ready IT for Medical & Dental Practices

What changed, and why practices are calling now

The proposed 2025 HIPAA Security Rule update makes previously "addressable" safeguards effectively mandatory: MFA, encryption, asset inventories, annual penetration testing — and risk assessment that explicitly covers AI tools. Small practices aren't exempt: they historically absorb the majority of OCR penalties, and 76% of 2025 enforcement cases involved risk-analysis failures ($6.6M in fines across 21 cases).

Where ATCOS fits

Security Rule readiness: MFA rollout, encryption verification, asset inventory, the written risk analysis, and pen-test coordination — delivered as documents you can show OCR or your cyber insurer.
AI-tool risk assessment: the AI scribe, the imaging AI, the front-desk chatbot — each vendor's BAA and data posture reviewed and documented before it becomes a finding.
Multi-location networking: site-to-site VPN, firewall management (FortiGate/UniFi), and shared-system uptime across offices — an ATCOS specialty most single-office IT shops can't match. We run SMB networks across four countries today.
EHR/PMS environment management: we manage the infrastructure your clinical software depends on and own the escalation call with the EHR vendor.
User lifecycle: clinical staff turnover handled cleanly — access granted and revoked the day it should be, with the audit trail HIPAA expects.

Typical engagement, 2-location practice (~25 staff)

Component	Scope
Entry: HIPAA-AI Readiness Assessment	Full tier — risk analysis, AI vendor review, gap list, roadmap. Fixed fee from $7,500.
Managed IT	Users, endpoints, servers, both networks, backup verification — from $125/user/mo (compliance documentation included in quote).
Fractional IT Director	Compliance program ownership, vendor management, owner reporting — from $3,000/mo at this size.

See full pricing.

Is our AI scribe HIPAA compliant?

Only if the vendor signs a BAA, your data isn't used to train their models in a way that violates it, and the tool appears in your risk analysis. Many practices adopted AI scribes before anyone checked. We review each vendor and document the analysis OCR expects.

Our dental IT company handles all this — why ATCOS?

If they're truly delivering the documentation, keep them — our second-opinion audit will confirm it in writing. Where we differ from single-vertical dental MSPs is multi-site network architecture and director-level strategy: if you're opening a second location or absorbing another practice, that's our home turf.

HIPAA-ready IT for medical & dental practices.

What changed, and why practices are calling now

Where ATCOS fits

Typical engagement, 2-location practice (~25 staff)

Get the risk analysis before the audit letter