HIPAA compliance for msps & mssps

No. A BAA allocates responsibility; it does not implement safeguards. Your configuration, access control, logging, and workforce practices are still assessed against the Security Rule.

Yes, and you should. Roughly two-thirds of the control work overlaps. One control set, two outputs — that is how the platform is built.

Trust centre and questionnaire library go live in days. A defensible full program takes 8–12 weeks. We tell prospects the difference honestly, and so should you.

Yes — one per client, and the terms often differ in breach notification windows and offshore restrictions, so read before templating. You also need downstream BAAs with your own vendors that touch client ePHI. Tracking both directions per client is exactly what the multi-tenant console does.

Fully. Your RMM sees client screens and files, your backup platform holds copies of their ePHI, and your remote access tool is a direct path into their systems. Each vendor behind those tools needs a BAA with you, and each tool belongs in your own risk analysis, not just your clients'.

You can implement and evidence the technical safeguards, but their risk analysis, policies, training, and officer designations remain their legal obligations. The honest offer is managed compliance, not transferred liability — the white-label platform lets you deliver that as a productised service with margin.

Both of you, potentially. Since the Omnibus Rule, business associates are directly liable under the Security Rule, so OCR can penalise the MSP itself — and your client's BAA will contain indemnification on top. Your own program is not optional overhead; it is what stands between an incident and an enforcement action.

Increasingly, yes — MSPs are prime supply-chain targets and client security teams know it. The control set extends from HIPAA to SOC 2 without duplicate implementation, so the diligence request becomes an artefact you already have rather than a scramble.

Most partners bundle platform seats into a compliance tier of their managed service, with assessments and remediation as fixed-fee projects. Because our pricing is published and locked for three years, you can build a margin model that does not get repriced out from under you.