| Generic MSP | PK Tech | |
|---|---|---|
| IT Fundamentals | ||
| Day-to-day IT support during business hours | ||
| Procurement and installation of business-class workstations, servers, network equipment, and cloud solutions | ||
| 24/7/365 IT support availability | ||
| Audited annually by a third party for security controls (SOC 2 Type II) | ||
| Properly insured for comprehensive coverage of breaches, extortion, and mistakes | ||
| 15+ years of Microsoft partnership and expertise | ||
| Generic IT Support vs. PK Tech | ||
| Experts in helping healthcare practices comply with required regulations, such as HIPAA and the HITECH Act | ||
| Familiarity with HIPAA risk assessments, security audits, and breach notification deadlines | ||
| Successful track record of hosting and managing EHR/EMR applications in Microsoft Cloud | ||
| Works well with internal IT managers as their backup, escalation point, and security advisor | ||
| Independently verified for HIPAA compliance with a formal Seal of Compliance | ||
Why PK Tech for my Healthcare Services Firm?
Secure, Compliant, Reliable IT solutions
PK Tech helps healthcare organizations improve security, reliability, and operational continuity.
A Message to Healthcare Services Firms
We know Healthcare Services firms.
Healthcare organizations depend on secure systems, reliable uptime, and fast access to information.
PK Tech helps healthcare providers reduce cybersecurity risk, support operational continuity, and build secure technology environments designed around patient data protection and long-term reliability.
We understand the operational impact downtime and security incidents can have on both staff and patient experience.
In healthcare, downtime affects more than operations.
Partner with PK Tech.
Jordan Hetrick
Founder & CEO
Why Healthcare Services Firms Choose PK Tech
Secure Infrastructure
Protect sensitive healthcare and operational systems.
Cybersecurity Protection
Reduce ransomware and phishing exposure.
Reliable Uptime
Support critical healthcare operations with proactive monitoring.
Secure Remote Access
Enable secure access for distributed teams and providers.
Cloud & Microsoft 365 Expertise
Modern collaboration with strong security controls.
Strategic IT Guidance
Support long-term operational and technology planning.
| Rightworks (formally Right Networks) | Thomson Reuters | PK Tech | |
|---|---|---|---|
| IT Fundamentals | |||
| Day-to-day IT support during business hours | |||
| Procurement and installation of business-class workstations, servers, network equipment, and cloud solutions | ❓ |
||
| 24x7x365 IT support availability | ❓ |
||
| Audited annually by a third party for security controls (SOC 2 Type II) | ❓ |
||
| Properly insured for comprehensive coverage of breaches, extortion, and mistakes | ❓ |
||
| 15+ years of Microsoft partnership and expertise | ❓ |
||
| CPA Industry Specific | |||
| Experts in helping CPA firms comply required regulations, such as the FTC Safeguards Rule, IRS Publication 4557 | ❓ |
||
| Familiarity and additional support offered during tax season deadlines | ❓ |
||
| Successful track record of hosting and managing tax applications in Microsoft Cloud | ❓ |
||
| Works well with internal IT managers as their backup, escalation point, and security advisor | ❓ |
||
| 15+ years of experience supporting CPA firms | ❓ |
||
Ready to speak with an expert?
| On your own | Generic MSP | PK Tech | |
|---|---|---|---|
| FTC Safeguards Rule | |||
| Qualified Individual to implement and supervise your company’s information security program The Qualified Individual can be an employee of your company or can work for an affiliate or service provider. The person doesn’t need a particular degree or title. What matters is real-world know‑how suited to your circumstances. The Qualified Individual selected by a small business may have a background different from someone running a large corporation’s complex system. If your company brings in a service provider to implement and supervise your program, the buck still stops with you. It’s your company’s responsibility to designate a senior employee to supervise that person. If the Qualified Individual works for an affiliate or service provider, that affiliate or service provider also must maintain an information security program that protects your business. |
Unknown |
||
| Conduct a risk assessment You can’t formulate an effective information security program until you know what information you have and where it’s stored. After completing that inventory, conduct an assessment to determine foreseeable risks and threats – internal and external – to the security, confidentiality, and integrity of customer information. Among other things, your risk assessment must be written and must include criteria for evaluating those risks and threats. Think through how customer information could be disclosed without authorization, misused, altered, or destroyed. The risks to information constantly morph and mutate, so the Safeguards Rule requires you to conduct periodic reassessments in light of changes to your operations or the emergence of new threats. |
|||
| Required safeguards | |||
| Implement and periodically review access controls Determine who has access to customer information and reconsider on a regular basis whether they still have a legitimate business need for it. |
🤝 |
||
| Know what you have and where you have it. A fundamental step to effective security is understanding your company’s information ecosystem. Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. Keep an accurate list of all systems, devices, platforms, and personnel. Design your safeguards to respond with resilience. |
|||
| Encrypt customer information on your system and when it’s in transit. If it’s not feasible to use encryption, secure it by using effective alternative controls approved by the Qualified Individual who supervises your information security program. |
|||
| Assess your apps. If your company develops its own apps to store, access, or transmit customer information – or if you use third-party apps for those purposes – implement procedures for evaluating their security. |
|||
| Implement multi-factor authentication for anyone accessing customer information on your system For multi-factor authentication, the Rule requires at least two of these authentication factors: a knowledge factor (for example, a password); a possession factor (for example, a token), and an inherence factor (for example, biometric characteristics). The only exception would be if your Qualified Individual has approved in writing the use of another equivalent form of secure access controls. |
|||
| Dispose of customer information securely. Securely dispose of customer information no later than two years after your most recent use of it to serve the customer. The only exceptions: if you have a legitimate business need or legal requirement to hold on to it or if targeted disposal isn’t feasible because of the way the information is maintained. |
|||
| Anticipate and evaluate changes to your information system or network. Changes to an information system or network can undermine existing security measures. For example, if your company adds a new server, has that created a new security risk? Because your systems and networks change to accommodate new business processes, your safeguards can’t be static. The Safeguards Rule requires financial institutions to build change management into their information security program. |
|||
| Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Implement procedures and controls to monitor when authorized users are accessing customer information on your system and to detect unauthorized access. |
|||
| Regularly monitor and test the effectiveness of your safeguards. Test your procedures for detecting actual and attempted attacks. For information systems, testing can be accomplished through continuous monitoring of your system. If you don't implement that, you must conduct annual penetration testing, as well as vulnerability assessments, including system-wide scans every six months designed to test for publicly-known security vulnerabilities. In addition, test whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program. |
|||
| Train your staff. A financial institution’s information security program is only as effective as its least vigilant staff member. That said, employees trained to spot risks can multiply the program’s impact. Provide your people with security awareness training and schedule regular refreshers. Insist on specialized training for employees, affiliates, or service providers with hands-on responsibility for carrying out your information security program and verify that they’re keeping their ear to the ground for the latest word on emerging threats and countermeasures. |
|||
| Monitor your service providers. Select service providers with the skills and experience to maintain appropriate safeguards. Your contracts must spell out your security expectations, build in ways to monitor your service provider’s work, and provide for periodic reassessments of their suitability for the job. |
|||
| Keep your information security program current. The only constant in information security is change – changes to your operations, changes based on what you learn during risk assessments, changes due to emerging threats, changes in personnel, and changes necessitated by other circumstances you know or have reason to know may have a material impact on your information security program. The best programs are flexible enough to accommodate periodic modifications. |
|||
| Create a written incident response plan. Every business needs a “What if?” response and recovery plan in place in case it experiences what the Rule calls a security event – an episode resulting in unauthorized access to or misuse of information stored on your system or maintained in physical form. Section 314.4(h) of the Safeguards Rule specifies what your response plan must cover: The goals of your plan; The internal processes your company will activate in response to a security event; Clear roles, responsibilities, and levels of decision-making authority; Communications and information sharing both inside and outside your company; A process to fix any identified weaknesses in your systems and controls; Procedures for documenting and reporting security events and your company’s response; and A post mortem of what happened and a revision of your incident response plan and information security program based on what you learned. |
|||
| Require your Qualified Individual to report to your Board of Directors. Your Qualified Individual must report in writing regularly – and at least annually – to your Board of Directors or governing body. If your company doesn’t have a Board or its equivalent, the report must go to a senior officer responsible for your information security program. What should the report address? First, it must include an overall assessment of your company’s compliance with its information security program. In addition, it must cover specific topics related to the program – for example, risk assessment, risk management and control decisions, service provider arrangements, test results, security events and how management responded, and recommendations for changes in the information security program. |
|||
-1.png?width=1000&height=705&name=Untitled%20design%20(1)-1.png)
We know Healthcare Services Firms
-
What did HHS propose changing about the HIPAA Security Rule, and does it affect us yet?
In January 2025, OCR put out a 289-page proposal to rewrite the HIPAA Security Rule for the first time in over a decade. We read the whole thing, and here's what matters: it would make encryption, multi-factor authentication, network segmentation, and regular penetration testing mandatory, not "addressable," which is the loophole a lot of practices have been hiding behind for years. As of mid-2026, it's still a proposal. HHS has already pushed the final rule back once. But we wouldn't wait on it. OCR is still enforcing the current rule, and a missing or stale risk analysis is the single most common finding in their settlements. If your last risk assessment predates this year, that's your actual deadline, not whatever date OCR eventually publishes.
-
How do we know so much about healthcare compliance?
Because compliance is compliance. We built PK Tech inside a CPA firm in 2009, and the FTC Safeguards Rule asks almost exactly the same questions HIPAA does: can you prove you've done a real risk analysis, is your data encrypted, do you have MFA on everything that touches sensitive records, do you have an actual incident response plan or just a document that says you do. We didn't have to reinvent our approach for healthcare. We already had the operating model; we're just applying it to ePHI instead of tax returns. And we back it up the same way we always have, with an independent SOC 2 Type II audit every year, voluntarily, because we don't think "trust me" is good enough when you're handling other people's regulated data.
You can read more about how PK Tech got its start here. -
What IT regulations apply to a healthcare practice?
More than most people think. There's the HIPAA Privacy Rule, the Security Rule, and the Breach Notification Rule, all enforced by OCR. If you touch substance use disorder records, 42 CFR Part 2 layers on top with stricter consent rules that most generic IT vendors have never heard of. Most states add their own breach notification requirements. And if you take card payments, PCI DSS doesn't go away just because you're also HIPAA-covered. We bring this up because we've seen firms treat "HIPAA compliant" as a single checkbox. It isn't. It's a stack.
-
What official cybersecurity guidance has actually been issued to healthcare organizations?
HHS runs the 405(d) program, which publishes the Health Industry Cybersecurity Practices, real, threat-based guidance built for practices your size, not enterprise hospital systems. NIST SP 800-66 is the implementation guide for the Security Rule itself, worth reading if you want to know what OCR expects rather than guessing. And OCR's own cybersecurity newsletters call out the exact gaps they find most in investigations, weak risk analyses, and missing MFA near the top of the list every time. None of this is a secret. Most of it just isn't being read.
-
Can I just use a HIPAA compliance template and call it good?
No, and we'll say why instead of just telling you no. We've watched this exact pattern play out with CPA firms and the FTC Safeguards Rule: a boilerplate-written security program looks complete on paper and fails the moment an auditor asks how it maps to your actual systems, your actual EHR, and your actual vendors. A template can't know your business associate relationships or where your ePHI really lives. Your risk analysis has to. Use the template as a starting outline if you want, but the compliance work happens after that, not instead of it.