Clinics · law · accounting · professional offices
Dental, medical, legal, and accounting practices in the Tri-Cities and Western North Carolina run on Microsoft 365, an imaging or practice-management box, and a closet nobody wants to open. We keep that stack boring — and we show up when it is not.
We work under a business associate agreement when the work touches ePHI. We do not sell you a “HIPAA in a box” stack we are paid to push. There is no official HIPAA certification for an MSP; anyone who sells you one is selling a logo.
Monday is the imaging PC that will not talk to the sensor. Wednesday is the new hire who needs 365 without inheriting the last associate’s mailbox. Friday is the insurer asking whether you have a continuity plan. None of that should wait on a national queue that does not know State of Franklin from West Market.
Remote first: identity, backups, the vendor pile. Onsite when the closet, the wireless, or the owner who will not put the server on the internet is the actual problem. If you want a monthly security program rather than break-fix, that is fractional CISO / CIO next to the helpdesk — not instead of it.
You keep the vendors and the day-to-day. After you write or book twenty minutes: Avery gets on the line, we say whether this is managed IT, a one-off, or an incident, and you get that in writing. We will talk to the dentist / attorney / existing IT person you already have. Billing is invoice, not a surprise portal. On the first call we need: who has admin on 365, whether there is a BAA already, and whether anything is on fire.
If you have an admin, a helpdesk, or an out-of-town MSP, we do not replace them. We sit next to that person: vendors, budget, security program, surge, and someone who can be in the building. Tickets and day-to-day ownership stay where they are unless you ask otherwise.
A solo attorney or a three-chair dental office is a first-class client. Remote first; onsite in Johnson City, Kingsport, Bristol, Greeneville, Elizabethton, Erwin, Gate City, Abingdon, Asheville, Weaverville, and Mars Hill.
HIPAA, GLBA, and ABA continuity language live on the vCISO page. Destruction methods follow NIST SP 800-88. We will say when you need counsel, not a new firewall.
There is no official HIPAA certification for an MSP. We work under a BAA when the engagement requires it, design 365 and backups so ePHI is not sitting in the wrong place, and issue a signed destruction certificate when drives leave the building.
No. Most of this work is remote: identity, backups, and the vendor pile. We drive to Johnson City, Kingsport, Bristol, Greeneville, Elizabethton, Erwin, Gate City, Abingdon, Asheville, Weaverville, or Mars Hill when the closet or the imaging PC will not wait.
Yes. She keeps the vendors and the day-to-day. We are the named engineer for the stack, the incident, and the questions an insurer or attorney will ask.
vCISO retainers include policy review and a continuity plan with HIPAA / GLBA / ABA language where it applies. We do not pretend to be your counsel.
We will say whether you need a package, a one-off, or a lawyer.
