Start with the patient journey, not the server closet
Trace a patient visit from scheduling through check-in, charting, e-prescribing, billing and follow-up messaging. Note every system each step touches and who uses it. A provider evaluating your practice should be able to explain how it would keep each step running, not just quote a per-device price.
Include the awkward cases: a provider charting from home, a covering clinician who needs temporary access, and a front-desk terminal shared across shifts. Ask how accounts are created, changed and closed, and how quickly a departed employee's access disappears.
Treat HIPAA as your obligation that an MSP supports
If a provider will create, receive, maintain or transmit electronic protected health information on your behalf, expect a business associate agreement and ask what safeguards it actually operates: encryption, multi-factor authentication, log retention and documented incident handling. The U.S. Department of Health and Human Services publishes guidance on the Security Rule that your compliance lead can use to frame the conversation.
No IT contract transfers your regulatory duties. Keep risk analysis and policy decisions with your compliance officer or counsel, and ask each candidate to describe — in writing — which controls it manages, which it only recommends, and which remain yours.
Pin down clinical application boundaries
List your EHR, practice-management, imaging, lab-interface and telehealth tools with each vendor's support terms. Many MSPs maintain the network and devices but escalate application faults to the vendor. Decide who opens that ticket, who follows up, and how a clinician with a frozen chart gets help during clinic hours.
Ask for a walked-through example: the EHR is reachable but e-prescribing fails fifteen minutes before a full afternoon schedule. The answer reveals more about a provider's escalation discipline than any marketing claim about healthcare experience.
Plan downtime procedures before you need them
Identify the minimum set of systems needed to see patients safely: schedule, charts, e-prescribing and phone lines. Ask how often restoration is tested, what a test actually proves, and whether staff get a readable downtime procedure rather than a binder nobody opens.
Discuss recovery order explicitly. A provider that restores the file server before the phone system may technically meet a backup metric while your practice still cannot function. Recovery priorities are a business decision you should set and the MSP should document.
Before requesting proposals
Your preparation checklist
- A written inventory of clinical and billing systems with vendor support contacts
- A list of every location and role that touches patient information, including remote access
- Your expected response times during clinic hours versus after hours
- A draft downtime procedure naming the systems that must come back first
- Confirmation of who owns HIPAA risk analysis and policy decisions inside your practice
Questions for prospective MSPs
- Which safeguards do you operate directly, and which do you only recommend?
- Will you sign a business associate agreement, and what does it cover in practice?
- How do you handle a clinical application fault that belongs to the software vendor?
- What did your most recent restoration test for a similar client actually demonstrate?
- How is access revoked for a departed employee, and how quickly?