Healthcare
Your imaging machine runs an operating system nobody has patched since it was installed.
HIPAA Security Rule configuration, signed Business Associate Agreements, and the network segmentation that keeps a twelve-year-old ultrasound from becoming the way into your patient records. For practices, clinics, dental and behavioural health across Northeast Ohio.
We sign a BAA before we touch anything containing protected health information. That is not a negotiation, it is the starting point.
BAAs signed
Before we touch any PHI.
HIPAA counts twice
It qualifies for Ohio 1354 too.
Devices isolated
Unpatchable kit, segmented not replaced.
45-day clock
Ohio breach law applies on top of HIPAA.
The Real Problem
The risk is rarely the computers. It is everything else plugged into the network.
Practices replace workstations. They do not replace imaging equipment, dental sensors, lab analysers or the machine that talks to the practice management system — because those cost six figures and work perfectly well. Most of them run operating systems that stopped receiving security updates years ago.
That is not a reason to replace them. It is a reason to put them on their own network segment, where a device that cannot defend itself is not sitting next to the server holding your patient records.
The other half is paperwork you will be glad to have. HIPAA asks for risk analysis, access control, audit logging and workforce training — and because HIPAA is a qualifying framework under ORC Chapter 1354, documenting it properly also earns you Ohio’s safe harbour against civil claims. One body of work, two protections.
Segment the devices. Document the program. Sign the BAA. In that order.
Bring us the questionnaire
If a hospital system, payer or cyber insurer has sent you a security questionnaire you cannot currently answer, that document is the fastest way to find your real gaps.
What We Handle
Built around how a practice actually runs
Medical device segmentation
Imaging, lab and diagnostic equipment on its own isolated VLAN, so unpatchable hardware cannot reach your records or the internet unsupervised.
Practice management & EHR support
The system your whole day runs through — kept current, backed up, and restored quickly when something goes wrong on a Monday morning.
HIPAA-aligned access control
Unique logins, automatic logoff, role-based permissions and audit trails that answer who opened which record and when.
Encrypted email & patient communication
Secure messaging for anything with PHI in it, including the referral letters and imaging that currently go out as plain attachments.
Backup with proven restores
Tested on a schedule rather than assumed — because a ransomware event on a practice without working backups ends the practice.
Written policies & staff training
The administrative safeguards HIPAA requires, documented and refreshed, so a compliance review is a folder rather than a fortnight.
Also relevant: secure email and Ohio compliance, which covers the HIPAA and ORC 1349.19 overlap in detail.
Your patients assume this is handled. Let us make that true.
Questions
Questions from practices
Will you sign a Business Associate Agreement?
Yes, before any work begins that touches protected health information. It is the baseline requirement for a vendor in our position and we do not treat it as optional.
Our imaging equipment cannot be updated. Is that a HIPAA violation?
Not in itself. The Security Rule expects reasonable and appropriate safeguards, and isolating unpatchable equipment on its own segment is a recognised, defensible control. Replacing working six-figure hardware is not the expectation.
Are you HIPAA certified?
Nobody is — there is no HIPAA certification body. Be wary of any vendor who claims otherwise. What matters is configuring to the Security Rule and signing a BAA.
Does Ohio breach law apply to us as well as HIPAA?
Yes. ORC 1349.19 runs alongside your federal obligations, with its own 45-day notification deadline. The two stack; neither replaces the other.
We are a two-provider practice. Is this overkill?
No. HIPAA has no size exemption, and small practices are targeted precisely because attackers assume the defences are thinner.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Your One Stop I.T. Shop
Whenever You Are Ready
Let us look at what is actually on your network.
An assessment tells you which devices are exposed, where the records sit, and what a defensible HIPAA program would take. No pressure, no scare tactics.
Isolate the old kit. Prove the program. Sleep better.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com