HIPAA IT Services Portland: Managed IT for Medical, Dental & Therapy Practices
We manage the computers, email and network your practice runs on, with the safeguards HIPAA expects, handled by a local team in Tualatin.
We’ll sign a BAA on request
If we’ll handle systems that store or touch patient information, we sign a Business Associate Agreement with your practice. Just ask during your assessment.
Secure access
MFA on email and key systems, unique staff logins, and quick removal when someone leaves.
Protected devices
Encrypted laptops and workstations, managed patching and endpoint protection on every machine.
Backups you can restore
Backups of Microsoft 365 and practice data, with periodic restore checks.
Secure email
Filtering for phishing and options for sending patient information securely.
Documentation
Records of your systems, access and changes to support your own risk assessment.
Vendor coordination
We work with your EHR, imaging and phone vendors so your staff doesn’t have to.
Good fit for: independent clinics, dental offices, chiropractic, physical therapy and counseling practices across Portland, Beaverton, Tigard, Lake Oswego, Hillsboro, Gresham, Wilsonville and Vancouver WA. Managed plans only: no break-fix, no hourly billing. HIPAA compliance remains the practice’s responsibility; we help with the technical safeguards.
PDX Information Technology Services (PDX IT) provides HIPAA IT services in Portland for medical, dental and specialty clinics, as part of a managed IT plan. We will sign a Business Associate Agreement (BAA) when your practice asks for one. HIPAA puts the responsibility on your practice. Your IT partner still does a lot of the work: signing a Business Associate Agreement (BAA), running the technical safeguards every day, and handing you the evidence when an auditor or cyber insurer asks. PDX Information Technology Services is a local IT provider for Portland-area medical, dental, therapy, chiropractic, optometry, and veterinary practices. We do that work steadily, not once a year when the binder comes out.
Healthcare IT Services for Portland Clinics and Dental Practices
Healthcare is the largest small-business sector in the Portland–Vancouver–Hillsboro metro. The U.S. Census Bureau counts about 9,000 healthcare and social assistance establishments there with fewer than 50 employees (County Business Patterns, 2023). Big health systems like OHSU, Providence, Legacy Health, and Kaiser Permanente anchor the region. Around them are thousands of independent practices that need the same protections without an in-house IT department.
We name those health systems only as local context. They are not our clients. For day-to-day IT beyond HIPAA, see managed IT for healthcare in Portland.
- Physician offices and multi-provider clinics
- Dental practices, where imaging systems and practice software have to stay online
- Chiropractic, physical therapy, behavioral health, and optometry practices
- Outpatient and specialty groups working across more than one location
- Veterinary practices that handle sensitive client data and face the same cyber insurance questions
If you have roughly 10 to 50 workstations, no full-time IT staff, and an EHR or practice management system you can’t afford to lose, this page is for you.
The HIPAA Security Rule in plain English
The Security Rule asks you to protect electronic protected health information (ePHI) with administrative, physical, and technical safeguards. For a small practice, that usually comes down to five things:
- Know where ePHI lives: the EHR, email, imaging, scanned documents, laptops, and backups.
- Control who can reach it: unique logins, least-privilege access, and multi-factor authentication (MFA).
- Protect it at rest and in transit with encryption and secure email workflows.
- Spot trouble and respond to it with monitoring, endpoint detection and response (EDR), and a written incident plan.
- Prove you did the work with a risk analysis, policies, training records, and logs.
HHS has proposed updates to the Security Rule that would spell out several of these controls more explicitly. As of September 2026 those changes haven’t been finalized. The current rule is enforced today, though, and a documented risk analysis is still the foundation. Good security doesn’t need to wait for a final rule.
A signed BAA before we touch patient systems
When an IT provider manages systems that create, receive, maintain, or transmit ePHI for you, that provider is a business associate. We sign a BAA before we take over those systems. It’s step one, not an afterthought.
If your current IT support has never signed one, it’s worth fixing. Cyber insurers and OCR investigators both ask about it.
HIPAA IT Safeguards We Manage for Portland Clinics
- MFA on email, remote access, and critical accounts
- EDR and 24/7 monitoring on every workstation and server
- Patching scheduled around patient hours, so exam-room and front-desk PCs don’t sit unpatched for months
- INKY email and phishing protection on Platinum, plus security awareness training
- Encrypted backups with tested restores and clear recovery targets
- Microsoft 365 protection and alerts on Platinum
- Dark web monitoring on Gold and Platinum
- Coordination with your EHR and practice management vendors. We don’t claim to specialize in any one software brand.
This is managed IT, not a one-time project. As your Portland IT support team, we watch these controls every day and fix drift before it becomes an audit finding. See our cybersecurity services and BCDR for clinics pages for more detail.
Security risk assessment and gap analysis
We start with a HIPAA-focused security risk assessment and give you a prioritized fix list in plain English. It isn’t a 200-page report nobody reads. Cyber insurers and auditors want the same conversation, and the results become your roadmap.
Our compliance services cover regulation mapping, gap analysis, policies, and audit readiness for HIPAA, plus PCI DSS if you take card payments.
Oregon rules that sit alongside HIPAA
Oregon has its own breach law. Under ORS 646A.604, the Oregon Attorney General must be notified when a breach involves the personal information of more than 250 Oregon consumers. Your attorney can tell you how that applies alongside your HIPAA obligations. Our job is to make sure you have the logs, backups, and documentation to respond quickly. (This isn’t legal advice.)
Staff training and audit-ready records
Technology can’t protect a practice if people click the wrong link. Platinum includes employee security training. We also help you keep audit-ready records: policies, MFA evidence, backup and restore test notes, and answers for insurer questionnaires.
Staff are also starting to use AI tools for letters and notes. Our guide to AI and HIPAA for Portland healthcare practices covers what’s safe. If you’re considering Copilot, read Microsoft 365 Copilot security for small business first. For the bigger picture, see the critical role of IT in HIPAA compliance.
HIPAA IT Services Pricing in Portland
Gold Managed Services starts at $100 per user, per month. It includes 24/7 monitoring, weekly tune-ups and security patches, managed security tools, unlimited remote support, and unlimited on-site support. On-site support from Hillsboro to Gresham to Wilsonville to Vancouver WA, including Portland, Beaverton and Clackamas, with no trip fee; remote support anywhere in the U.S.
Platinum Managed Services starts at $180 per user, per month. It includes everything in Gold, plus a 24/7 security operations center (SOC), managed detection and response (MDR), INKY email and phishing protection, employee security training, Microsoft 365 protection and alerts, and dark web monitoring.
Optional add-ons, such as physical system backup and vulnerability scanning, are quoted in writing before you agree to them. Microsoft 365 licenses are billed directly by Microsoft. There are no hidden project fees on managed plans.
Every client is on a proactive managed plan with one predictable monthly price per user. That’s the only way we work, because preventing problems beats reacting to them.
90-Day Opt-Out for Portland clinics
Try us for 90 days. If we’re not the right fit, you can cancel in the first 90 days, no penalties. Switching IT providers shouldn’t feel like a leap without a net.
How we get started
- Step 1: Book a free assessment or an office visit. We bring the coffee and donuts.
- Step 2: We review access, backups, email security, and HIPAA gaps, and explain what we find in plain English.
- Step 3: You get a written Gold or Platinum recommendation with starting-at pricing.
- Step 4: We sign the BAA, then run the cutover while you keep seeing patients.
Our office is at 8215 SW Tualatin-Sherwood Rd, Suite 200, Tualatin, OR 97062. We serve practices across Portland, Lake Oswego, Beaverton, Hillsboro, Tualatin, Wilsonville, and Vancouver, WA. On-site support from Hillsboro to Gresham to Wilsonville to Vancouver WA, including Portland, Beaverton and Clackamas, with no trip fee; remote support anywhere in the U.S. Pricing context: what managed IT costs in Portland.
Frequently asked questions: Portland clinics
Are you the covered entity?
No. Your practice is the covered entity. We’re your business associate: we sign a BAA and run the technical safeguards under a managed plan.
Do you serve dentists, therapists, and vets as well as medical clinics?
Yes. Dental, therapy, chiropractic, optometry, outpatient, and veterinary practices are all a good fit when they need BAA-backed managed IT.
What’s the difference between Gold and Platinum for a clinic?
Both are proactive managed plans. Platinum adds a 24/7 security operations center, MDR, INKY email protection, staff training and Microsoft 365 protection. Both plans include dark web monitoring. Clinics facing tougher cyber insurance questions often look at Platinum.
Where do you provide on-site support?
On-site support from Hillsboro to Gresham to Wilsonville to Vancouver WA, including Portland, Beaverton and Clackamas, with no trip fee; remote support anywhere in the U.S. Our office is at 8215 SW Tualatin-Sherwood Rd, Suite 200, Tualatin, OR 97062, and most issues are fixed remotely first.
What if it isn’t a good fit?
We offer a 90-day opt-out: try us for 90 days, and if we’re not the right fit you can cancel in the first 90 days, no penalties.
Do you offer IT consulting as well as support?
Yes. As part of a managed plan, we provide the IT consulting Oregon practices need for HIPAA planning, cyber insurance renewals, new locations, and technology roadmaps. It’s included in the relationship, not billed separately.
Do you have SOC 2?
No, we don’t claim SOC 2. We sign a BAA, run controls aligned to the Security Rule, and help you document them.
Will you sign a Business Associate Agreement (BAA)?
Yes. PDX IT signs a BAA when your practice asks.
Can you help with our HIPAA security risk analysis?
Yes. We help you complete and document your security risk analysis and then fix the technical gaps it finds. See our HIPAA security risk analysis guide.
What does HIPAA IT support cost?
It’s included in our managed plans: Gold from $100 and Platinum from $180 per user per month. Both include dark web monitoring, and every client starts with our 90-day opt-out.
Related: managed IT services in Portland · managed IT in Vancouver, WA · HIPAA IT in Vancouver, WA · HIPAA security risk analysis · data backup and recovery · managed IT in Lake Oswego · managed IT by industry
Not sure where your practice stands?
Gold from $100 · Platinum from $180 per user/month · 90-day opt-out · No trip fee* · 971-331-4871
Reviews and case studies: How a Beaverton health clinic gained HIPAA confidence · All case studies · Client testimonials
Other IT services: Managed IT services · Help desk & tech support · Cybersecurity · IT compliance · Backup & disaster recovery · IT consulting in Portland · Business VoIP phone systems