IT for healthcare clinics in West Monroe and Northeast Louisiana

Identity and shared workstations first

Badge access, a shared workstation at checkout, and a guest in a mailbox are normal clinic patterns. They are also how accounts linger after someone leaves. MFA, Conditional Access, and a joiner/leaver process beat a new firewall for most offices we see. We will not call that “HIPAA certified” unless a specific engagement and documentation say so. We will say when sharing and admin roles are the actual gap.

Microsoft 365 is the default workplace stack: mail, files, Teams, and the identity plane. Shared mailboxes, referral inboxes, and the one printer that authenticates oddly get written down in discovery—not left as tribal knowledge. Front-desk phones are the same honesty test: SimpleVoice hosted VoIP can private-route and record when you enable it, and we will talk about a BAA when compliance asks. We will not call that a HIPAA certification. See the VoIP page for the product and simplevoice.net for feature detail.

Backups you have restored on purpose

Ransomware and a deleted chart folder look the same if you have never restored a file. Clinic work includes Exchange and OneDrive backup design with a restore test, plus endpoint standards that do not assume a hospital SOC. Human help desk is Monday–Friday, 8:00 AM – 5:00 PM Central. Monitoring of covered systems can run continuously.

Custom intake or referral tools are in scope when the off-the-shelf option is worse than writing it. Entra ID sign-in belongs on that app. A second login graveyard is not a product.

A clinic checklist we will actually walk

Shared workstations at the front desk are normal. They are also how a chart stays open under the wrong name. We document who sits there, whether the session locks, and whether a shared Windows login is standing in for real identities.

MFA belongs around the EHR login and the Microsoft 365 account that reaches it. We do not replace the EHR or the practice-management vendor. We harden the identity and the PC the EHR runs on.

Backup restore tests are part of the work. A backup job that has never been restored is a hope. Clinic files, Exchange, and OneDrive get a restore you can watch, on a schedule we write down.

A BAA is a signed contract for a specific engagement. It is not a certification, and it is not assumed to be in place because you are a clinic. We will say when a BAA is required for the work we are doing and when it is not. We still do not call NewRockIT HIPAA certified.