What Managed IT Includes for a Medical Practice

Two managed IT proposals land on your desk. One is $120 per user per month, the other $180. Both say "comprehensive support." Only when you read the fine print do you find that the cheaper one excludes backups, after-hours help and anything to do with your EHR.

Managed IT services for medical practices are hard to compare because "managed" means different things to different providers. This guide lists what a complete agreement should cover, what is usually excluded, and how to read a proposal line by line.

What managed IT means for a medical practice

A managed IT provider, often called a managed service provider or MSP, takes ongoing responsibility for your technology for a fixed monthly fee. Instead of calling someone when things break, you pay for monitoring, maintenance, security and support that aim to stop problems before they reach patients.

For a healthcare provider, the scope has to include HIPAA compliance and cybersecurity, not just keeping computers running. Managed IT services for healthcare differ from general business IT on exactly those two points. If you are still deciding between models, our comparison of managed IT and break-fix covers that choice.

What a complete managed IT agreement includes

Help desk and user support

Staff should be able to reach a technician by phone, email or portal. The agreement should state support hours, after-hours coverage and response times by priority. Ask whether remote support is unlimited or capped at a number of hours.

Device management and patching

Every workstation, laptop and server should be inventoried, monitored and patched on a schedule. That includes operating systems and common applications. Ask how quickly critical security patches are applied, and how exceptions are handled for devices running clinical software.

Devices on unsupported systems need a plan, too. Our post on end-of-life operating systems covers the options.

Monitoring and alerting

The provider should watch servers, network devices, backups and security tools around the clock and act on alerts. Monitoring without someone responding to alerts is a dashboard, not a service.

Network, firewall and Wi-Fi

Firewall management, secure Wi-Fi with a separate guest network, and network documentation belong in scope. Our guide to HIPAA-compliant Wi-Fi explains what a medical office network should look like.

Backup and disaster recovery

Backups of servers, cloud data and Microsoft 365 should be included, with copies stored offsite. More important, the provider should test restores and show you the results. A backup nobody has restored is a guess. Ask where backup data storage lives, and whether it is encrypted and kept separate from your network.

Healthcare downtime costs an average of $7,900 per hour, so recovery time and business continuity matter as much as the backup itself. Our backup and disaster recovery guide covers how to set recovery targets.

Cybersecurity

Security is the part of managed IT that has changed most. Healthcare has the highest data breach costs of any industry, an average of $7.42 million according to IBM's 2025 Cost of a Data Breach Report. A healthcare agreement in 2026 should include:

• Endpoint detection and response on every device, with a team watching alerts
• Email filtering and phishing protection
• Multi-factor authentication on email, remote access and the EHR
• Regular vulnerability scans
• Security awareness training for staff
• An incident response process with named contacts

Our guides to setting up MFA and phishing training go deeper on two of these.

Microsoft 365 and email

User accounts, licenses, mailbox settings and security policies for Microsoft 365 or Google Workspace should be managed by the provider. That includes the settings that make email HIPAA compliant, which our Microsoft 365 guide lists.

Onboarding and offboarding

New staff need accounts and devices on day one. Departing staff need access removed the same day. The agreement should cover both, with a checklist. Our onboarding and offboarding guide has one you can use.

Vendor management

When the EHR, phone system or printer breaks, someone has to call that vendor and stay on the line. A good provider handles those calls for you, even when they cannot fix the software themselves.

Compliance support

The provider should support your HIPAA compliance work: help with the annual security risk assessment, technical evidence for policies, and a signed Business Associate Agreement. They cannot be your compliance officer, but they hold much of the evidence OCR asks for.

Our risk assessment checklist shows which items depend on your IT provider.

Planning and reviews

Quarterly business reviews should cover open issues, security reports, aging hardware and a budget for the next year. Higher tiers often add a virtual CIO or CISO. Our post on what a vCISO does explains when that role is worth paying for.

What is usually excluded

These items are often outside the monthly fee. None of them is unreasonable to exclude, but you should know before you sign.

• Hardware and software licenses. New computers, firewalls and Microsoft licenses are usually billed separately.
• Projects. Office moves, server migrations, new locations and EHR upgrades are usually quoted as separate projects.
• EHR application support. Clinical workflow questions inside the EHR go to the EHR vendor. The MSP covers the devices and network it runs on.
• Onsite visits. Some plans include a set number of onsite hours; others bill every visit.
• Major incident recovery. Recovering from a ransomware attack can exceed the plan's scope. Check how your cyber insurance and the agreement work together.

How managed IT is priced

Providers price per user, per device or by tier. Per-user pricing is common because it covers each person's laptop, phone and accounts in one number. Watch for onboarding fees, minimum terms and charges for leaving.

Our guide to IT budgets for medical practices puts these numbers in context. Our own pricing page lists exactly what each 4MEDNET tier includes, and the plan comparison shows them side by side.

Questions to ask about any proposal

1. What are your support hours, and what does after-hours support cost?
2. Are backups included, and how often do you test restores?
3. Who watches security alerts at night and on weekends?
4. Will you sign a Business Associate Agreement?
5. Which of these items are excluded or billed separately?
6. What happens to our data and documentation if we leave?

Response times deserve their own review. Our guide to IT provider SLAs explains how to read them.

Managed, in-house or both?

Practices with an internal IT person do not have to choose. Co-managed IT gives your staff member tools, security monitoring and backup while they handle daily requests. Our post on co-managed IT covers how that split works.

Whichever model you choose, ask for the scope in writing. A clear list of what is included and excluded is the best predictor of a good relationship with any managed IT provider. If you want to compare a proposal against our scope, our managed IT services page is a good starting point.