Who is a HIPAA compliance IT consultant for medical practices in Dallas?
Cross River Tech helps Dallas medical practices with the IT side of HIPAA. I am Anthony Omini: I inventory every device and account that touches patient data, write the technical findings for your risk analysis, and put the safeguards in place: unique logins, multi-factor authentication, encryption, logging, patching, tested backups and separate networks. I am not a compliance attorney or auditor; your practice keeps the policies, training and decisions.
Answered by Anthony Omini, Cross River Tech, Dallas
Key takeaways
- An IT consultant supports your HIPAA risk analysis with an inventory of every device, account and system that touches patient data, plus written findings and a fix list.
- The technical safeguards are concrete: unique logins, multi-factor authentication, encryption, automatic logoff, audit logs, patching, endpoint protection and tested backups.
- Any IT provider who can reach patient data signs a business associate agreement before the access starts.
- Policies, training records and risk decisions stay with the practice; IT supplies the evidence that the controls exist.
- No one can make a practice officially HIPAA approved; be wary of anyone selling that.
What a HIPAA compliance IT consultant in Dallas actually does
A HIPAA IT consultant finds where patient information lives in your practice, shows you the security gaps, fixes the technical ones and gives you the evidence for your compliance file. That is the work I do for medical practices in Dallas–Fort Worth: clinics, physician offices, therapy and chiropractic offices, and med spas that handle patient records.
I am Anthony Omini, owner of Cross River Tech, and I am your direct contact: I answer the phone, plan the work and come onsite myself, while my team handles the day-to-day monitoring and updates. I have over 15 years of IT experience across many industries and global organizations, and for a medical practice that experience turns into practical answers: who needs access to which system, how to protect the laptop that goes home with the office manager, and how fast you can get the schedule back if the server dies on a Monday morning.
What I am not matters just as much. I am not a compliance attorney or an auditor, and I do not issue anyone a HIPAA stamp, because no official one exists. If someone offers to make your practice officially HIPAA approved for a fee, they are selling a private document, not a status the government recognizes. My job is to make your technology support your HIPAA duties and to tell you plainly what still needs your attention.
If you want to talk it through, call or text (214) 612-7080, or send me a short request with your practice type, your EHR and the reason you are asking.
The HIPAA Security Rule in plain words
The Security Rule protects electronic protected health information, usually shortened to ePHI: any patient information stored or sent electronically. Its aim is simple. Patient data stays private, stays accurate and is available to the people who need it. The rule groups the protections into three kinds:
- Administrative safeguards: the decisions behind security. Who is responsible, how risks are assessed, who approves access, how staff are trained and what happens when something goes wrong. Your practice makes these decisions; I turn them into system settings and tell you where the technology cannot do what the policy says.
- Physical safeguards: the equipment and the rooms. A screen a patient can read from the waiting area, an unlocked network closet, an old PC in a storage room with records still on it. I point out the technology exposures and handle secure disposal; you control the building and the people.
- Technical safeguards: how systems identify users, control access, record activity and protect data in transit and at rest. This is where most of my work sits.
Some parts of the rule are "required" and some are "addressable". Addressable does not mean optional: it means you assess it, then either implement it or document why an equivalent measure fits your practice better. A med spa or wellness business should also confirm whether it is a covered entity at all, with legal advice if needed. I can map your systems and data flows; I do not make that legal call.
Start with the security risk analysis
Every covered practice must do a security risk analysis. A vulnerability scan or a software report feeds into it, but on its own it is not the analysis. The analysis looks at where patient data is, what could happen to it and how likely and serious that would be. Here is how I support it:
- Inventory. Every device, account and system that touches patient data: the EHR and practice management system, workstations at the front desk and in exam rooms, laptops that leave the building, phones that read work email, scanners, the imaging system, cloud apps, admin accounts, remote access tools and the vendor connections nobody remembers.
- Data flow. How a record actually moves. A referral arrives by email, gets downloaded to a desktop, scanned into the EHR and then sits in a local Downloads folder for two years. Looking only at the EHR misses that copy.
- Findings with evidence. What was checked, what was found, which systems it affects and why it matters. "Improve security" is useless. "A former employee's account is still active in email and remote access" is something you can act on today.
- A fix list. Each item with the correction, who approves it, who does it and how we confirm it is done.
Your compliance lead folds this technical work into the full analysis, alongside interviews, procedures and the physical walk-through. The practice owns the analysis; I make sure the technology part of it is complete and true.
The technical safeguards I put in place
These are the controls I set up and maintain for a medical office, chosen around your systems and the decisions in your risk analysis rather than copied from a generic list.
| Safeguard | What it looks like in a small practice |
|---|---|
| Unique logins | Every person has their own account in Windows, email and the EHR. No shared front-desk password, so you can see who opened a chart and remove a departing employee cleanly. |
| Role-based access | Scheduling, billing and clinical staff see what their job needs. You approve the roles; I set them where the software allows. |
| Multi-factor authentication | A second check beyond the password on email, remote access, the EHR portal where supported and every admin account. |
| Encryption | BitLocker or FileVault on laptops with the recovery keys stored under the practice's control, and a protected way to email patient information. |
| Automatic logoff and screen lock | Exam-room and front-desk screens lock when nobody is there, checked in both Windows and the clinical application. |
| Audit logs | Sign-ins, access and admin changes recorded and kept, with someone named to review them. |
| Patching and endpoint protection | Windows, browsers and apps updated on a schedule; antivirus monitored. Vendor-restricted imaging PCs updated in step with the vendor, not forced. |
| Backups with tested restores | Copies of the server, local files and cloud mailboxes, one copy offsite and one that ransomware cannot delete, restored on a test schedule. |
| Separate networks | Guest Wi-Fi kept away from practice systems, and medical devices on their own network segment with firewall rules between them. |
A setting being available is not the same as a setting being on. Part of the job is proving each control is active on every machine, not just on the one I happened to look at. The broader security and recovery work is described on the cybersecurity and backup page, and the Microsoft side in Microsoft 365 security settings for a small business.
Business associate agreements, the EHR and imaging
A business associate agreement, or BAA, is the contract a practice signs with any vendor that handles patient information on its behalf. An IT provider whose support can reach patient data needs one in place before that access starts; a confidentiality line in a general contract does not replace it. I sign a BAA with the medical practices I support, and I help you list the other vendors that need one: the EHR, the backup provider, the email platform, the phone system if it records calls or voicemail with patient details.
Microsoft 365 offers a BAA under its standard terms for its covered services, and Google Workspace has its own. Having the agreement does not configure anything, though. Sharing settings, external forwarding, mailbox access and email encryption still have to be set correctly, and that is my part.
With the EHR, practice management and imaging systems, I look after everything underneath: the workstations, the network, printers, scanners, the server or connection the software runs on. When a problem sits inside the vendor's software, I open the case with the vendor and stay on it until it is resolved, so your front desk is not stuck on hold. I do not change clinical workflows without your approval, and I keep vendor-supported settings on medical devices.
Practices that combine medical and dental work will find the dental side in HIPAA-compliant IT for dental offices.
Who does what: the practice and the IT consultant
HIPAA goes wrong in small practices when everyone assumes someone else has it. This is the split I work to:
| Responsibility | What I do | What the owner or compliance lead does |
|---|---|---|
| Risk analysis | Inventory, technical findings, fix list | Leads the full analysis, approves risk decisions |
| Access | Creates accounts, sets permissions and MFA | Defines roles, approves every change |
| Physical security | Flags exposed equipment, wipes and disposes of old devices | Controls rooms, visitors and screen placement |
| Encryption and email | Turns it on, documents it | Sets the rules for sending patient information, trains staff |
| Audit logs | Enables and keeps the logs, investigates technical events | Names who reviews them and how issues are escalated |
| Backups | Runs backups, tests restores, records results | Sets recovery priorities and downtime procedures |
| Policies and training | Supplies technical instructions and evidence | Adopts policies, runs training, keeps the records |
| Incidents | Contains the technical problem, preserves evidence | Leads the response with legal advice, decides on notification |
What I hand over goes into your compliance file: the inventory, configuration records, access lists, findings, restore test results and change records. Each piece names the system it covers and the result, so it still makes sense to an auditor a year later.
Onboarding, offboarding and an owner's checklist
Most real-world HIPAA gaps come from staff changes. A new hire starts Monday and borrows a colleague's login; an employee leaves and their email keeps working for three months. A repeatable process fixes both. Before someone starts, you approve their role and I create individual accounts, set up multi-factor authentication and prepare the computer. When someone changes roles, access is adjusted rather than added to. When someone leaves, you tell me the date and I disable accounts, end sessions, remove remote access and collect or wipe devices, covering email, the EHR, shared files, vendor portals and remote tools, not just the mailbox.
Before an IT review, gather what you can:
- The name of the person who coordinates compliance decisions.
- Your current risk analysis and any open findings.
- A rough list of computers, laptops, phones and locations.
- The EHR, practice management, imaging and billing systems you use.
- Who has admin access to email, the firewall and the EHR.
- Whether laptops are encrypted and MFA is on for email.
- How backups run and when a restore was last tested.
- Your BAAs, policies and training records.
- How the last employee departure was handled.
Missing pieces are fine. They become part of the work, each with an owner. If you are setting up a new location, opening a medical clinic in Dallas: the IT setup checklist builds these decisions in from the start.
What HIPAA IT help costs, and when to hire someone else
There are two ways to work with me. A one-time review is hourly with no contract: $100 an hour remote or $150 onsite during business hours, Monday to Friday 8 AM to 5 PM Central, and $150 remote or $225 onsite after hours, weekends and holidays, billed by the hour with a one-hour minimum. You get the inventory, the findings and the fix list, and you decide what happens next.
Ongoing managed IT keeps the safeguards in place as staff, computers and software change. It is quoted per user or per device after a short conversation, month-to-month, cancel anytime, and it includes updates, antivirus and email security, managed backup and disaster recovery, Microsoft 365 or Google Workspace administration, the network and printers, and unlimited remote support with onsite visits at no extra charge when remote cannot fix the problem. Remote support runs 24/7/365, including holidays, with after-hours rates.
Neither option moves your compliance obligations onto me, and I will say when you need someone else. Hospital systems and large multi-site groups need a larger provider. If an insurer, a partner or a regulator asks for a formal third-party audit, hire an auditor; I will support them with records. Legal questions, contract review and breach notification decisions belong with a healthcare attorney. For everything else on the IT side of a Dallas practice, see IT for medical practices, or call me.
Questions people ask
Can Cross River Tech make my practice officially HIPAA compliant?
No, and nobody can. There is no official HIPAA stamp a practice can earn, and paying for one does not change your obligations. I am an IT consultant, not a compliance attorney or auditor. I find the technical risks, put the approved safeguards in place and give you the evidence. Your practice keeps responsibility for its policies, training, risk decisions and legal review.
Does a security scan count as our HIPAA risk analysis?
Not on its own. A scan contributes findings, but the risk analysis has to cover everywhere patient data is created, received, stored and sent, plus the threats to it and how your staff actually work. I support it with a full inventory, technical checks, written findings and a fix list. Your compliance lead adds procedures, the physical walk-through and the risk decisions.
Will you sign a business associate agreement?
Yes. Any IT provider whose support can reach patient data should sign a BAA before that access begins, and I sign one with the medical practices I support. I also help you list the other vendors that need one, such as the EHR, the backup service, the email platform and any phone system that stores patient voicemail.
Can I hire you for a one-time HIPAA IT review without a contract?
Yes. A review is hourly with no agreement: $100 an hour remote and $150 onsite in business hours, $150 remote and $225 onsite after hours, weekends and holidays, one-hour minimum. You receive the inventory, the findings and a prioritized fix list. You can fix the items yourself, hire me by the hour or move to managed IT.
What should I send when I first contact you?
A short note with your practice type, location in Dallas–Fort Worth, how many people and computers you have, the EHR or practice management system you use and what prompted the question, such as an insurer form or a new location. Do not send any patient information. Call or text (214) 612-7080 or use the contact form.
Sources and further reading
Market price ranges in this article are my own observation of quotes in the Dallas market, not a published survey. Where I state a rule or a standard, the source is linked above.
