Questions practice owners actually ask.

Cost depends on the environment: how many workstations, servers, and locations you run, and how much of the work you want us to own. We quote after the assessment, in writing, with the scope attached to the number. If the scope changes later, we re-quote before the work, not after the invoice. There is no rate card worth giving you before we know what you actually run.

Yes, but the first step is an assessment, not a switch. We look at what the current provider built and why, and we keep the parts that are right. The handover is documented, including credentials, vendor accounts, and any gap that would bite during the transition. Nobody should have to guess where the previous provider left off.

Critical alerts route to a person, not a queue. The support window for routine requests is agreed in writing before onboarding, so you know what happens at 7pm on a Friday and who to call when the practice is closed. The point is that nobody at the front desk has to decide who to call while a patient waits.

Yes. An upgrade gets staged: the backup is confirmed restorable, patched test workstations come first, and there is a rollback path if the new version misbehaves. When the vendor needs to be involved, we coordinate the window and stay on the call. The week after an upgrade is when most problems surface, so it gets attention too.

By making the blast radius smaller and the recovery real: network segmentation, least-privilege accounts, multi-factor authentication, endpoint protection, email filtering, and backups the attacker cannot reach with the same credentials. Restores get tested, and there is a written incident plan. A backup nobody has opened is a hope, not a safeguard. No one can promise a practice will never be hit. The difference is what happens next.

There is no HIPAA certification. HHS does not certify vendors. We maintain HIPAA-aligned safeguards, sign Business Associate Agreements where required, document what is in place, and support your Security Rule obligations: risk analysis, access control, audit logging, contingency planning, and incident response. We will also tell you what we cannot yet evidence.

No. Equipment gets replaced when it fails, when it is out of support, or when it cannot run the software you need. A lifecycle plan lists the dates so replacements are budgeted instead of urgent. Budgeting beats emergency purchasing, and it keeps the operatories on supported software. If a machine is old but serviceable, we say so.

That plan is written before the day. Restore order, the workstation that becomes the temporary front desk, where the paper forms are, who calls the software vendor, who calls the imaging vendor. Rehearsing it is the difference between a bad morning and a week of rescheduled patients. If the plan is only in someone’s head, it is not a plan.

Some of it, yes. We inventory before we change anything, do the disruptive work outside patient hours or between blocks, and tell you what will be touched before we touch it. The first changes are the ones that remove the most risk. We do not promise zero disruption. We promise that nothing changes without you knowing what and when.

The term, the scope, and the exit terms are agreed in writing before you sign. A contract should describe how the relationship ends, not just how it starts. You should be able to leave with your documentation and the credentials you need to operate. If a provider will not put that in writing, ask why.