Nelson Gomes

The role and importance of technology for enhancing patient care and engagement were increasing rapidly before the coronavirus pandemic. The public health emergency has only further fueled this substantial growth. There are a number of solutions that have essentially become more than just "nice-to-haves" for practices working to meet the evolving needs of their patients and staff, remain competitive, and ultimately put themselves on paths to success.

Here are eight of such technologies and their importance for practices in today's care delivery system.

Telehealth has emerged as a delivery method largely embraced by patients, physicians, payers, and the federal government because it is an efficient and effective means of providing care that does not require an in-person visit. Now that so many more patients have experienced telehealth and gained first-hand appreciation for its benefits, the demand is expected to remain high well past the end of the pandemic. For practices with an existing telehealth program or those thinking about launching a program, careful attention must be paid to the technology used to support the program. Ensure any platforms and vendors are compliant with HIPAA under existing regulatory waivers and after those waivers expire.

Nine ways to improve your patient communications

A subset of telehealth, remote patient monitoring (RPM) has also experienced a significant uptick in usage over the past year and there is no indication that this growth will being slowing down. RPM engages patients in their care by allowing patients to use a wide variety of devices to gather, enter, or automatically collect health data and transmit it to their physicians. Common examples of devices include blood pressure monitors, weight scales, blood glucose monitors, and spirometers, but there are also fitness trackers, smartwatches, sleep monitors, thermometers, skin patches, and many more. RPM permits physicians to track patient conditions in between visits and identify when a patient's biological data experiences a change that requires additional attention and possibly care. The rules governing RPM have undergone substantial changes over the past few years, including how services can be delivered, so practices with RPM programs will want to keep up with rule changes to maintain compliance.

3. Communication and collaboration platform

To accommodate the increase in remote work and virtual collaboration, practices are turning to communication and collaboration platforms, such as Microsoft Teams and Slack. They typically include a wide range of features, such as chat and video meeting capabilities; personal and team file storage and sharing; real-time file collaboration; and integration with numerous apps and services to further support productivity and teamwork. With the ability to access these platforms across essentially all devices, they serve as a mechanism for practices to deliver services to patients and support efforts for staff to better communicate and work together. While such platforms will not permanently replace in-person meetings, virtual gatherings and collaboration are undoubtedly here to stay.

Cloud computing is essentially the delivery of on-demand computing services provided over the Internet. In other words, these are services that do not require a person to be physically near computer hardware. This covers a wide range of services delivered via technologies that practices are already using or may add in the future. Among them: electronic medical records, telehealth/RPM, communication and collaboration platforms, and patient portals. There are numerous benefits associated with migrating to the cloud and doing so has become simpler and more cost-efficient in recent years. Cloud benefits for patient care include improved collaboration between providers and better engagement of patients in their care via sharing of health data and information.

Practices are turning to a variety of self-service kiosks for a multitude of patient care and engagement-related activities. Patient check-in kiosks allow patients or their caregivers to check in and complete required documentation while informing staff that patients have arrived for appointments. Thermal kiosks check the temperature of staff, patients, and visitors while non-thermal kiosks ask staff, patients, and visitors a series of health screening questions. Some kiosks include video capability that allows staff to visually interact with kiosk users. Others include a credit card slot so patients can make payments. Expect to see the usage of kiosks—by patients, staff, and visitors, including vendors—to become more commonplace in practices and many other areas of healthcare.

Better communications tend to translate to healthier patients and stronger finances. That's why practices are increasingly switching from hardwired phone landlines to voice over Internet protocol (VoIP) services. In simple terms, VoIP is a way to place and receive phone calls via the Internet, but it is doing so much more for practices. With VoIP, practices are gaining access to communications solutions that deliver tangible patient care improvements, including improved satisfaction and decreased cancellations. Among VoIP's features, depending upon the solution and services selected: routing of calls to smartphones; more efficient management of patient calls; custom, scheduled messages and greetings; voicemails translated to text; and videoconferencing. VoIP does all of this while improving security and privacy of a practice's communications.

Five Strategies to Help Empower Your Patients

This is a fairly simple technology delivering tremendous value to practices and their patients. SMS—the most common text messaging service component of mobile device, telephone, and Internet systems—has become a preferred method of communication for most of the patient population. Phone calls and voicemails are increasingly ignored due to the proliferation of spam; calling takes up significant staff time and resources. Similarly, emailing has become less dependable due to spam and the number of emails most people receive every day. SMS is an efficient way to communicate with patients and can be leveraged in many ways—even more when two-way text messaging, which permits patients to reply to texts, is leveraged. Practices are using SMS to communicate with patients about the status of appointments, safety protocols, pre-screening requirements, scheduling appointments as part of recall programs, satisfaction surveys, and online reviews, compliance with medication and care protocols, and emergency updates (e.g., COVID-19, weather), just to name a few. With 

 owning a cell phone with texting capabilities, SMS is an effective communication option for most patients.

While many of the technologies identified above encourage greater patient engagement in and control over their care, there is a growing group of solutions focused on accomplishing this increasingly important component of a patient's care journey. For example, patient portals provide patients with easy access to their health information and can include a host of other features, such as the ability to request referrals and prescription refills, view test results, make payments, and read educational materials. Scheduling software gives patients more control over when patients meet with a provider and potentially how that interaction occurs (i.e., in-person visit or telehealth). Recall solutions inform patients about recommended follow-up appointments and routine services, such as annual wellness visits, colonoscopies, and mammograms. Solutions like text messaging and chat give patients more control over how they communicate with caregivers. These and the many other types of patient engagement solutions are not only helping empower patients to improve their health and wellness, but they are also helping practices adapt to value-based payment models.

Enhancing Patient Care and Engagement with Technology

Healthcare is undergoing a transformation. Advancements in healthcare technology are helping practices address the changing and often growing care needs of their patients while helping make patients become more active participants in their care. By developing a strategy for adding and integrating new technology, you will put yourself in a position to make smart, educated investments in the solutions that will help ensure your patients receive the personalized care they need, and your practice hits its revenue targets and maintains its long-term viability.

Nelson Gomes is an information technology veteran with 30-plus years of IT experience. He is the senior vice president of business development and general manager of New Jersey for 

, a healthcare-focused managed services provider.

Articles

Solutions that have become more than just “nice-to-have” since the beginning of the 2020 pandemic.

Eight technologies practices are leveraging to deliver better patient care 

As we approach the end of 2016, it is important to prepare for technology challenges your practice may face and opportunities you may want to capitalize on in the new year.

Here are eight developments in healthcare technology to know about for 2017:

While we do not know how the new presidency will affect federal healthcare regulations, one can safely assume that security and compliance will remain an area of focus. This past March, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) launched its second phase of HIPAA audits of covered entities and their business associates. In October, OCR released new guidance on HIPAA and cloud computing. These and other recent developments indicate security and compliance are under close scrutiny. Practices should take compliance seriously.

They should also take the threat of cybercrime seriously. Cybercriminals are increasingly targeting healthcare providers because of the black market value of medical records and use of outdated security measures. Symantec's "

" noted that the largest number of data breaches in 2015 took place within health services, comprising 39 percent of all breaches last year. Ransomware - when cybercriminals use encryption to hold companies’ and individuals’ data hostage - increased 35 percent percent in 2015. There is no reason to believe cybercriminals will stop targeting providers.

Informatics has been a buzzword for quite some time. What are its benefits informatics? While it's a few years old, the University of Illinois at Chicago spells this out in a detailed 

. Key takeaways include dramatic reductions in malpractice claims after introducing EHRs, faster lab results when using EHRs, potential for significant cost savings, and improved quality of care.

Along with informatics, analytics remains in the spotlight thanks to its potential to deliver significant improvements in all aspects of a practice's operations by converting big data into actionable insights. Practices can expect to see more informatics and analytics solutions hit the market in 2017. It will be important to conduct due diligence before investing in an informatics and/or analytics solution.

Mobile health (mHealth) is showing no signs of slowing down. A 

Pricewater Cooper Health Research Institute (PwC) survey

 revealed some insightful statistics about the use of mobile devices, including the following:

• Sixteen percent of consumers used at least one medical, healthcare or fitness app in 2013. That number doubled to 32 percent in 2015.

• 60 percent of consumers are willing to have a video visit with a physician through a mobile device (more on this later)

• 81 percent of clinicians say mobile access to medical information helps coordinate patient care

• 38 percent of clinicians use email to stay connected with their chronic disease patients.

It will not be surprising if all of these figures increase in 2016. Practices will want to examine how they can use mHealth to boost patient engagement and satisfaction to improve care delivery and help achieve a competitive edge over slower adopting providers.

How do you grow patient volume without increasing foot traffic to your practice? Telemedicine. It's already on the radar of many providers, with the PwC survey indicating that 58 percent of clinicians would rather provide a portion of care virtually. Insurance companies are getting on board with covering telemedicine, and an increasing number of states have laws concerning its coverage. As previously stated, a growing number of consumers are willing to consider video visits with a physicians. It's up to practices to meet these consumers in the middle.

Already, there are technologies used by patients that capture vital signs, blood pressure, heart rate and more that then transmit the data to healthcare facilities. Practices can expect the number and types of these devices to grow in 2017, and patients to become more accepting of them, especially as an alternative to physically visiting a practice.

For the past few years, there has been an effort on behalf of government agencies to move toward increased interoperability of health IT systems.

 (Cures) shows the government's intention to make interoperability a high priority in the coming years. As the U.S. House of Representatives Committee on Energy and Commerce 

, "The development of new drugs and devices is meaningless unless they are delivered to the right patients at the right time. Cures will help improve delivery by: ensuring electronic health record systems are interoperable for seamless patient care and help fully realize the benefits of a learning health care system."

A contributor to Apple's success is the tendency for users of Apple products to own multiple Apple products. One reason for this brand loyalty is that Apple products are integrated systems.

It is for this reason that practices can expect a greater push for integrated systems in the market in areas such as access control, video surveillance and audio/visual equipment. When these devices are integrated, implementation, management, upgrades, data retrieval and training is easier.

With a growing emphasis in healthcare on streamlining operations, technology companies are working to meet this objective and secure more of an organization's business at the same time.

No discussion about technology trends of the past several years and likely the next several years would be complete without at least mentioning the cloud. As practices and other healthcare providers implement a greater number of robust systems, the need for convenient, secure data access and retrieval will grow.

Practices should expect technology vendors to encourage greater use of cloud computing. It is important to remember that if a practice shifts any of its data storage to the cloud, use of the service must comply with HIPAA.

Practices need to focus their tech brain trust on potential developments in security compliance, mobile and more, in the coming year. 

8 Health Tech Challenges and Opportunities in 2017

" and noted that healthcare data breaches were most likely to be caused by human error. In its analysis of 2015 breaches, Verizon identified the following as significant contributors:

• Lost and stolen assets, such as laptops and smartphones;

• Sending sensitive information to the wrong person;

• Use of weak, default or stolen passwords; and

• Opening malicious attachments or nefarious links in an email.

In a press release, the executive director of global security services for Verizon Enterprise Solutions, said, "You might say our findings boil down to one common theme - the human element."

While your staff members are likely your practice's top source of vulnerability when it comes to your falling victim to a cyberattack or data breach, they also represent your first line of defense. That's why it's critical to make data security a priority for your practice, if it's not already. To do so requires development of an IT security training program that keeps data security high on your staff's list of responsibilities.

Here are eight steps to take to develop and support an effective IT security training program.

This vital step in planning your training will specify what you want your staff to learn and reduce the likelihood of omitting critical information to cover during training. Outline the specific aspects of IT security your staff needs to learn to be smart, compliant users of technology. These goals will serve as a framework to create your training and help identify different mediums you will use to deliver training.

To develop an effective training program will require substantial work up front. Executing and maintaining the program will require ongoing work. Leadership must be educated on the importance of IT security training and support efforts in this area. Poor support could lead to a lack or reallocation of resources, which is likely to contribute to an incomplete program that leaves a practice more vulnerable to security threats.

You likely have some components of IT security already in place at your practice, such as assigning passwords to access computers and the use of anti-virus software. Perform a risk assessment to identify where security gaps exist, which should include analysis of any IT training you provide and opportunities for improvement.

4. Understand staff roles and their vulnerabilities. 

Depending upon how your staff members' IT privileges and roles are established, they likely can access some programs used by your practice, and may have restrictions on their ability to access other programs. It is important to understand which of your staff members can access your programs, define their roles in using these programs and then identify associated vulnerabilities. For example, if a staff member with access to the EHR has his account breached, it could lead to theft of protected health information. Your training program should include guidance specifically related to staff roles and vulnerabilities.

5. Deliver education on security policies and procedures.

 It's not enough to just have security policies and procedures. Staff members need to receive education on your policies and procedures when they start working at your practice. They should also receive re-education as part of annual training and whenever policies or procedures undergo changes. Also consider including IT discussions during all staff meetings. This will help keep security at the front of staff members' minds.

Within your training, it's important to teach staff what to do and not to do. Hit home the importance of following these rules by including discussion of the ramifications of their failure to follow instructions, such as the penalties associated with HIPAA violations.

It's great to have IT "superusers" at your practice - staff members with the most knowledge about your programs and technology, and people that other staff can approach with questions. But one potential downside of superusers is a practice that relies heavily on these individual(s) is often left scrambling to replace knowledge lost when superusers leave a practice. Help overcome this obstacle by making cross-training part of your training program. Cross-training can help develop more superusers, or at least more knowledgeable technology users. This will reduce the likelihood of IT-related errors and make a practice less vulnerable if employment of a superuser ends.

Cybercriminals work around the clock to find new ways to breach IT systems and steal data. Practices must stay abreast of new threats and the processes that keep technology and data safe and secure. As you come across news and resources on IT security, share the information with your staff (via email, newsletter, bulletin board, etc.), and then discuss the most significant developments during staff meetings.

The more informed you are about cybersecurity, the better prepared your practice will be to protect itself from threats and respond effectively and appropriately to cyberattacks.

Nelson Gomes is the president and CEO of PriorityOne Group, a New Jersey-based healthcare IT consulting firm. Gomes has more than 25 years experience in IT, including 20 specifically in health IT, providing services to medical practices, ambulatory surgery centers, and clinics.

Avoid having problems with data protection. Here are eight steps to take to develop and support an effective IT security training program. 

8 Steps to Developing a Health IT Security Training Program

The year is almost over, so it's time to start planning for 2015 (if you haven't already). This should include planning your practice's budget, including important factors such as payroll, equipment, and any capital projects coming up, but it must also include IT expenses.

To get a general idea of what you can expect to spend on IT in 2015, analyze your expenses for 2014. Understand that this is just an estimate, and likely a rough one at that. As with the other areas of your budget, IT expenses are rarely consistent each year, and may even be significantly different from one year to the next depending upon whether your practice undergoes any substantial changes.

Here are eight areas of focus when putting together your IT budget.


2014 was a year of significant HIPAA developments. There were several high-profile data breaches, both in healthcare settings and businesses in other sectors (e.g., Home Depot, Sony). An individual healthcare record is now worth more on the black market than a U.S.-based credit card and personal identity with social security number combined, according to 

, making healthcare data even more appealing to hackers. In April, Microsoft ceased providing automatic fixes, updates or online technical assistance for Windows XP and Office 2003, leaving them both vulnerable to security issues. It's now been more than a year since the HIPAA Omnibus Final Rule went into effect.

Regulators are more aggressively pursuing audits. It is critical for providers to conduct at least annual HIPAA and HITECH security risk analysis and remediation to help ensure protected health information (PHI) is secure. Practices should budget for this accordingly.


As with Windows XP and Office 2003 in 2014, Microsoft is ending support of Windows Server 2003 on July 14, 2015. As of that date, Windows 2003 will be considered vulnerable to security issues, and a practice using it for anything involving PHI will be technically out of compliance with HIPAA.

Practices need to identify whether they have machines using this operating system, and then determine which machines have hardware capable of running a newer operating system and which do not. For those that can, practices should budget for a license upgrade plus the fee to configure the computer for its use. For any machines that cannot, they will have to either be replaced or have their technology inside upgraded.

3. Disaster recovery and business continuity


Practices rely heavily on technology to power their operations. So when an IT disaster occurs, which can be at any time, it can very easily have a substantial, negative impact on finances and operations. Your practice will likely experience at least a small IT disaster every few years, but nearly 

one in five businesses suffers a major disruption to its data or voice networks or communications systems every year

It is critical that practices have a comprehensive, HIPAA-compliant IT disaster recovery and business continuity plan. Such a plan should detail not only the steps a practice will take to recover from any type of IT disaster, but also how to maintain business continuity during and after a disaster to help limit the short- and long-term effects.

If you do not already have such a plan in place, it is important to invest in its development - and complete development as soon as possible. If your practice has a plan, it should be tested in 2015, so budget for this accordingly. If there are changes made to IT systems next year that will affect the plan, it will need to be updated and should be retested in order to help ensure a seamless business continuity strategy in the case of catastrophic event.


If you have plans to grow your practice next year, you'll want to take into consideration the IT costs associated with the changes. Moving into a larger building or adding locations? Expect a significant investment in IT. Even just adding physicians or new staff can incur IT-related expenses that quickly add up, as you will need to take into consideration new computers and workstations, software licenses, and telecommunications (voice and data services).


If 2015 will be the year when you take the plunge and add an EHR or another significant electronic system to your operation, it's important to determine not only how much the system itself will cost but also associated costs, including installation, hardware needed to run the system, licenses for users, and training. Always give your IT point person plenty of notice if you intend to invest in a new system to allow ample time for research and planning.


Some of the software your practice may use, including an EHR and practice management software, have maintenance costs associated with them. Maintenance for these mission-critical solutions typically run between 17 percent and 23 percent of the original licensing cost for the software; not pocket change if a system costs $100,000.

Ask these system vendors if any significant upgrades are planned for 2015. If so, you need to determine whether your existing hardware can support such upgrades.


It's likely that at least one of your IT-related contracts will be up for renewal in 2015. Such contracts can include IT managed services agreement, telecommunications, and phone system. Use the end of this year as an opportunity to review all of your contracts and note those up for renewal next year. Try to determine well in advance whether you need to make a change to the contract (such as number of computers and users accessing a service) or intend to change service providers, and how such a change will affect the rate you pay for these services. It's a good time to research options to see if there are worthwhile alternatives available, and whether you can leverage other options as part of contract negotiations.


As with contracts, it's likely that some of the warranties on your practice's major IT equipment, such as servers, switches, and firewalls, will expire in 2015. You should determine whether this will be the case for your practice, both for initial and renewed warranties, and determine whether it's worthwhile to renew the warranty, if you have the option. Take into consideration the age of the equipment, and whether you're better off simply replacing the equipment.

It's time to start budget planning for 2015 and that should include IT expenses. Here are eight areas of focus for your medical practice.

Your 2015 Medical Practice IT Budget: 8 Areas of Focus

Under the HIPAA Omnibus Final Rule published last January, the deadline for compliance with the new HIPAA rules was essentially Sept. 23, 2013. However, there was an exception built in to the rule for physician practices and other covered entities (CEs). This exception stated that for CEs with vendor business associate agreements (BAAs) entered on or before Jan. 25, 2013, these BAAs must be brought into compliance with the Omnibus Rule by Sept. 23, 2014.

Failure to ensure your BAAs are HIPAA compliant can lead to penalties that can devastate a medical practice financially and ruin its reputation if protected health information (PHI) is stolen.

If you have missed the Sept. 23 deadline, by the letter of the law you are out of compliance. The chance of your being audited on that is slim, and there's probably no need to panic. With that said, do not drag your feet. Pull your program together as soon as possible. By all accounts, the Office for Civil Rights is going to be increasing enforcement audits come Jan. 1, 2015, and you should be prepared.

Here are three steps practices should take to comply with the requirements of this final Omnibus Rule deadline.

A helpful tip on how to identify your practice's business associates: Pull up accounts payable to access your list of vendors. With this list in front of you, identify vendors that have access to your PHI. These vendors may include IT companies, transcription companies, coding and billing companies, consultants, collection agencies, and shredding companies.

 Under the Omnibus Rule, the definition of business associated was reworded. A business associate now includes any vendor that creates, receives, maintains, or transmits PHI on behalf of a CE - even those that do not access PHI. Business associates can now include organizations involved in patient safety activities, health information organizations, and PHI data storage companies.

Once you have identified which vendors qualify as business associates, you should review the latest BAA they signed with your practice. If the most current BAA you have on file with a vendor is signed on or before Jan. 25, 2013, you should immediately amend or replace this BAA and have a vendor sign a new BAA that complies with Omnibus Rule requirements.

If your practice delegates duties to a vendor, a practice has a responsibility to confirm - to the best of its ability - the business is handling those duties in conformity with HIPAA rules. This can be accomplished through an auditing process in which your practice asks business associate representatives a number of questions and then assesses the answers. These questions include the following:

• Do you have updated policies, procedures, and manuals that your organization follows to show compliance with HIPAA?

• Have you trained all of your employees on the privacy and security procedures covered by HIPAA and documented the training?

• Do you have a mechanism in place to train new employees and document the training?

• Have you recently (certainly within the last year) completed a security risk assessment and documented this assessment?

• Do you have mechanisms in place to ensure you remain compliant with HIPAA?

• Do you have mechanisms in place to ensure any subcontractors that will have access to PHI agree to the same restrictions, conditions and requirements that apply to the business associate with respect to such information?

Business associates held to high standards

With the passing of the Omnibus Rule, business associates can now be held directly liable for HIPAA breaches and violations. As a result, business associates are now required to establish and maintain a similarly comprehensive HIPAA program as CEs.

When your practice is auditing its business associates, this is the type of program you're looking for. If the audit reveals anything concerning regarding a business associate's ability to comply with HIPAA rules, request the business associate address the concern immediately or consider replacing this vendor.

While business associates can now be held directly liable for their improper use or disclosure of PHI, if a business associate is found to be negligent (or worse) in the handling of PHI, a CE can still be found liable. A well-drafted BAA can go a long way in protecting a CE from any improper actions by its vendors.

esource for outsourced accreditation and healthcare compliance solutions. E-mail him

Your practice's business associates can lead to HIPAA issues. Here are three tips to ensure your vendors can ensure the safety of protected health information.

Updating HIPAA Business Associate Agreements: 3 Steps

Physician practices are used to undergoing audits. They undergo meaningful use audits and payer claims review audits, and may even face tax and RAC audits. But one type of audit that is not often discussed but is absolutely critical for practices to undergo is an information technology (IT) audit.

In short, an IT audit is a comprehensive review and examination of IT in use within a practice. It has many purposes that are critical to the short- and long-term financial, legal, and operational success of a practice.

Here are 10 things you should know about IT audits and why your practice should consider scheduling one today.

1. IT audits detect security and compliance gaps. 

The primary reason practices should undergo an IT audit is to mitigate risk. An IT audit will identify gaps in security that may allow a data breach of unsecured protected health information, which is a HIPAA violation. The audit will provide a practice with an understanding of areas of security and compliance that require remediation.

 Some IT auditors will provide an analysis of a practice's workflow to determine whether there are opportunities for changes that will bring about improvement in productivity. These changes might be as simple as moving a scanner to a location that is more easily accessible to staff members to leveraging new types of technology that can improve employee productivity, such as providing employees with dual monitors.

Practices should always know exactly what technology is used in their facility. An IT audit will provide a practice with such a comprehensive list. Using this inventory assessment, a practice will know, for example, whether it needs to purchase new technology when new employees join or when technology needs to be upgraded or replaced, such as systems using Windows XP as an operating system (now that 

4. IT audits should be conducted by a qualified third party. 

This is true regardless of whether or not a practice has a current IT provider in place. By bringing in a third party, you're more likely to receive a truly objective report. In addition, if you work with an IT provider that lacks extensive healthcare experience, the provider may not be aware of the nuances of HIPAA laws, for example. An outside company with healthcare experience can help identify areas in need of improvement specific to healthcare IT.

5. IT audits should be conducted on a regular basis. 

For smaller practices, it is best to undergo an IT audit every year; larger entities should consider undergoing one every six months because of the increased likelihood of compliance issues developing as a result of their more complex operations. By conducting regular IT audits, you will reduce the likelihood of gaps developing while helping ensure you have the most efficient workflow possible.

6. IT audits are usually conducted one of two ways. 

 If you do not want anything installed on your computers, an IT auditor can run a network and hardware analysis using a bevy of different auditing and assessment software tools. These tools do not actually sit on the systems. Rather, they run from an engineer's laptop that is connected to the local network being assessed. The programs will scan everything on your entire network and then generate the report, which should include analysis of everything noted earlier: gaps, work flow, inventory assets, etc.

Another way to undergo an IT audit is to allow for what are called "assessment agents" to be installed on your computers. The assessment agents will run for about a few days and will collect multitudes of detailed information on the hardware, software, patches and much more. This not only provides a 50,000-foot overview, but allows an IT auditor to drill down and learn about every single facet of your entire network. The auditor can look at everything from software licensing issues all the way down to whether the manner in which a printer is setup is slowing down your network. Using assessment agents will yield a much richer report with much more accurate and detailed data than using the webpage-based software.

7. IT auditors should sign a business associate agreement. 

Before you begin the audit process, it is required that you have the IT firm sign a 

. It's important to note that the IT company performing the audit must follow HIPAA security and compliance policies and procedures required by a business associate. Once on your network, the IT firm has essentially full carte blanche access to your information. 

Without usernames and passwords to access your EHR, an IT auditor cannot view patient data or access a secured database unless you have patient medical records stored unsecured.

The audit is critical for company valuation and for the controlling party to learn what technology they're acquiring. Without an audit, it will be significantly more difficult to merge the IT of the organizations and develop an effective workflow between them.

9. IT auditors should provide you with the report. 

A trustworthy IT auditor will provide you with all of the information gathered during the audit and not hold the information hostage until you sign a contract to have the issues identified during the audit addressed. Make sure this clause is included in the contract you sign with an IT auditor.

10. IT auditors should review and test backup and disaster recovery.

 A critical IT function of any physician practice is its 

. It's imperative that any IT audit include a detailed review of the backup policies and procedures. The principal areas that require review are as follows:

• Backup logs
• Retention policies
• Data restores
• Mock disaster testing
• Disaster recovery plan
• Documentation

Medical practices are no strangers to audits. But health IT audits are critical to the financial, legal, and operational success of your office.