A general IT managed service provider serves a portfolio of clients that might include a manufacturing company, a law firm, a retail chain, and a home health agency. The team that manages the home health agency's technology applies the same framework it applies to every other client — because that framework works well for most of the portfolio. The framework was not designed for HIPAA. It was not designed for the clinical operational context that shapes what security responses are appropriate in a healthcare setting. It was not designed for the regulatory environment that transforms a standard IT incident into a potential breach notification obligation.
The gaps this creates are not visible on a network scan or a software audit. They show up when an incident occurs and the IT provider's response inadvertently destroys forensic evidence. They show up when an OCR audit letter arrives and the compliance documentation the agency paid for turns out to not satisfy HIPAA's specific requirements. They show up when a hospital discharge planner asks whether the agency has behavioral EDR — and the IT provider does not know what behavioral EDR means in the HIPAA context.
Five Specific Ways the Expertise Gap Manifests
Gap 1: The Risk Analysis That Is Really an IT Audit
A general IT provider asked to produce a "HIPAA risk analysis" typically produces an IT asset inventory and a vulnerability assessment — both of which are valuable and both of which fall short of the HIPAA Security Rule risk analysis requirement. The HIPAA risk analysis must assess the likelihood and potential impact of specific threats exploiting specific vulnerabilities against the covered entity's specific ePHI population. An IT asset inventory identifies assets. A vulnerability scan identifies technical weaknesses. Neither constitutes an analysis of risk to ePHI as defined by the HIPAA Security Rule and interpreted by OCR enforcement actions.
The consequence: a home health agency that paid its general IT provider for a "risk analysis" and received a network audit has a document it believes satisfies the HIPAA requirement but that an OCR investigator will find inadequate. The agency does not know about this gap until OCR tells them.
Gap 2: Incident Response Without HIPAA Breach Assessment
When a general IT provider responds to a security incident at a home health agency, they apply IT incident response procedures: contain the threat, restore systems, close the ticket. The HIPAA four-factor breach risk assessment — the analysis that determines whether the incident constitutes a reportable breach — is not part of the standard IT incident response framework. A general IT provider may resolve a ransomware incident completely and competently from a technical perspective while leaving the home health agency with an unidentified breach notification obligation that begins accruing penalty exposure from the date of discovery.
Gap 3: Compliance Documentation That Does Not Match OCR Requirements
General IT providers that offer "HIPAA compliance documentation" as a service product typically produce policies based on generic healthcare templates that address the areas of HIPAA Security Rule most familiar to the IT industry — technical safeguards — while providing less coverage of administrative safeguards (risk analysis, training, sanctions policy, workforce management) that OCR enforcement data shows are the most commonly cited deficiencies. The documentation package looks complete. The OCR investigator finds the gaps.
Gap 4: EDR That Is Not Behavioral EDR
The 2026 HIPAA mandatory requirement is specifically behavioral endpoint detection and response. A general IT provider deploying Microsoft Defender Antivirus and calling it EDR has not satisfied this requirement. The provider may not know the difference between standard antivirus and behavioral EDR — because for most of their non-healthcare clients, the distinction does not create a compliance obligation. For the home health agency, it does.
Gap 5: SHIN-NY Is Unknown Territory
Any general IT provider serving a New York home health agency should know what SHIN-NY is, what a CSPP requires, and how to document MFA enforcement in CSPP terms. In my experience, most do not. The SHIN-NY compliance programme is niche healthcare knowledge that general IT providers have no business reason to develop. For their New York home health clients, this means SHIN-NY compliance is either unmanaged or managed through a fragmented process that never quite assembles into an approvable CSPP.
For a broader look at what separates a healthcare-specialized security provider from a general one, see The ShieldForce Advantage
Frequently Asked Questions
What's the difference between a HIPAA risk analysis and an IT audit?
An IT audit inventories assets and scans for technical vulnerabilities. A HIPAA Security Rule risk analysis specifically assesses the likelihood and potential impact of threats exploiting vulnerabilities against your organization's actual ePHI — a narrower, compliance-specific analysis that a standard IT audit does not satisfy, even when it's labeled as one.
What is behavioral EDR, and how is it different from antivirus?
Standard antivirus detects known malware signatures. Behavioral EDR (Endpoint Detection and Response) monitors what a process actually does — flagging ransomware-like encryption activity or unusual data access in real time, including threats with no known signature. The 2026 HIPAA Security Rule's mandatory EDR requirement specifically means behavioral EDR, not standard antivirus relabeled as EDR.
Does a general IT provider's incident response cover HIPAA breach notification requirements?
Not automatically. Standard IT incident response focuses on containing and resolving the technical incident. HIPAA additionally requires a four-factor breach risk assessment to determine whether the incident is a reportable breach — a distinct analysis that a general IT provider's standard playbook does not include.
→ Schedule Your Free HIPAA Risk Assessment — shieldforce.io/hipaa-assessment
→ Explore Home Healthcare Cybersecurity — https://shieldforce.io/home-healthcare
→ View Transparent Pricing from $35/user/month — https://shieldforce.io/home-healthcare/checkout