A general IT managed service provider serves a portfolio of clients that might include a manufacturing company, a law firm, a retail chain, and a home health agency. The team that manages the home health agency's technology applies the same framework it applies to every other client — because that framework works well for most of the portfolio. The framework was not designed for HIPAA. It was not designed for the clinical operational context that shapes what security responses are appropriate in a healthcare setting. It was not designed for the regulatory environment that transforms a standard IT incident into a potential breach notification obligation.
The gaps this creates are not visible on a network scan or a software audit. They show up when an incident occurs and the IT provider's response inadvertently destroys forensic evidence. They show up when an OCR audit letter arrives and the compliance documentation the agency paid for turns out to not satisfy HIPAA's specific requirements. They show up when a hospital discharge planner asks whether the agency has behavioral EDR — and the IT provider does not know what behavioral EDR means in the HIPAA context.
Five Specific Ways the Expertise Gap Manifests
Gap 1: The Risk Analysis That Is Really an IT Audit
A general IT provider asked to produce a "HIPAA risk analysis" typically produces an IT asset inventory and a vulnerability assessment — both of which are valuable and both of which fall short of the HIPAA Security Rule risk analysis requirement. The HIPAA risk analysis must assess the likelihood and potential impact of specific threats exploiting specific vulnerabilities against the covered entity's specific ePHI population. An IT asset inventory identifies assets. A vulnerability scan identifies technical weaknesses. Neither constitutes an analysis of risk to ePHI as defined by the HIPAA Security Rule and interpreted by OCR enforcement actions.
The consequence: a home health agency that paid its general IT provider for a "risk analysis" and received a network audit has a document it believes satisfies the HIPAA requirement but that an OCR investigator will find inadequate. The agency does not know about this gap until OCR tells them.
Gap 2: Incident Response Without HIPAA Breach Assessment
When a general IT provider responds to a security incident at a home health agency, they apply IT incident response procedures: contain the threat, restore systems, close the ticket. The HIPAA four-factor breach risk assessment — the analysis that determines whether the incident constitutes a reportable breach — is not part of the standard IT incident response framework. A general IT provider may resolve a ransomware incident completely and competently from a technical perspective while leaving the home health agency with an unidentified breach notification obligation that begins accruing penalty exposure from the date of discovery.
Gap 3: Compliance Documentation That Does Not Match OCR Requirements
General IT providers that offer "HIPAA compliance documentation" as a service product typically produce policies based on generic healthcare templates that address the areas of HIPAA Security Rule most familiar to the IT industry — technical safeguards — while providing less coverage of administrative safeguards (risk analysis, training, sanctions policy, workforce management) that OCR enforcement data shows are the most commonly cited deficiencies. The documentation package looks complete. The OCR investigator finds the gaps.