Your IT company keeps the lights on.
Nobody is minding the Admin console.
We are not here to replace your IT support. We would rather you kept them.
Most dermatology practices we talk to already have IT support — someone internal, or a local company on retainer. They are good at what they do. They set up workstations, keep the network running, handle the printer that stopped printing, and answer the phone when somebody cannot log in.
None of that is the same job as configuring Google Workspace to match the HIPAA policies you already paid somebody to write.
What your IT support does
Workstations, network, printers, phones, the EHR client, the user who forgot a password. The visible, urgent, interrupt-driven work that keeps a practice open on a Tuesday morning.
What usually nobody does
Reviews who still has access to patient information, and removes the people who should not. Checks whether two-step verification is actually enforced or merely available. Finds the Drive folders shared outside the practice. Reads the audit log — which the Security Rule asks for regularly, at 45 CFR 164.308(a)(1)(ii)(D) — and writes down what was found. Keeps the evidence that any of it happened.
This is not a failure of your IT team. It is a different job on a different clock. Their work is interrupt-driven and visible. This work is scheduled, invisible, and nobody complains when it does not happen — which is exactly why it does not happen.
What we refuse to do
We think this is the more useful half of the page.
We do not touch workstations. We do not support phones or tablets — we configure the policy that governs them, which is a different thing. We do not fix printers, build spreadsheet formulas, troubleshoot the EHR, or answer user questions. If a member of your staff cannot log in, that goes to your IT support, not to us.
We are not equipped to do the work they are good at, and we are not interested in taking it.
Where the line sits
This goes in the agreement as an explicit two-column list, not as an understanding.
Theirs
Anything a user touches. Workstations, printers, the network, the phone in somebody's pocket. Desktop support and SaaS add-ons. The EHR client. Password managers. Spreadsheet formulas. Setting up a device, fixing a broken one, replacing a lost one. And a few things set in the Admin console that still belong with them: a user who can’t sign in (we give your IT company Google’s Help Desk Admin role, so it can reset passwords), Google Voice, Google’s advanced mobile management, and the other software’s side of signing in to it with Google.
Ours
Everything on the Google Admin side. Accounts, groups, access and organizational units. Security settings and two-step verification. Email authentication — SPF, DKIM, DMARC, MTA-STS. Drive sharing controls. Retention. Device policy. Employee onboarding and offboarding in Workspace. The audit logs, and the evidence that comes out of all of it.
What that leaves your Security Official
HIPAA requires your practice to name a Security Official — 45 CFR 164.308(a)(2). That person stays yours, and so do the decisions. What they usually lack is somebody to make those decisions real in the tools the practice actually runs on, and to produce the evidence afterwards.
Compliance decisions stay with your Security Official. The configuration, the monitoring and the proof are ours.
See where you stand first
Twenty-seven questions, one for each safeguard in the HIPAA Security Rule. You score yourself, and every item names who would have to close it — us, your leadership, or your own team. Nothing here asks you to take our word for anything.
Take the HIPAA Checkup Check your email security