Most IT providers measure themselves by tickets closed. That sounds reasonable until you notice what it rewards. A provider paid to close tickets will close the same lockout every Tuesday for a year and never ask what is causing it.
The cost of that arrangement is not visible on an invoice. It shows up as clinical minutes: a provider waiting on a chart, a front desk that cannot check anyone in, an exam room running behind for the rest of the morning. Nobody counts those minutes, which is exactly why they keep being spent.
WheelHouse IT works the other way. We study patterns across our own service data to find what is generating the tickets, then remove the cause. A recurring lockout is usually an identity or access-policy problem rather than a user problem. A chart that is slow to open is usually a workstation or network problem rather than a software problem. Neither gets fixed by closing the ticket faster.
Every client is assigned a pod, which is the dedicated support team responsible for that account. The technicians in your pod stay with your practice rather than rotating in from a general queue, so they learn your systems, your schedule, and which failures actually stop care.
WheelHouse IT is privately owned and has been for 25 years, with 60+ IT professionals across the Fort Lauderdale, New York, and Orlando offices.
None of These Happen When the Schedule Is Empty.
Most healthcare IT pages use HIPAA as an adjective. It is worth being specific instead, because the requirements describe real work and your practice carries the obligation either way.
The HIPAA Security Rule, at 45 CFR Part 164 Subpart C, requires administrative, physical, and technical safeguards for electronic protected health information. In practice: a documented risk analysis, access controls that limit who can reach what, audit controls that record system activity, workforce training, and contingency planning for loss of access to systems.
HHS published a notice of proposed rulemaking that would convert several currently optional safeguards into requirements and attach specific timeframes to them. The table below lists the proposals that would land directly on IT.
| Proposed requirement | Frequency or timeframe |
|---|---|
| Technology asset inventory and a network map showing how ePHI moves | At least every 12 months, and on change |
| Encryption of ePHI at rest and in transit | Required, with limited exceptions |
| Multi-factor authentication | Required, with limited exceptions |
| Notification when a workforce member’s access changes or ends | Within 24 hours |
| Network segmentation | Required |
| Vulnerability scanning | At least every 6 months |
| Penetration testing | At least every 12 months |
| Restoration of systems after loss | Within 72 hours |
| Compliance audit | At least every 12 months |
This is a proposal, not a current obligation. It drew more than 4,000 public comments, and HHS has since moved it to the Long-Term Actions section of its regulatory agenda with anticipated final action listed as July 2027. Agenda dates are planning estimates rather than binding deadlines, so that date may move again.
The practical read. Nothing on that list is required of you today, and everything on it is a reasonable thing to have in place regardless. A practice that already runs multi-factor authentication, keeps an asset inventory, segments its network, and has tested a restore is not scrambling whenever the rule does land.
One thing to be clear about. The compliance obligation stays with the practice. It is not transferable to a vendor, and no IT provider can assume it. What WheelHouse IT supplies is the controls, the monitoring, and the documented evidence that both were running, which is what an auditor asks for.
See our security and compliance work.
Practices run a stack that general IT providers rarely touch, and each layer fails in its own way.
When a provider cannot log in, or a chart is slow to open, the cause often sits outside the application: identity, the workstation, or the network path between them. The software vendor’s support line cannot fix any of those three, which is why the call comes back to IT.
Large files, specialized viewers, and storage that grows without anyone planning for it. The failure shows up as capacity and retrieval speed, and it arrives gradually.
Patient-facing, which means a failure is visible outside the practice. What matters here is availability and the identity plumbing behind it.
Identity, email, file storage, and the collaboration layer everything above authenticates against or exchanges files with. When the layer underneath is misconfigured, the symptom usually appears in the clinical system, which is where people go looking first.
WheelHouse IT has completed 500+ migrations, including a clinical system migration for Wellington Internal Medicine Group finished inside a month against a hard vendor cutoff. See our Microsoft 365 management.
The same document in three places is not a filing preference. In a practice it is two problems at once.
The clinical problem is accuracy. Staff work from whichever copy they opened, and if that copy is stale, the decision made from it is stale too.
The compliance problem is inventory. Every duplicate is protected health information sitting somewhere nobody has accounted for, which is precisely what a risk analysis is supposed to identify.
Telling people to be more careful does not fix either one, because the cause is structural. There is no single authoritative location and permissions do not follow the role. What WheelHouse IT does about it:
One authoritative location for clinical and administrative documents, with older versions retained but visibly superseded rather than sitting in the same folder looking equally current.
Permissions that follow the role, so front desk, clinical, and billing staff reach what their work requires and not the rest.
Access that ends when employment does, closed out on departure rather than when somebody remembers. The proposed Security Rule update would put a 24-hour clock on this.
Retention that matches the record obligation, not the software default.
An auditor does not ask whether your controls are good. They ask you to show that the controls were running, on the dates in question. That is a documentation problem as much as a security one, and it is the part practices most often have to assemble from memory.
WheelHouse IT holds the HIPAA Seal of Compliance from Compliancy Group, and staff are verified as HIPAA compliant through an independent third party. CISSP-certified engineers are on staff, along with Microsoft security and compliance certifications.
Three things a practice should expect from any IT provider, and can ask for by name:
A provider handling electronic protected health information needs one in place. If a prospective provider hesitates on this, that is the answer to a different question.
Access reviews, patch records, backup and restore test results, and training completion, produced as artifacts rather than assembled the week before an audit. Our platform gives clients real-time visibility into ticket status, project progress, and environment health.
For practices that need governance rather than only paperwork, a virtual Chief Information Security Officer engagement provides it without a full-time executive hire.
Healthcare carries a difficult combination: the data has resale value, and the tolerance for downtime is close to zero because the schedule does not pause.
Rather than lead with a threat statistic, it is worth naming the three things these controls are built to stop. A mailbox quietly accessed and used to redirect a payment or harvest more credentials. A remote-access path with a weak or reused password, found by scanning. And ransomware moving laterally across a flat network, because nothing separated the clinical systems from the front desk machine that opened the attachment.
Endpoint activity monitored continuously rather than reviewed after the fact.
Clinical systems separated from guest wireless and administrative traffic, so one compromised machine is not a path to the EHR.
Access follows the role and ends when the role does.
The compromise usually starts weeks before anything visible happens, so the mailbox is where it gets caught.
Staffed by WheelHouse IT employees and never outsourced overseas.
A backup nobody has restored from is an assumption. The proposed Security Rule update would attach a 72-hour restoration expectation to this.
WheelHouse IT has completed a SOC 2 examination, audited against AICPA standards by an independent CPA firm. That means an outside auditor examined the security controls WheelHouse IT runs internally, not the ones described in a brochure.
On incident response, the process is isolate, restore, document. No provider can promise a recovery outcome, and any provider who does is describing a hope rather than a procedure.
See our managed cybersecurity services and 24/7 SOC and SIEM monitoring.
A practice does not run on a help desk schedule. Reach your pod by phone, Microsoft Teams chat, email, or the ticket portal, with a 24/7 internal Network Operations Center behind it.
52 sec.
Avg. call wait
29.6 min.
Avg. ticket time
60+
IT professionals
>95%
Satisfaction rating
Three WheelHouse IT healthcare clients have published their experience.
Primary and specialty care across multiple Florida locations, running on a clinical system that was being retired. The vendor gave two to three months of notice, the date did not move, and missing it meant losing every digital patient record. WheelHouse IT completed the migration inside a month.
“Not only were they able to beat out that deadline, but also get it done within the month.” Luis M., Strategic Project Manager
A growing podiatry practice running multiple locations across South Florida counties. WheelHouse IT put in the collaboration technology that lets staff reach each other between offices without dialing, and has grown with the practice as it expanded.
“I would highly recommend WheelHouse IT to anyone who’s considering a managed service provider for their IT systems, absolutely.” Certified Foot and Ankle Specialists
A healthcare business services company supported by WheelHouse IT.
“…They really know healthcare.” Skyler Fierro, CEO
Yes. Any IT provider with access to your electronic protected health information needs a Business Associate Agreement in place, and we execute one as part of onboarding. This matters because the agreement is what puts your provider’s obligations in writing rather than leaving them to assumption. WheelHouse IT also holds the HIPAA Seal of Compliance from Compliancy Group, and our staff are verified as HIPAA compliant through an independent third party.
You reach a live team member, and our reported average wait to do so is 52 seconds. A lockout during clinic hours is not a routine ticket, because the cost is a patient waiting rather than an employee inconvenienced. Beyond resolving the individual lockout, we look at whether it is recurring and why, since repeated lockouts are usually an identity or access-policy problem rather than a user problem. Our reported average ticket resolution time is 29.6 minutes. Both figures are reported averages from our own service data rather than service-level targets.
Yes. Insurer questionnaires and client security reviews ask for the same things: multi-factor authentication coverage, access control, backup and tested recovery, monitoring, and documented incident response. WheelHouse IT supplies the control documentation and the evidence that the controls were running, which is the part most practices cannot produce on their own. The compliance obligation stays with your practice, and what we provide is the controls, the monitoring, and the documentation behind them.
Not as a deadline, but they are worth acting on as a plan. The changes HHS proposed in January 2025 would make several currently optional safeguards mandatory, including encryption, multi-factor authentication, network segmentation, an asset inventory, vulnerability scanning every six months, and penetration testing every twelve. That proposal is not in force. HHS has moved it to the long-term section of its regulatory agenda with anticipated final action listed as July 2027, and agenda dates are estimates rather than deadlines. The practical answer is that everything on the list is reasonable to have in place anyway, so a practice that does the work now is simply not scrambling later.
Yes. That arrangement is co-managed IT services, and it runs as one of two programs. Comprehensive means every user reaches WheelHouse IT directly. Foundational means your internal team stays the face of IT while WheelHouse IT owns infrastructure and security behind them. Foundational is a full engagement in its own right, not a reduced tier. For a practice whose one internal IT person is absorbed by day-to-day requests, it is the arrangement that puts that person back on clinical systems.
Recovery runs from tested backups, and the process is isolate, restore, document. The reason to ask any provider this question is that most backup systems are never restored from until the day they are needed, which is the worst possible moment to discover a problem with one. WheelHouse IT tests restores rather than assuming them. No provider, including this one, should promise you a recovery outcome; what we commit to is the procedure. The proposed Security Rule update would attach a 72-hour restoration expectation to this work.
Pricing is a fixed monthly fee, and new client agreements run month to month with no multi-year commitment. Fixed fee matters in a practice because IT that bills by the incident is unbudgetable, and the incidents cluster at the worst times. Pricing follows a discovery conversation and is presented in a proposal, because a number quoted before anyone has looked at your environment is a guess.
More questions are answered on our FAQ page.
WheelHouse IT supports practices from offices in Fort Lauderdale, New York, and Orlando, and works with clients in 18+ states and Puerto Rico.
15 minutes is all it takes to see if our approach aligns with your needs.
Call, chat, email, or fill out the form to be connected with a technical advisor.
