Skip to main content

Updated 4 min read

In-House IT vs. Managed IT Services: What Healthcare Practices Need to Know

The short answer

For most Orange County medical practices under about 30 users, managed IT covers more than one in-house hire can: monitoring around the clock, security, after-hours help and HIPAA paperwork kept current. Above that size, most practices do well with both: an in-house person for day-to-day help and a managed team behind them.

An IT technician working at a computer in a server room

Most practices start by putting an IT salary next to a managed IT invoice. That comparison misleads in both directions: it understates what the hire costs and overstates what one person can cover.

What an in-house hire involves

A good IT generalist is a full salary before you add payroll taxes, benefits, paid leave, equipment, training and certifications. That buys you one person, working business hours, with one skill set.

What one person can’t cover

The gaps matter more than the cost.

  • Coverage. One person can’t be on call around the clock. They take vacation, get sick and go to training. Your EHR doesn’t.
  • Breadth. Networking, cybersecurity, cloud, telephony and HIPAA documentation are different jobs. A generalist will be good at some of them and out of their depth in others.
  • Segregation of duties. The person who sets up your security controls shouldn’t be the only one who reviews them. A one-person IT function has no second pair of eyes, which is a weakness in itself.
  • Continuity. When they leave, the knowledge leaves with them. Our handover checklist covers what to secure if that happens.

In-house, managed or both, side by side

One in-house IT person Managed IT Both (co-managed)
Overnight monitoring Only if they’re on call, and one person can’t watch around the clock Systems watched around the clock, with alerts going to a team The managed team watches overnight; your person picks up in the morning
After-hours emergencies Depends on one person answering their phone A team on call after hours The managed team takes after-hours calls
Vacation and sick cover None, unless you arrange someone else Built in, since nobody is a single point of failure The managed team covers when your person is out
Security updates Done when the help desk queue allows On a set schedule, outside clinic hours The managed team runs them; your person knows what’s changing
HIPAA paperwork Often falls behind day-to-day tickets Kept current as the work happens The managed team keeps it current; your person adds what they know
Best for Larger practices with daily on-site needs and room for more than one IT person Most practices under about 30 users Practices above about 30 users, or with specialized systems that need daily hands-on care

How the answer changes with practice size

  • Under about 15 users: a single hire is hard to justify. Most of their week would be idle, and you’d still have no after-hours or security coverage.
  • 15 to 30 users: managed IT usually covers more for less, because one person can’t handle round-the-clock monitoring, security and compliance documentation at once.
  • 30 to 40 users: the costs start to converge here, and the honest answer is usually both rather than either.
  • 50 users and up: you need more than one IT person to remove the single point of failure, and a hybrid model almost always wins.

When an in-house hire makes sense

Managed IT isn’t always the right answer. Hiring your own IT person makes sense when:

  • You’re large enough to justify more than one IT person, so nobody is a single point of failure
  • You run specialized systems that need hands-on attention every day, like on-site imaging, research systems or custom integrations
  • You need someone physically in the building all the time, not now and then
  • Someone at the practice has the time and know-how to direct technical staff

That last one is easy to overlook. Without someone directing them, an IT hire tends to drift into firefighting, and the longer-term work never gets done.

Where HIPAA comes in

HIPAA is where the comparison tilts furthest. The Security Rule expects a written review of where patient information lives and what could go wrong, access controls, activity logs, encryption, workforce training and incident response, and it expects the documentation behind all of that to stay current as things change, rather than being rebuilt once a year. It also asks you to name a Security Officer (§164.308(a)(2)), and that person doesn’t have to be an IT employee. Our HIPAA checklist for medical practices goes through each piece.

One generalist working through help desk tickets rarely gets that documentation written. Skill usually isn’t the issue. A locked-out user or a broken printer is always more urgent than documentation, every single day. It’s the most common reason we see practices with their own IT person come up short when someone asks to see the HIPAA paperwork.

The hybrid model

Above roughly 30 users, most of the practices we work with split the work. This is usually called co-managed IT:

  • Internal: user support, onboarding and offboarding, vendor coordination, and being the familiar face who knows the staff
  • MSP: security operations, patching, monitoring, compliance documentation, after-hours and holiday coverage, and a second pair of eyes on the controls

It costs more than either one alone, and it covers the weak spots of both.

Three questions for your practice

  1. What happens to your practice if your IT person is unavailable for two weeks?
  2. Who keeps your HIPAA documentation up to date, and when did they last work on it?
  3. If a ransomware attack started at 9 p.m. on a Friday, who would notice?

If any of those answers makes you uneasy, that gap is worth putting a number on. If you’re talking to providers, here’s what managed IT should include for a medical practice.

We’re happy to talk it through whether your IT is in-house, outsourced or a mix. Book a free IT check-in, or read more about our IT support for medical practices.

This article is general information, not legal advice. For questions about your practice’s specific obligations, talk to your attorney or compliance advisor.

Sources

  1. Summary of the HIPAA Security Rule (HHS)
  2. 45 CFR Part 164, Subpart C: the HIPAA Security Rule (eCFR)

Frequently asked questions

At what size does hiring in-house IT start to make sense?
Usually above 40 to 50 users, or when you run specialized systems that need daily attention, like an on-site imaging environment, custom integrations or research work. Even then, most practices that size use a hybrid: someone internal for day-to-day support and vendor relationships, and an MSP for security, compliance documentation and after-hours.
What happens to HIPAA compliance if our one IT person leaves?
It's the biggest risk of relying on one IT person, and it has less to do with support coverage than with what they take with them. What they know, setups nobody documented and half-finished compliance work all walk out the door. After a departure, practices often find the documentation was never written, access reviews were never run and nobody else knows the backup passwords.
Can an in-house person and an MSP work together?
Yes, and it's a common setup above roughly 30 users. The internal person handles user support, onboarding and vendor coordination. The MSP handles security operations, patching, monitoring, compliance documentation and after-hours coverage. You keep a familiar face on site without depending on one person for everything.
Does HIPAA require us to have an IT person on staff?
No. The Security Rule asks you to name someone responsible for security, the Security Officer, but that person doesn't have to be an IT employee, and the technical work can be done by an outside provider that signs a business associate agreement with you. This is general information, not legal advice.
Will we lose a familiar face in the office if we move to managed IT?
Not with a good provider. You should get a small group of people who know your practice, and someone who comes on site when hardware or the network needs hands. If you want a person in the building every day, keep an in-house hire and add a managed team behind them.

Related reading