Facebook-f X-twitter Youtube Google Linkedin-in
Sales 571-982-6000
Support 888-351-9014
Remote Support Login


SERVING VIRGINIA BEACH, VA · NORFOLK · CHESAPEAKE · TOWN CENTER · OCEANFRONT

Healthcare IT Support in Virginia Beach HIPAA-Ready IT for Practices and Clinics.

Ransomware hit 44% of healthcare breaches in 2025, and downtime in a clinic is measured in patients, not tickets. We keep Virginia Beach practices running — EHR support, HIPAA safeguards, and a 30-minute response.

15+
YEARS
1,000+
BUSINESSES
<30 min
RESPONSE
4.9★
GOOGLE
  • 24/7 helpdesk & on-site Virginia Beach support
  • Industry compliance handled end to end
  • Vendor & line-of-business app management
  • A dedicated Success Manager who knows your world
Get Your Free Cyber Risk Score →Book Your Free 15-Minute Strategy Call →or call 571-982-6000

Free · Takes 3 minutes · No sales call required

SOUND FAMILIAR?

If Any of These Hit Home, You Are Losing Money Right Now

EHR Down, Waiting Room Full

When the EHR freezes with a full schedule, providers chart on paper, patients wait, and revenue leaks by the minute.

Ambient AI Scribes Are Ending After-Hours Charting

Practices in Virginia Beach adopting AI scribes and intake agents run fuller schedules with less provider burnout — and the gap compounds monthly.

PHI in Public AI Tools Is a Breach in Waiting

Staff pasting notes into free chatbots is a HIPAA incident nobody signed off on. AI needs BAAs, vetting, and policy — then it is a superpower.

AI

AI for Healthcare — Done Safely

Ambient scribes, AI intake and recall agents, HIPAA-safe vetting and policy — AI that pays for itself in a practice.

  • Ambient AI scribe enablement
  • AI phone, intake & recall agents
  • HIPAA-safe vetting, BAAs & staff policy

Book Your Free 15-Minute Strategy Call →

What We Do

Healthcare IT Services: Eight Capabilities That Protect Hampton Roads Clinical Environments

Each service below addresses a specific threat vector or compliance gap in the Hampton Roads healthcare IT environment. We do not sell technology for its own sake. We solve the specific problems that cause Hampton Roads practices to get breached, fail OCR audits, or lose cyber insurance coverage.

SentinelOne EDR

Endpoint Detection and Response for Clinical Workstations

SentinelOne provides AI-driven behavioral detection on every clinical and administrative endpoint — detecting ransomware behavior, lateral movement, and credential misuse in real time, before encryption begins. Unlike traditional antivirus, EDR monitors process behavior rather than file signatures, meaning it catches novel ransomware variants and fileless attacks that signature tools miss. For Hampton Roads healthcare organizations, every workstation that touches your EHR, your patient portal, or your billing system is in scope. SentinelOne’s rollback capability can reverse ransomware damage within minutes of detection without paying a ransom or waiting for backup restoration.

What it prevents: successful ransomware encryption, silent lateral movement across clinical networks, and the two-to-three week dwell times that allow attackers to exfiltrate patient records before triggering visible damage.

Without it: the Hampton Roads behavioral health ransomware scenario above ran for long enough that the practice could not demonstrate when the breach occurred — a critical failure for the HIPAA four-factor breach test. EDR with audit logging closes both the security gap and the forensic evidence gap simultaneously.

Microsoft 365 + BAA

Microsoft 365 for Healthcare — With a Proper Business Associate Agreement

Capital Techies configures Microsoft 365 for healthcare clients with Defender for Office 365, MFA enforcement across all accounts, conditional access policies that block authentication from non-compliant devices, Data Loss Prevention rules for ePHI keywords in outgoing email, and audit logging that satisfies 45 CFR 164.312(b). Microsoft provides a Business Associate Agreement as part of its Online Services Agreement — but it must be acknowledged and its terms must be reviewed for each client’s specific use case. We execute the Microsoft BAA on behalf of every healthcare client before ePHI enters any Microsoft service. Email phishing is the most common initial access vector in healthcare breaches. Microsoft Defender’s pre-delivery detonation and impersonation protection stops the majority of these attempts before they reach a clinical inbox.

What it prevents: credential phishing against clinical email accounts, unencrypted ePHI transmission, BEC attacks targeting billing staff, and the BAA gap that created an independent HIPAA violation in the Peninsula billing contractor scenario above.

Without it: a Microsoft 365 deployment without a signed BAA is a standing HIPAA violation — before a breach ever occurs. The Sentara settlement demonstrated that OCR treats BAA gaps as enforcement-worthy findings independent of any underlying security failure.

Immutable Backup

Ransomware-Resistant Backup and Same-Day Recovery

We deploy immutable, offsite backup with tested recovery that does not depend on paying a ransom or negotiating with an attacker. Immutability means backup data cannot be encrypted, deleted, or modified by ransomware operators — even if they gain administrative credentials on the primary network. Recovery testing is documented and performed regularly so that when a ransomware event occurs, recovery time objectives are known quantities, not hopeful estimates. For Hampton Roads practices that cannot afford clinical downtime, we align recovery time objectives to the practice’s specific operational requirements and document the backup architecture in the Security Risk Analysis. HIPAA requires a contingency plan under 45 CFR 164.308(a)(7) — tested backup is the technical implementation of that requirement.

What it prevents: the outcome in the Peninsula specialty practice scenario above — paying ransom, receiving a partial decryption key, and losing two years of patient records. A tested immutable backup turns a ransomware event from an existential crisis into a recovery operation.

Without it: the ransom note becomes your recovery plan. Sophos reports 50% of ransomware victims paid ransom in 2025 — and the median payment was $1 million (Sophos State of Ransomware 2025). Practices with tested backup recovered in a median of one week without paying. Practices without it often did not fully recover.

HIPAA SRA + vCISO

HIPAA Security Risk Analysis and Ongoing Compliance Advisory

We conduct a documented Security Risk Analysis per 45 CFR 164.308(a)(1), covering every system where ePHI is stored, transmitted, or processed — EHR, patient portal, billing system, email, backup, imaging, and any clinical AI tools in the environment. The SRA identifies threats, vulnerabilities, likelihood and impact ratings, and existing safeguards, and produces a risk management plan with prioritized remediation items. The SRA is specific to each Hampton Roads organization’s environment, not a generic template. Annual SRA updates are included in ongoing managed service engagements. Our vCISO advisory function covers BAA inventory management, policy documentation, workforce training planning, and OCR audit preparation — everything a covered entity needs to demonstrate an ongoing compliance program when OCR requests documentation.

What it prevents: enforcement actions under OCR’s October 2024 Risk Analysis Enforcement Initiative, which by April 2025 had already produced multiple settlements from organizations that simply never built a documented SRA-based program.

Without it: OCR’s audit protocol begins with the SRA. Organizations that cannot produce a current, documented SRA at the first records request face a much harder enforcement path — because the SRA’s absence is not a secondary finding. It is the foundational violation from which every other gap flows.

KnowBe4

Security Awareness Training for Clinical and Administrative Staff

Annual HIPAA Security Rule training for all workforce members with PHI access, delivered through KnowBe4’s healthcare-specific training modules; simulated phishing campaigns targeting the social engineering techniques used against Hampton Roads healthcare staff (credential harvesting, invoice fraud, CEO impersonation in billing departments); and documented completion records maintained for six years in a format that satisfies OCR documentation requests. Training records include date, content covered, and individual completion confirmation by employee. For behavioral health providers, training covers both HIPAA and 42 CFR Part 2 obligations simultaneously so staff understand the distinction between standard PHI and substance use disorder records. Completion records are maintained in a shared compliance documentation repository accessible during an OCR records request.

What it prevents: credential phishing from clinical inboxes — the initial access vector in both the billing contractor BEC scenario and the specialty practice EHR ransomware scenario above — and the workforce training documentation gaps that appear in nearly every multi-violation OCR enforcement action.

Without it: a workforce that has not been trained on Security Rule requirements and current phishing techniques is both a breach risk and a compliance documentation liability. The four-factor breach test requires demonstrating that staff are trained — without records, there is no demonstration to make.

DMARC + Defender

Email Security and ePHI Protection in Transit

Microsoft 365 Defender for Office 365 provides pre-delivery detonation of malicious attachments, URL rewriting and detonation for phishing links embedded in clinical emails, impersonation protection for executive and physician accounts commonly targeted in BEC attacks, and behavioral anomaly detection for compromised accounts — the control that would have flagged the outbound email forwarding rule in the billing contractor scenario above within hours rather than two weeks. We enforce DMARC, SPF, and DKIM on every healthcare client domain so attackers cannot impersonate your practice domain to patients, referral partners, or payers. For practices that transmit ePHI via email, we implement TLS enforcement and configure Data Loss Prevention rules that flag or block outbound emails containing patient identifiers without encryption.

What it prevents: BEC attacks against billing staff, credential phishing against clinical accounts, domain impersonation targeting patients, and unencrypted ePHI transmission — all in one integrated control layer built on Microsoft’s existing licensing most practices already pay for.

Without it: the average BEC attack in 2024 ran for 13 days before detection according to FBI IC3 reporting — long enough to redirect multiple payment runs and exfiltrate significant patient data. Most Hampton Roads practices have no detection capability for compromised-account behavior that does not involve malware.

Patch + Asset Management

Patch Management and Clinical Asset Inventory

We maintain a complete inventory of every device with ePHI access — workstations, laptops, tablets, printers, medical devices with network connectivity, and any IoT device on the clinical or administrative network — and enforce a documented patch management process that applies security updates within defined timeframes by criticality level. The Virginia Beach senior care patient portal breach above was enabled by an unpatched vulnerability that the vendor had corrected four months earlier. Patch management for healthcare environments requires coordination with EHR vendors to avoid breaking clinical software compatibility — a step that general IT providers often skip, creating either unpatched systems or broken clinical applications. We test patches in staging before production deployment and document the testing process for cyber insurance audits and OCR records requests.

What it prevents: vulnerability exploitation via unpatched systems — the initial access vector in the senior care patient portal scenario above — and the cyber insurance coverage gaps that result from undocumented patch management processes.

Without it: the 241-day mean time to breach detection reported by IBM in 2025 means an unpatched vulnerability can be under active exploitation for months before any alert fires. Healthcare organizations without a documented patch management process are also frequently flagged during cyber insurance underwriting, which can result in coverage denial or ransomware exclusions.

IR Plan + Va. Code 18.2-186.6

Breach-Ready Incident Response and Dual-Track Notification

A documented incident response plan aligned to HIPAA’s breach notification rule and Virginia’s breach notification law (Va. Code 18.2-186.6), including a breach risk assessment workflow applying OCR’s four-factor test, breach notification letter templates for affected individuals, HHS OCR breach portal reporting support, and Virginia AG Computer Crime Section notification package. Virginia requires notification “without unreasonable delay” — not within a fixed number of days — and requires AG notification for every reportable breach regardless of size. HIPAA requires notification to HHS OCR and affected individuals within 60 days of discovery. Both clocks run concurrently from the moment of discovery, meaning the incident response plan must address both regulatory tracks simultaneously from the first hour of incident response. We also provide tabletop exercise facilitation so clinical leadership understands the notification process before it is needed under pressure.

What it prevents: the compounding violation of a breach plus a late or missing notification — two independent enforcement categories. Organizations that miss notification timelines face enforcement on both the underlying security failure and the notification failure as separate violation categories.

Without it: the ransom note is your first notification that a breach occurred — and you are already behind on both the HIPAA 60-day clock and Virginia’s “without unreasonable delay” standard. The four practices in the scenarios above all shared a common failure: no incident response plan that addressed what to do in the first 24 hours.

Who We Serve

Healthcare IT for Every Hampton Roads Clinical Setting

Hampton Roads healthcare is not monolithic. Sentara-affiliated practices have different IT governance than independent groups. Behavioral health has different compliance obligations than general medicine. Medical billing companies carry different liability than the covered entities they serve. Each vertical requires healthcare IT expertise specific to its environment.

Covered Entity

Physician Practices — Virginia Beach, Norfolk, Chesapeake

Independent and affiliated physician practices across Hampton Roads — from Virginia Beach Town Center and Hilltop medical offices to Norfolk and Chesapeake Greenbrier corridor groups — typically run their IT on a mix of EHR-provided cloud applications, local servers, and Microsoft 365, often managed by a generalist IT provider who signed a BAA without fully understanding what it requires. Capital Techies builds the complete security and compliance layer around your clinical software: endpoints protected with SentinelOne EDR, Microsoft 365 configured to Security Rule standards with MFA and DLP, immutable backup, audit logging, and a documented SRA that covers every system in scope. For practices affiliated with Sentara, Riverside, or Chesapeake Regional, we align the IT program to the health system’s compliance expectations while maintaining independent documentation for your practice’s own HIPAA obligations as a covered entity.

Dual Compliance: HIPAA + 42 CFR Part 2

Behavioral Health Providers — Peninsula and Southside

Hampton Roads behavioral health practices serve a population that includes veterans and active-duty personnel from Naval Station Norfolk, Joint Base Langley-Eustis, and other installations throughout the region, alongside a large civilian patient base across Chesapeake, Suffolk, and Virginia Beach. This population means behavioral health providers here have an outsized proportion of substance use disorder patients whose records are subject to 42 CFR Part 2 — a stricter confidentiality framework than standard HIPAA that prohibits disclosure without patient consent and requires record segregation. Capital Techies builds access control architectures that enforce both frameworks simultaneously: Part 2 records receive dedicated access controls, logical segregation within the EHR environment, and separate audit logging. Staff training covers both regulatory frameworks so clinical and front-desk staff understand which records trigger which obligations. The behavioral health commingling scenario above is not unusual — it is the default state for most small behavioral health practices that have not explicitly addressed Part 2 in their IT architecture.

Medical Billing / Business Associate

Medical Billing and Revenue Cycle Companies

Medical billing and revenue cycle management companies operating in Hampton Roads carry direct HIPAA business associate liability — they are in scope for OCR enforcement independently of their covered entity clients. Many billing companies operate under a misconception that the physician practice’s HIPAA obligations cover them. They do not. A billing company that experiences a BEC attack or ransomware event involving patient data must notify HHS OCR and affected individuals as a business associate, file the Virginia AG notification, and demonstrate a documented security program when OCR requests records. Capital Techies builds healthcare IT programs specifically for Hampton Roads billing and RCM companies: email security with DMARC and Defender, endpoint protection with SentinelOne, a complete BAA inventory covering both covered entity clients and the billing company’s own subcontractors, immutable backup, and a Security Risk Analysis covering all billing system environments. We also execute BAAs for the billing company’s own vendor relationships that are frequently overlooked — cloud accounting software, payment processing platforms, and practice management tools all commonly require them.

Covered Entity

Dental Practices — Hampton Roads

Dental practices that submit claims electronically to insurance carriers are HIPAA covered entities subject to the full Security Rule. Many Hampton Roads dental offices operate under the mistaken belief that their Dentrix, Eaglesoft, or Open Dental software’s “HIPAA compliance” features satisfy their Security Rule obligations. They do not. The software’s own security posture does not substitute for the practice’s Security Risk Analysis covering the entire environment — the workstations that run the software, the network that connects them, the backup system that stores patient data, the Microsoft 365 account that receives patient emails, and the imaging server that holds digital X-rays. Capital Techies builds HIPAA compliance programs for Hampton Roads dental practices sized appropriately for a small office, including digital X-ray system security, encrypted device management, and BAA execution for every vendor in the practice’s technology stack — including cloud storage providers, IT support vendors, and billing services. Dental records, X-rays, and treatment histories are ePHI and fully subject to HIPAA Security Rule requirements.

Covered Entity

Senior Care and Assisted Living — Chesapeake, Virginia Beach, Suffolk

Skilled nursing facilities, assisted living communities, memory care facilities, and home health agencies across Hampton Roads face HIPAA obligations that extend across a complex technology landscape: resident electronic health records, medication administration systems, nursing station workstations, family communication portals, building security systems with resident tracking components, and an array of connected medical devices including fall detection sensors and vital sign monitors. The patient portal breach scenario above — 340 residents, 90 days of undetected access — is a direct illustration of the monitoring gap common in senior care IT environments. Capital Techies provides managed IT for Hampton Roads senior care facilities that includes endpoint protection on all care delivery workstations, network segmentation between clinical and administrative systems, patch management coordinated with clinical software vendors, and HIPAA technical safeguards scaled for multi-floor facility environments with shift-based staff access patterns.

Covered Entity + Health System Context

Sentara-Affiliated and Independent Specialty Clinics

Specialty clinics across Hampton Roads — orthopedic, dermatology, cardiology, ophthalmology, oncology, and others — handle ePHI across a broader set of systems than general practices: EHR, diagnostic imaging (PACS/DICOM), patient portal, infusion management, procedure scheduling, and specialty-specific billing platforms, often from different vendors with different security postures and different BAA templates. Each system is independently in scope for the Security Risk Analysis. Each vendor integration is a potential lateral movement path for an attacker. Capital Techies maps every ePHI data flow in a specialty clinic’s environment, identifies BAA gaps across the full vendor stack, implements technical safeguards on every ePHI-capable system, and produces the documentation package that demonstrates a complete compliance program to OCR — including the AI-assisted diagnostic tools and remote monitoring platforms that are increasingly common in specialty settings. Sentara-affiliated specialty groups additionally benefit from our alignment with Sentara’s enterprise security program standards for affiliate organizations.

What Is Happening to Hampton Roads Healthcare Right Now

Four Healthcare Threat Scenarios Playing Out Across Hampton Roads

These are not hypotheticals. Each scenario below mirrors documented threat patterns from OCR enforcement actions, Verizon DBIR 2025, Sophos State of Ransomware 2025, and Virginia-area incident reporting — adapted for the healthcare organizations that serve the Peninsula, Southside, and Virginia Beach. Every named regulation and cost figure is sourced.

The EHR Ransomware Attack That Shut Down a Peninsula Practice on a Friday Afternoon

A Peninsula-area specialty practice running its clinical records on an aging Windows server with no endpoint detection received a phishing email on a Thursday morning. A medical assistant clicked a link, entered her Microsoft 365 credentials on a spoofed login page, and went back to scheduling appointments. By Friday at 4:30 p.m., every file on the server — patient records, scheduling data, billing histories, diagnostic imaging — was encrypted. The attacker left a ransom note demanding payment in Bitcoin. The practice paid on Monday. The decryption key partially worked. Two years of patient records were unrecoverable.

Under HIPAA, the ransomware event is a presumptive breach requiring 60-day notification to HHS OCR and affected patients unless the practice can demonstrate through a documented four-factor analysis that PHI was not accessed or acquired — a burden of proof most practices cannot meet without forensic evidence they never collected. Under Virginia’s breach notification law (Va. Code 18.2-186.6), notification to affected residents and the Virginia Attorney General’s Computer Crime Section was required without unreasonable delay. The practice missed both timelines.

Cost benchmark: average ransomware recovery in 2025 was $1.53 million excluding the ransom payment itself (Sophos State of Ransomware 2025). Verizon DBIR 2025 reports ransomware appeared in 44% of all breaches — and 88% of small business breaches specifically. The median ransom payment was $115,000 (Verizon DBIR 2025). This practice paid more, recovered less, and still faced OCR.

The Medical Billing Company Whose Email Account Forwarded 4,200 Patient Records for Two Weeks

A Hampton Roads medical billing contractor supporting Peninsula and Southside physician practices received what appeared to be a Microsoft 365 password-reset notification. The practice manager clicked through, entered her credentials on a convincing fake login page, and returned to processing claims. Over the next fourteen days, the attacker used her compromised account to silently forward outgoing emails — including claims attachments, remittance advices, and patient demographic exports — to an attacker-controlled inbox. Records belonging to 4,200 patients moved out of the organization before anyone noticed an anomaly in the account activity log.

The billing company, as a HIPAA business associate, carried direct liability to HHS OCR under the Omnibus Rule — independent of the covered entity practices it served. Notification to HHS OCR was required within 60 days of discovery. Virginia’s breach notification law (Va. Code 18.2-186.6) required AG notification for every reportable breach. Both timelines were missed. The billing company also lacked a signed Business Associate Agreement with two of its covered entity clients, creating an additional independent HIPAA violation category layered on top of the breach.

Outcome: HIPAA breach notification violation plus missing BAA violations for each uncovered client relationship — two independent enforcement categories. Sentara Health’s 2019 $2.175M HHS OCR settlement included a missing BAA finding on its own. Business email compromise is consistently among the costliest attack types reported to the FBI’s IC3. Microsoft 365 Defender, MFA, and DMARC enforcement stop the majority of these attacks before the first credential is entered.

The Behavioral Health Practice That Commingled Substance Use Disorder Records With General PHI

A Hampton Roads behavioral health group serving veterans, active-duty personnel, and civilian patients across Chesapeake and Suffolk managed all patient records in a single shared EHR with no role-based access differentiation. Session notes for substance use disorder treatment — subject to 42 CFR Part 2’s stricter confidentiality requirements — sat in the same folder structure as general clinical records, accessible to the full front-desk staff, billing team, and clinical assistants. When a ransomware operator encrypted the server and the group began working with a forensic firm to determine what data was accessed, they discovered the EHR’s audit log had never been configured. There was no record of who had accessed what, making it impossible to apply the HIPAA four-factor breach test.

The Part 2 SUD records created a second and simultaneous compliance exposure: 42 CFR Part 2 imposes confidentiality obligations stricter than standard HIPAA, prohibits disclosure without patient consent in most circumstances, and requires records to be segregated from general PHI. The practice had never implemented record segregation or trained staff on the distinction between HIPAA-governed records and Part 2-governed records. The breach triggered both frameworks simultaneously.

Concurrent exposure: HIPAA Security Rule violations (missing audit logging per 45 CFR 164.312(b), missing SRA per 164.308(a)(1)), HIPAA breach notification obligations, and 42 CFR Part 2 confidentiality violations for SUD records exposed without consent. For Hampton Roads behavioral health providers serving veterans near Naval Station Norfolk or JBLE, this dual-framework compliance gap is a material and underappreciated risk.

The Virginia Beach Senior Care Facility Whose Patient Portal Was Breached Without Anyone Noticing for 90 Days

A Virginia Beach skilled nursing facility used a web-based patient portal to allow family members to view care notes, medication schedules, and discharge planning documents. The portal vendor had not applied a security patch released four months earlier. An attacker discovered the unpatched vulnerability through an automated scan, gained access to the portal’s authentication system, and created a credential that allowed persistent read access to resident records. The attacker accessed records belonging to 340 residents over 90 days before an alert from the vendor’s own monitoring system — not the facility’s — flagged unusual query volume.

By the time the breach was discovered, the 60-day HIPAA breach notification clock had already expired based on when the intrusion began. The facility had no documented incident response plan, no clear point of contact for OCR reporting, and no vendor-side BAA that clearly assigned breach notification responsibilities. HHS OCR’s breach notification rule places the covered entity’s notification obligation at 60 days from discovery — but discovery itself is a legal determination, and facilities with no monitoring in place often cannot demonstrate when discovery actually occurred.

Key precedent: HHS OCR’s October 2024 Risk Analysis Enforcement Initiative explicitly targets organizations that lack security monitoring and documented SRAs — exactly the conditions that allowed this breach to run for 90 days undetected. The US average data breach cost was $10.22 million in 2025 per IBM. For a Hampton Roads senior care facility operating on thin margins, a breach at any fraction of that scale is existential. Patch management, vendor BAA review, and continuous monitoring are the operational controls that close this gap.

Definition

What Healthcare IT Actually Covers — and Why Your EHR Vendor Does Not Do It

Healthcare IT for Hampton Roads physician practices, behavioral health providers, dental offices, senior care facilities, and medical billing companies means managing the entire technology environment through which patient health information flows — not just the clinical software. Your EHR vendor provides a HIPAA-compliant application. They do not protect the Windows workstations that access it, the Microsoft 365 email accounts that receive patient inquiries, the backup system that stores your data if ransomware encrypts your server, the network that connects your clinical and administrative systems, or the staff who click phishing links from their clinical inboxes. Every one of those layers is in scope for the HIPAA Security Rule and every one of them is the healthcare IT provider’s responsibility, not the EHR vendor’s.

What healthcare IT includes: managed endpoints with endpoint detection and response (EDR) on every clinical and administrative workstation; Microsoft 365 administration with a signed Business Associate Agreement, Defender deployment, and MFA enforcement; ransomware-resistant backup with tested recovery that does not depend on paying an attacker; network monitoring and patch management across clinical and administrative infrastructure; HIPAA Security Risk Analysis documentation covering every system where ePHI is stored, transmitted, or processed; Business Associate Agreement management for every vendor with ePHI access; access control implementation with role-based minimum necessary permissions; audit log configuration per 45 CFR 164.312(b); security awareness training for clinical and administrative staff; and breach-ready incident response planning covering both the 60-day HIPAA notification window and Virginia’s notification requirements under Va. Code 18.2-186.6.

What healthcare IT is not: healthcare IT is not a feature of your EHR. It is not covered by your IT provider signing a BAA without configuring your environment to satisfy Security Rule requirements. It is not satisfied by a single annual training session. It is not a one-time assessment filed in a drawer. The HIPAA Security Rule requires an ongoing program — annual Security Risk Analysis updates, continuous monitoring, documented policy enforcement, and evidence of all of the above maintained for six years. Capital Techies builds and operates these programs for Hampton Roads healthcare organizations as a managed service, not a one-time project.

The NIST CSF 2.0 context: NIST published Cybersecurity Framework 2.0 in February 2024, expanding the original five functions (Identify, Protect, Detect, Respond, Recover) to six by adding Govern. HHS has published guidance mapping HIPAA Security Rule requirements to NIST CSF controls. For Hampton Roads healthcare organizations seeking cyber insurance renewal — carriers increasingly require evidence of a structured security program — NIST CSF 2.0 provides the operational framework and HIPAA provides the legal requirement. Capital Techies implements NIST CSF 2.0 as the backbone of every healthcare security program, mapped to HIPAA Security Rule specifications so organizations satisfy both simultaneously.

The Hampton Roads healthcare landscape: Sentara Health — Virginia’s largest health system with approximately 35,000 employees, 12 hospitals, and headquarters in Norfolk and Virginia Beach — established the enforcement posture that shapes OCR’s expectations for Virginia healthcare organizations with its $2.175 million settlement in November 2019 (missing BAA, underreported breach). Riverside Health System (Newport News, 8 facilities, Greater Peninsula service area) and Chesapeake Regional Medical Center (310 beds, Chesapeake) anchor the regional health system landscape alongside Bon Secours Mercy Health and Sentara-affiliated groups across the Southside. Independent practices, specialty clinics, behavioral health groups, dental offices, senior care facilities, and medical billing companies that operate within this ecosystem carry their own HIPAA obligations independently of the health systems they affiliate with or serve. Capital Techies builds healthcare IT programs for every tier of this landscape.

AI and clinical technology context: Healthcare AI tools — ambient documentation, diagnostic support, clinical decision support, and patient communication platforms — are increasingly common in Hampton Roads clinical environments. Each AI vendor with access to ePHI is a HIPAA business associate requiring a signed BAA, and AI-generated outputs that contain PHI are subject to the same Security Rule requirements as any other ePHI. The 2024 and 2025 OCR guidance cycles have emphasized that the introduction of AI tools does not change the covered entity’s responsibility to conduct a Security Risk Analysis covering every system where ePHI is processed. Capital Techies evaluates new clinical AI tools for BAA status and ePHI data flows before they are deployed into a client environment.

The Numbers

Six Healthcare Cybersecurity Statistics Every Hampton Roads Practice Needs on Its Wall

Every figure below is sourced and attributable. These are the numbers your practice administrator, compliance officer, and board need to understand before an attacker or OCR arrives at your door.

$10.22M
Average cost of a US data breach in 2025 — the highest in the world for the 15th consecutive year. Healthcare breaches rank among the most expensive of any industry due to regulatory penalties, patient notification, and operational disruption compounded on top of each other.
Source: IBM Cost of a Data Breach Report 2025 (ibm.com/reports/data-breach)

44%
Share of all data breaches in 2025 in which ransomware appeared — up from 32% the prior year, now the most common attack action in breaches. For small businesses specifically, ransomware appeared in 88% of breaches. Healthcare is a disproportionate target.
Source: Verizon Data Breach Investigations Report (DBIR) 2025

$1.53M
Average ransomware recovery cost in 2025 excluding any ransom payment — down from $2.73 million in 2024 but still catastrophic for a small practice. This figure covers forensics, restoration, downtime, and notification — not the ransom itself.
Source: Sophos State of Ransomware 2025 (sophos.com)

$2.175M
HHS OCR settlement with Sentara Hospitals in November 2019 — for underreporting a breach affecting 16,342 patients and lacking a Business Associate Agreement with its parent entity. A Virginia health system. Hampton Roads. The enforcement precedent that defines OCR’s expectations here.
Source: HHS Office for Civil Rights, official settlement page (hhs.gov), Nov. 27, 2019

Oct. 2024
HHS OCR launched its Risk Analysis Enforcement Initiative — targeting covered entities and business associates that have failed to conduct adequate HIPAA Security Risk Analyses. By April 2025, multiple settlements had resulted. The SRA is the single most commonly cited missing control in OCR enforcement actions.
Source: HHS OCR Risk Analysis Enforcement Initiative announcement; National Law Review; Feldesman LLP, 2025

241 days
Mean time to identify and contain a breach globally in 2025 — the lowest in 9 years, yet still nearly eight months of undetected attacker access. For Hampton Roads practices without continuous monitoring, the attacker clock starts long before any alert is generated.
Source: IBM Cost of a Data Breach Report 2025

COMPLIANCE, HANDLED

Healthcare Compliance Frameworks Capital Techies Addresses for Hampton Roads Organizations

You do not need to memorize the acronyms. You need to pass the audit and keep your clients’ trust. That is our job.

HIPAA SECURITY RULE

Security Risk Analysis per 164.308(a)(1) covering all ePHI systems; access control implementation per 164.312(a)(1) with role-based minimum necessary permissions; audi…

HIPAA BREACH NOTIFICATION

Breach risk assessment workflow applying OCR’s four-factor test from first hour of incident response; breach notification letter preparation for affected individuals; …

VIRGINIA BREACH NOTIFICATI

Incident response plan incorporating Virginia-specific notification workflow; notification letter preparation for affected Virginia residents; Virginia AG Computer Cri…

42 CFR PART 2

Access control architecture segregating Part 2 SUD records from general PHI; logical or physical segregation within EHR environments; patient consent tracking for any …

See the full framework detail
Framework Who Needs It What Capital Techies Does Deliverable
HIPAA Security Rule (45 CFR Part 164, Subpart C) Every covered entity and business associate handling ePHI — regardless of organization size. Includes all Hampton Roads physician practices, behavioral health providers, dental offices, senior care facilities, medical billing companies, and specialty clinics that transmit health information electronically. The Security Rule has no small-business exemption. Security Risk Analysis per 164.308(a)(1) covering all ePHI systems; access control implementation per 164.312(a)(1) with role-based minimum necessary permissions; audit logging per 164.312(b); encryption of ePHI at rest and in transit; automatic logoff per 164.312(a)(2)(iii); workforce training per 164.308(a)(5); Business Associate Agreement management for all vendors with ePHI access; incident response planning per 164.308(a)(6); six-year documentation retention Annual SRA report with risk management plan, 164.308-164.312 evidence folder, BAA inventory with executed agreements, training completion records, contingency plan and breach response runbook
HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) All covered entities for breaches affecting their patients; business associates must notify covered entity clients within 60 days of discovery. For breaches affecting 500 or more individuals in a state, covered entities must also notify prominent media outlets in that state. HHS breach portal reporting is required within 60 days of discovery for large breaches; smaller breaches may be reported annually. Breach risk assessment workflow applying OCR’s four-factor test from first hour of incident response; breach notification letter preparation for affected individuals; HHS OCR breach portal reporting support; covered entity notification for business associate clients; evidence preservation to support four-factor test conclusions Breach notification letter templates, four-factor risk assessment documentation, HHS OCR breach portal filing support, business associate-to-covered-entity notification protocol
Virginia Breach Notification Law (Va. Code 18.2-186.6) Every Hampton Roads healthcare organization that owns or licenses computerized personal information about Virginia residents. Notification required “without unreasonable delay” to affected residents and to the Virginia Attorney General Computer Crime Section for every reportable breach, regardless of size. Civil penalties up to $150,000 per breach. No fixed number of days — the “without unreasonable delay” standard applies. Incident response plan incorporating Virginia-specific notification workflow; notification letter preparation for affected Virginia residents; Virginia AG Computer Crime Section notification package; dual-track coordination so HIPAA federal notifications and Virginia state notifications are prepared simultaneously from the same incident response process Incident response plan with dual-track notification workflow, Virginia AG notification package template, breach response runbook aligned to both state and federal timelines
42 CFR Part 2 (Substance Use Disorder Records) Behavioral health practices, federally assisted substance use disorder treatment programs, and any provider that maintains SUD treatment records — applies in addition to HIPAA with stricter patient consent requirements and prohibition on re-disclosure. Particularly relevant for Hampton Roads providers serving the veteran and active-duty population near Naval Station Norfolk and Joint Base Langley-Eustis. Access control architecture segregating Part 2 SUD records from general PHI; logical or physical segregation within EHR environments; patient consent tracking for any disclosure; staff training distinguishing HIPAA-governed from Part 2-governed records; re-disclosure prohibition enforcement; audit logging specific to Part 2 record access Segregated access control documentation, consent audit trail system, Part 2 policy documentation, workforce training records covering both HIPAA and Part 2, EHR access control configuration evidence
NIST Cybersecurity Framework 2.0 Hampton Roads healthcare organizations seeking a structured operational security program aligned to HHS-published HIPAA/NIST mapping guidance — particularly organizations preparing for cyber insurance renewal, managing a security program for board-level reporting, or building a documented security posture that goes beyond minimum HIPAA compliance. NIST CSF 2.0 (published February 2024) adds the Govern function to the original five CSF functions. NIST CSF 2.0 Govern/Identify/Protect/Detect/Respond/Recover function implementation mapped to HIPAA Security Rule specifications; organizational security policy documentation under the Govern function; cyber asset inventory under Identify; security controls implementation under Protect; 24/7 SOC monitoring under Detect; incident response under Respond; tested backup and business continuity under Recover NIST CSF 2.0 implementation documentation, HIPAA-to-CSF crosswalk, security policy suite, cyber insurance renewal support documentation, board-ready security posture report
Cyber Insurance Requirements Every Hampton Roads healthcare organization carrying or seeking cyber liability coverage. Carriers now routinely require documented MFA, EDR deployment, tested and immutable backup, security awareness training with simulated phishing, patch management, network segmentation, and a written incident response plan as conditions of coverage and — critically — as conditions of claim payment. Missing controls can result in claim denial even when coverage technically exists. MFA implementation and documentation across all email and remote access systems; SentinelOne EDR deployment with documented coverage; immutable backup with tested recovery documentation; KnowBe4 security awareness training with completion records and simulated phishing results; patch management process documentation; network segmentation evidence; incident response plan; controls attestation package for renewal questionnaire support Cyber insurance controls attestation package with supporting evidence, renewal questionnaire support, gap remediation for coverage requirements, post-claim audit-ready documentation
HHS OCR Risk Analysis Requirement (45 CFR 164.308(a)(1)) Every HIPAA covered entity and business associate — required annually or upon significant operational change (new location, new EHR, new vendor with ePHI access, new AI tool, significant workforce change). OCR’s October 2024 Risk Analysis Enforcement Initiative specifically targets organizations that have not conducted adequate, documented SRAs. Multiple settlements resulted by April 2025. The SRA is the single most commonly cited missing control in OCR enforcement actions. Comprehensive Security Risk Analysis specific to each Hampton Roads organization’s environment — covering all ePHI locations (EHR, email, backup, imaging, billing, patient portal, clinical AI tools), threat and vulnerability assessment, likelihood and impact ratings for each risk, evaluation of existing safeguards, and a risk management plan with prioritized remediation. Not a generic template — the SRA reflects the organization’s actual systems, staff, and workflows. Documented SRA report meeting OCR’s guidance requirements, risk management plan with prioritized remediation items, annual SRA refresh schedule, evidence folder for OCR records requests

Free Healthcare IT Assessment

Find Out Exactly Where Your Healthcare IT Program Has Gaps — In 15 Minutes

Most Hampton Roads healthcare practices have larger security and compliance gaps than they realize. Our free Healthcare IT Assessment identifies your specific exposure areas across endpoint security, HIPAA technical safeguards, backup architecture, and email security — and gives you a written summary with no obligation.

  • 15-minute call with a Capital Techies healthcare IT advisor, not a salesperson
  • We map your current technology stack against Security Rule specifications and cyber insurance requirements
  • We identify your highest-risk gaps: unprotected endpoints, missing EDR, backup that cannot survive ransomware, BAA inventory holes
  • You receive a written gap summary whether or not you become a client
  • No contract required. No sales pressure — ever.
  • Serving physician practices, behavioral health, dental, senior care, medical billing companies, and specialty clinics across all seven cities of Hampton Roads

Start My Free Healthcare IT Assessment

For Hampton Roads healthcare organizations and their business associates. Response within 30 minutes.













No spam. No contract required. Your information is used only to prepare for your assessment call and is never sold or shared.

Client Feedback

What Our Clients Say

Real reviews from Capital Techies clients on Google.

FAQ

Healthcare IT Questions from Hampton Roads Medical Practices, Billing Companies, and Senior Care Facilities

Authoritative answers to the questions Hampton Roads healthcare organizations ask most often about managed IT, HIPAA Security Rule compliance, ransomware protection, cyber insurance, and the specific regulations that apply to their clinical setting.

What does a managed IT provider do differently for healthcare organizations versus general businesses?
Healthcare IT requires a layer of compliance and clinical-context awareness that general managed IT does not. Every technology decision — cloud storage, email platform, backup solution, remote access tool — must be evaluated against HIPAA Security Rule requirements, and every vendor with ePHI access requires a signed Business Associate Agreement before they touch your environment. General IT providers often sign these BAAs without understanding what they obligate them to do, or without knowing which systems actually contain ePHI. Capital Techies structures every healthcare engagement with HIPAA technical safeguards built in from the start: MFA on all ePHI-capable accounts, encrypted devices, audit logging per 45 CFR 164.312(b), access controls scoped to minimum necessary, and a tested backup architecture that survives ransomware without paying a ransom. For Hampton Roads practices on Epic, eClinicalWorks, athenahealth, Dentrix, MatrixCare, or other EHR platforms, we manage the surrounding infrastructure — endpoints, network, email, identity — so the clinical system runs securely and compliantly.
What is the average cost of a healthcare data breach in the United States?
According to IBM’s Cost of a Data Breach Report 2025, the average US data breach costs $10.22 million — the highest in the world for the 15th consecutive year. Healthcare breaches consistently rank among the most expensive of any industry, driven by the combination of regulatory penalties, breach notification costs, forensic investigation, patient notification, credit monitoring obligations, and reputational damage that leads to patient attrition. Ransomware, present in 44% of all breaches in 2025 per the Verizon DBIR 2025, adds recovery costs that Sophos reports at $1.53 million on average excluding any ransom payment. For a small to mid-size Hampton Roads practice, a breach at anything close to these figures is an existential event. The cost of preventive managed IT and cybersecurity services is a fraction of one percent of the average breach cost.
Does my small physician practice in Virginia Beach need managed IT with HIPAA capabilities, or can I use a general IT provider?
A general IT provider that does not understand HIPAA creates compliance exposure even when they are doing a good job technically. They may configure cloud backup without a signed BAA — making that backup relationship an independent HIPAA violation regardless of whether a breach occurs. They may set up Microsoft 365 without a Microsoft BAA. They may not configure audit logging as required by 45 CFR 164.312(b), or may not know what minimum necessary access controls look like in a clinical context. Capital Techies signs a BAA with every healthcare client before accessing any system that contains ePHI, structures all technology choices to satisfy Security Rule requirements, and produces documentation that holds up to an OCR records request. For Hampton Roads practices, that combination — technical competence plus compliance context — is the standard of care for healthcare IT. The HIPAA Security Rule has no small-business exemption: a three-physician practice in Chesapeake faces the same legal requirements as Sentara Health.
What is ransomware and why is it a specific threat to healthcare organizations?
Ransomware is malicious software that encrypts a victim’s files and demands payment for the decryption key. Healthcare organizations are disproportionately targeted for three reasons: patient data is extremely valuable on criminal markets, the operational pressure to restore clinical systems quickly creates payment incentive, and many healthcare IT environments — particularly small practices and behavioral health providers — lack the endpoint detection and backup architecture that would allow them to recover without paying. Ransomware appeared in 44% of all data breaches in 2025 per the Verizon DBIR 2025, and was present in 88% of small business breaches specifically. In healthcare, a ransomware attack on an EHR system is not just a business continuity problem — it is a HIPAA breach requiring 60-day notification to HHS OCR and affected patients, plus notification to the Virginia Attorney General under Va. Code 18.2-186.6. Capital Techies deploys SentinelOne EDR for real-time ransomware detection and maintains immutable, tested backups that enable same-day recovery without paying a ransom.
What is business email compromise and how does it target Hampton Roads medical billing companies?
Business email compromise (BEC) is an attack in which a threat actor gains access to or impersonates a legitimate business email account to manipulate financial transactions or steal information. Medical billing and revenue cycle management companies are high-value BEC targets because they routinely handle patient financial data, process insurance payments, and communicate with both payers and covered entity clients about money movement. A billing company whose email account is compromised can be used to intercept remittance advices, redirect payments, or forward patient records to attacker-controlled addresses — triggering HIPAA breach notification obligations for the billing company as a business associate. Microsoft 365 Defender, multi-factor authentication, and DMARC enforcement are the three controls that stop the majority of BEC attacks before they reach a clinical inbox. Capital Techies implements all three as standard components of every healthcare IT engagement, including for medical billing companies across Hampton Roads.
Do senior care facilities and assisted living communities in Hampton Roads need HIPAA-compliant IT?
Yes, if they are HIPAA covered entities or business associates. Skilled nursing facilities and nursing homes that provide healthcare services and transmit health information electronically for billing purposes are HIPAA covered entities. Assisted living communities that provide healthcare services may also be covered entities depending on their service model. Senior care facilities additionally face HIPAA obligations through their relationships with home health agencies, pharmacy benefit managers, and other vendors who access resident health information. In Hampton Roads, senior care organizations must comply with both HIPAA and Virginia’s breach notification law under Va. Code 18.2-186.6. Capital Techies serves senior care and assisted living facilities across the Hampton Roads region with managed IT programs that include HIPAA technical safeguards, ransomware-resistant backup, endpoint protection, and network segmentation scaled for facilities managing both resident care systems and administrative networks.
What is the NIST Cybersecurity Framework 2.0 and should Hampton Roads healthcare organizations use it?
NIST CSF 2.0, published in February 2024, is a voluntary cybersecurity framework organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. For healthcare organizations, NIST CSF 2.0 works alongside HIPAA rather than replacing it — the framework provides the operational structure for cybersecurity program management while HIPAA provides the legal requirements for ePHI protection. HHS has published guidance mapping HIPAA Security Rule requirements to NIST CSF controls, making it practical to build a program that satisfies both simultaneously. For Hampton Roads healthcare organizations seeking cyber insurance, carriers increasingly require evidence of a structured security program — and a documented NIST CSF 2.0 implementation provides that evidence in a format insurers recognize. Capital Techies uses NIST CSF 2.0 as the operational backbone of healthcare security programs, mapped to HIPAA Security Rule specifications so organizations satisfy both frameworks from a single managed service engagement.
What does Virginia’s breach notification law require of healthcare organizations?
Virginia Code 18.2-186.6 requires any entity that owns or licenses computerized personal information about Virginia residents to notify affected residents and the Virginia Attorney General’s Computer Crime Section without unreasonable delay after a qualifying breach. Virginia does not impose a fixed number of days — the “without unreasonable delay” standard applies, and notification may only be delayed at law enforcement’s written request when it would impede a criminal investigation. AG notification is required for every reportable breach regardless of how many individuals are affected. For healthcare organizations, this Virginia requirement runs concurrently with HIPAA’s 60-day breach notification obligation to HHS OCR and affected individuals — both notification streams must be prepared simultaneously from the first hour of incident response. Civil penalties under Virginia law can reach $150,000 per breach. Capital Techies builds breach notification workflows that satisfy both the federal HIPAA timeline and Virginia’s state notification requirements in a single coordinated incident response process.
What cyber insurance requirements do Hampton Roads healthcare organizations typically face at renewal?
Cyber insurance carriers have substantially tightened underwriting requirements for healthcare organizations since 2021. At renewal, Hampton Roads practices and facilities typically face questionnaires requiring documented evidence of: multi-factor authentication on all email and remote access, endpoint detection and response (EDR) on all workstations and servers, tested and immutable backup with documented recovery time objectives, security awareness training with simulated phishing, patch management with documented processes, network segmentation between clinical and administrative systems, and a written incident response plan. Organizations that cannot demonstrate these controls face coverage denial, premium increases, or policy exclusions for ransomware-related losses. Capital Techies implements all standard carrier-required controls and maintains documentation in a format that survives post-claim audit — because a claim denied due to a controls gap is worse than no coverage at all.
How does a patient portal breach differ from an EHR ransomware attack in terms of HIPAA obligations?
Both trigger HIPAA breach notification obligations, but through different pathways. A patient portal breach — where an attacker gains unauthorized access and views or exfiltrates patient records — is a confidentiality breach requiring OCR notification and patient notification within 60 days of discovery. An EHR ransomware attack is primarily an availability and integrity breach, but if the attacker exfiltrated data before encrypting it (common in modern ransomware operations using double-extortion tactics), it simultaneously triggers confidentiality breach notification. OCR’s four-factor test determines whether a ransomware event is a presumptive breach: the burden is on the covered entity to demonstrate that PHI was not accessed or acquired, not on OCR to prove it was. Capital Techies builds incident response plans that apply the four-factor test from the first hour of an incident, preserving evidence and documenting the analysis OCR will require.
Does behavioral health have different IT security requirements than general medical practices?
Behavioral health providers face the same HIPAA Security Rule requirements as any other covered entity, but they carry additional obligations under 42 CFR Part 2 for substance use disorder treatment records. Part 2 imposes stricter confidentiality requirements than standard HIPAA: SUD records cannot be disclosed without written patient consent in most circumstances, including to other treating providers, and must be segregated from general PHI. A behavioral health IT environment that commingles SUD records with general clinical records in a shared EHR creates simultaneous HIPAA and 42 CFR Part 2 compliance exposure. Capital Techies builds access control architectures for Hampton Roads behavioral health providers that enforce both frameworks: Part 2 records receive heightened access controls, logical segregation, and separate audit logging, while general PHI follows standard HIPAA technical safeguard specifications. For providers serving the region’s veteran and active-duty military population — substantial in Hampton Roads — this distinction is particularly critical and frequently overlooked.
How long does it take to set up managed IT services for a Hampton Roads medical practice?
For a typical small to mid-size Hampton Roads physician practice — 5 to 25 providers, one to three locations — Capital Techies can complete the onboarding process including network assessment, endpoint deployment, Microsoft 365 configuration, SentinelOne EDR installation, immutable backup setup, and initial documentation in 15 to 30 business days from contract signing. The process begins with a discovery session covering existing infrastructure, EHR platform, vendor relationships, and current security posture. HIPAA-specific elements — Security Risk Analysis documentation, BAA inventory review, access control assessment — run concurrently with the technical onboarding and are typically completed within 45 days. For larger facilities or multi-location groups, timelines are scoped during the initial assessment. Capital Techies does not deploy a standard template — every onboarding plan is specific to the organization’s clinical environment, practice management system, existing vendor relationships, and compliance baseline.

How Exposed Is Your Business Right Now?

Get your free Cyber Risk Score in under 3 minutes. We check for exposed credentials, email spoofing gaps, dark web leaks, and unpatched systems. You get a letter grade and a plain-English report. No sales call required.

Get Your Free Cyber Risk Score →

Free · Takes 3 minutes · No sales call required