Medical Office IT Guide: EHR, Exam Rooms, EPCS, Phones & HIPAA

A small medical practice depends on technology at every step of a visit. The patient checks in on a tablet, the medical assistant documents vitals in the electronic health record (EHR), the provider charts and e-prescribes from the exam room, a referral goes out by fax, and the claim leaves for the clearinghouse before the patient reaches the parking lot. If any of that stops, patient flow stops with it.

Most practices didn't design that technology as one system. It accumulated: an EHR chosen years ago, a fax machine nobody wants to give up, a phone system from a previous office, tablets someone bought online. This guide helps you look at it all together and make it reliable, secure and HIPAA-ready.

We're Beefed Up IT, a managed IT provider based in Ormond Beach, Florida. Medical and dental practices are the core of our work. Below is everything we'd walk through with a practice administrator or physician-owner: EHR choices, exam-room computers, e-prescribing and controlled substances, fax, phones, patient portal and telehealth, check-in kiosks, network and Wi-Fi, HIPAA, backups, budget, and a checklist for opening a new office.

What technology does a small medical practice need?

A small medical practice needs an EHR and practice management system, secure workstations at the front desk and in exam rooms, e-prescribing (including controlled substances), fax, phones, a patient portal, check-in tools, a segmented network with backup internet, and HIPAA safeguards around all of it. The table below is the map for the rest of this guide.

Should your EHR be cloud-based, hosted, or on a local server?

For most small practices today, a cloud-based EHR is the simplest and most secure choice, as long as you add a backup internet connection. Hosted EHRs work well too, while running your own EHR server only makes sense if your vendor requires it and you have IT support to maintain it properly.

The three models in plain English

• Cloud EHR (software as a service): The vendor built the EHR as an online service. You sign in through a web browser or app. The vendor runs the servers, applies updates, and backs up the database.
• Hosted EHR: Traditional, server-based EHR software runs in a data center operated by the vendor or a hosting company. You usually connect through a remote desktop session. It removes your server but keeps some of the older software's quirks, like printer and scanner mapping through the remote session.
• On-premises (local server): The EHR database runs on a server in your office. You're responsible for the hardware, backups, security, and updates. It keeps working when the internet is down, but it's on you to keep it alive.

Questions to ask any EHR vendor about IT

1. What internet speed do you require, per workstation and per office?
2. Which browsers, operating systems and helper apps are supported?
3. What happens during an internet outage on our end? Is there an offline or read-only mode, or downtime reports we can print?
4. What's your uptime commitment, and how do you notify us of outages?
5. Do you support multi-factor sign-in, and can we require it for all users?
6. Will you sign a business associate agreement (BAA)?
7. How are backups done, how long are they kept, and how do we get a complete export of our data if we leave?
8. Is your e-prescribing module certified or audited for controlled substances (EPCS)?
9. Which scanners, signature pads, card readers and medical devices integrate, and how?
10. Which labs, imaging centers and health information exchanges do you connect to?

Certified health IT and information blocking

If you participate in federal programs, your EHR will typically need to be certified under the ASTP/ONC Health IT Certification Program. Separately, the 21st Century Cures Act's information blocking rules apply to healthcare providers: practices shouldn't knowingly and unreasonably interfere with patients' access to, or the exchange of, their electronic health information, except as allowed by specific exceptions (ASTP/ONC information blocking). Practically, that means your patient portal and records-release processes should make it easy for patients to get their information.

What computers work best in exam rooms?

Exam-room computers should be business-grade Windows 11 Pro machines that lock automatically when a provider steps out and unlock in seconds for the next person. Wall-mounted all-in-ones or small PCs on arms suit fixed rooms; laptops on carts suit providers who move between rooms.

Options compared

• Wall-mounted computer on an articulating arm. Saves counter space and lets the provider face the patient while typing. Make sure the arm can swing the screen away from the doorway.
• Small PC with a monitor on an arm. Easier to replace than an all-in-one; the PC can live in a cabinet.
• Provider laptop on a cart or carried room to room. One computer per provider, signed in once, with a docking station in their office. Needs strong device security because it moves.
• Thin clients (simple terminals that connect to a hosted desktop) can work with hosted EHRs, but add complexity for scanners and devices; most small practices are better served by managed PCs.

Specs that hold up

A business-grade PC with a current Core i5 / Ryzen 5 class processor, 16 GB of memory, a 512 GB SSD, wired gigabit networking, and Windows 11 Pro is a solid baseline. Windows 11 requires TPM 2.0, a security chip that protects encryption keys, and Secure Boot-capable firmware (Microsoft). Choose models with a three-year next-business-day on-site warranty, and standardize models so every room is set up the same way.

Fast sign-in without shared accounts

The biggest exam-room complaint is sign-in speed, and the biggest HIPAA problem is the shortcut people use to avoid it: a shared "Exam2" login that stays signed in all day. Better options:

• Individual accounts for everyone, so the EHR's audit trail shows who did what.
• Windows Hello for Business with a PIN or fingerprint, which is much faster than a long password and works as a strong sign-in method.
• Short automatic screen locks (a few minutes, shorter in busy hallways) with fast unlock.
• Single sign-on (SSO), where signing in to Windows or Microsoft 365 also signs you in to compatible apps, if your EHR supports it.
• Privacy filters on screens that face doorways or waiting areas.

Peripherals in clinical areas

• Wipeable keyboards and mice that survive disinfectant.
• Label printers for specimen labels, configured and tested with the EHR.
• Scanners for outside records and insurance cards at the front desk, scanning directly into the patient's chart.
• Medical devices such as EKG machines, spirometers and vitals monitors that send results to the EHR. These often run their own software, sometimes on older Windows versions; plan their network placement (see the network section) and confirm vendor support before upgrading the PCs they connect to.

How should e-prescribing and EPCS be set up?

Set up e-prescribing in your EHR for every prescriber, and complete the extra steps for controlled substances: identity proofing, two-factor authentication that meets DEA rules, and access controls approved by two people. In Florida, e-prescribing is required by state law with limited exceptions, and Medicare has its own controlled-substance e-prescribing requirement.

The rules, briefly

• Florida law. Section 456.42 of the Florida Statutes requires prescribing practitioners to generate and transmit prescriptions electronically, phased in upon license renewal or by July 1, 2021, whichever came first. Exceptions include the prescriber and dispenser being the same entity, a prescription that can't be sent under the current NCPDP SCRIPT standard, a department-issued waiver of up to one year, and situations where electronic transmission would cause an unreasonable delay for the patient. The Florida Board of Pharmacy's summary also notes that written prescriptions remain acceptable during temporary technological or electrical failures (Florida Board of Pharmacy; Fla. Stat. 456.42).
• Medicare Part D (CMS EPCS program). Under the SUPPORT Act, CMS expects prescribers to electronically prescribe at least 70% of Schedule II–V controlled substance prescriptions for Medicare Part D patients, after exceptions. Prescribers with 100 or fewer qualifying Part D controlled substance prescriptions in a year are exempt, and there are disaster and waiver exceptions (CMS EPCS program). CMS's 2026 materials describe non-compliance notices for the 2025 measurement year going out starting in September 2026, so check your status in the CMS EPCS Prescriber Portal.
• DEA rules for EPCS. The DEA permits, but doesn't itself mandate, electronic prescribing of controlled substances. When you do it, both the software and the process must meet its rules (DEA EPCS Q&A).

What the DEA requires for EPCS, in plain English

1. Certified or audited software. The e-prescribing application must have been audited by a qualified third party or certified by an approved certification body. Your EHR vendor can show you this.
2. Identity proofing. Each prescriber's identity is verified through an approved credential service provider, remotely or in person, before they receive their EPCS credential.
3. Two-factor authentication. Signing a controlled substance prescription requires two of three factors: something you know (a password or PIN), something you have (a hard token, a separate device such as a phone app or key fob, which must meet at least FIPS 140-2 Security Level 1), and something you are (a biometric such as a fingerprint, with its own technical requirements) (21 CFR 1311.115). The DEA's Q&A confirms a cell phone can serve as the hard token.
4. Logical access control by two people. One person determines which practitioners may sign controlled substance prescriptions, and a DEA registrant then uses their own two-factor credential to approve that access list (DEA EPCS Q&A).

IT tips for a smooth EPCS rollout

• Plan identity proofing early. It can take time, especially for new providers joining before opening day.
• Decide on the token. A phone authenticator app is convenient; a hardware key fob is a good backup for providers who can't or won't use their personal phone. Keep a documented process for a lost or replaced phone.
• Don't confuse EPCS two-factor with Microsoft 365 MFA. They're separate systems with separate rules. Your providers will likely have both. That's fine; just explain it.
• Remove access the day a provider leaves, and update the EPCS access list.
• Know your downtime procedure. During an internet or EHR outage, how will providers prescribe? Under Florida's rules, paper prescriptions are acceptable during temporary technology failures; keep secure prescription pads and a log, and reconcile in the EHR afterward. Our EHR downtime plan covers this.

Is faxing still OK, and should you switch to eFax?

Faxing patient information is allowed under HIPAA with reasonable safeguards, and it's still how much of healthcare exchanges referrals and records. Most practices benefit from an online fax (eFax) service that delivers faxes into the EHR or a secure inbox, provided the vendor signs a BAA and access is controlled.

What HHS says

HHS has stated that providers may share patient information for treatment purposes by phone, fax, email or otherwise, as long as they use reasonable safeguards. Its examples include confirming a fax number before sending to a number that isn't regularly used, and pre-programming frequently used numbers to avoid misdials (HHS FAQ).

Fax machine vs eFax

eFax setup checklist

1. Vendor signs a BAA. An online fax service stores and transmits patient information, so it's a business associate.
2. Route faxes to the right place: into the EHR's document queue or a shared inbox with named-user access, not a single shared password.
3. Multi-factor sign-in on the fax portal.
4. Cover sheets and confirmation for outbound faxes, plus pre-saved contacts for frequent recipients.
5. Port your existing fax number so referring offices don't need to update anything.
6. Retention: decide how long faxes stay in the fax system once they're filed in the chart.
7. Downtime fallback: if your eFax depends on internet, it rides on your backup internet line; consider whether you need a physical fax available for extended outages.

What phone system should a medical practice use?

A cloud phone system (VoIP) with call queues, an auto-attendant, after-hours routing, failover to cell phones, and integration with your EHR or practice management system fits most small practices. Get a BAA if it stores voicemails, recordings or texts with patient information, and make sure it meets federal 911 rules.

What to look for:

• Call queues and an auto-attendant ("press 1 for appointments, 2 for prescription refills, 3 for billing") that route calls to the right team.
• After-hours routing to your answering service or on-call provider, on a schedule that changes automatically.
• EHR/PM integration where available, so the caller's record pops up.
• Secure texting for appointment reminders and two-way messages, from your main number, with a BAA in place.
• Voicemail to email only if that email is protected (encryption, MFA), since voicemails often include patient details.
• Failover: if the office internet or power goes down, calls automatically ring to cell phones or another site.
• 911 compliance. FCC rules implementing Kari's Law require that multi-line phone systems allow dialing 911 directly without a prefix and notify a central location when 911 is called; rules under RAY BAUM'S Act require sending a "dispatchable location" (address, floor, suite) with 911 calls to the extent technically feasible (FCC, 2025).

Desk phones are usually powered over the network cable (PoE) from your switch. Put that switch on a battery backup (UPS) so phones survive power blips. Our network, Wi-Fi and phone guide goes deeper.

What about the patient portal and telehealth?

Your patient portal usually comes with your EHR; your job is to make it easy to use and secure. For telehealth, use a platform whose vendor signs a BAA, because the COVID-era HIPAA flexibility for everyday video apps has ended.

Patient portal

• Turn it on and promote it. Portals reduce phone calls for results, refills and forms.
• Make enrollment easy at check-in, with a text or email invitation.
• Use it for forms and payments before the visit to shorten check-in.
• Support patients who need help: a one-page guide at the front desk, and staff who know the common sign-in problems.
• Remember information blocking rules, which expect providers not to unreasonably interfere with patients' access to their electronic health information (ASTP/ONC).

Telehealth

During the COVID-19 public health emergency, HHS's Office for Civil Rights relaxed HIPAA enforcement for good-faith telehealth using common video apps. That notice expired with the emergency on May 11, 2023, followed by a transition period that ended on August 9, 2023 (HHS). Today, use a telehealth platform built for healthcare (often included in your EHR) or a business video platform covered by a BAA. HHS's HIPAA and telehealth page has current guidance, including for audio-only visits.

IT checklist for telehealth: good webcams and headsets for providers, a quiet room, wired internet for the provider's computer where possible, and a backup plan (phone call) if video fails.

How should check-in tablets and kiosks be set up?

Check-in tablets and kiosks handle patient information, so treat them like any other workstation: managed by IT, locked to the check-in app, encrypted, on a staff network segment, and wiped clean between uses. A tablet bought off the shelf and handed to patients is a risk.

Setup checklist:

1. Device management. Enroll tablets in your device management system (for example, Microsoft Intune), so IT can push the app, enforce a passcode, update the operating system and wipe the device if it goes missing.
2. Kiosk mode. Lock the device to the check-in app so patients can't browse, take photos, or open other apps.
3. No patient data stored on the device. The app should send everything to the EHR or check-in vendor and clear the session after each patient.
4. Physical security. Locking stands or enclosures; tablets accounted for at closing.
5. Network. Tablets on a dedicated staff or device network, not the patient guest Wi-Fi.
6. Cleaning. Wipeable cases and a cleaning routine between patients.
7. Accessibility. Offer staff assistance or a paper alternative for patients who can't use the tablet.
8. Payments. Card readers should come from your payment processor and be configured per its instructions; keep card data out of the EHR unless the integration is designed for it.
9. BAA with the check-in or intake software vendor.

How should a medical office network and Wi-Fi be set up?

Build a wired network with a business firewall, managed switches and separate network segments for staff, phones, medical devices and guests, plus a backup internet line that fails over automatically. Guest Wi-Fi should reach the internet and nothing else.

Separate networks are made with VLANs (virtual local area networks), which split one physical network into walled-off sections that your firewall controls.

Why medical devices get their own segment: many run embedded or older operating systems that the device vendor controls and updates slowly. Isolating them limits what an attacker could reach if one is compromised, and protects them from problems elsewhere on the network.

Internet and failover

With a cloud or hosted EHR, internet is as essential as electricity. Use a business-class primary connection, add a backup from a different provider (cellular LTE/5G is the most common for small offices), and let a dual-WAN firewall switch automatically. The federal government's 2025 SAFER Guide on contingency planning recommends that smaller ambulatory clinics have at least a cellphone-based wireless internet access point capable of running a cloud-hosted EHR as a backup to their main connection. We've seen what this does in practice: one of our dental clients now has zero downtime during internet outages after we added automatic cellular failover. Full details, including UPS sizing, phone failover and paper workflows, are in our EHR downtime and internet failover plan. Our internet bandwidth calculator helps size the primary line.

What does HIPAA require of a medical practice's IT?

HIPAA's Security Rule requires a documented risk analysis, safeguards matched to the risks you find, controlled access to patient data, protection of data in storage and in transit, a contingency plan, staff training, and business associate agreements with vendors that handle patient data. For a small practice, that translates into a concrete list.

ePHI (electronic protected health information) is any patient-identifiable health information stored or sent electronically: the chart, lab results, scanned referrals, appointment texts, voicemails, insurance information.

The practical HIPAA IT checklist for a medical office

1. Risk analysis, done and updated when you change systems or offices. It's required under 45 CFR 164.308(a)(1) (Cornell LII). See our risk assessment guide.
2. Individual accounts, role-based access in the EHR, and same-day removal when staff leave.
3. Multi-factor authentication for email, the EHR, remote access, and every cloud service that supports it. Our MFA guide explains the options.
4. Encryption on every computer (BitLocker), every laptop and tablet, and every backup.
5. Managed devices through Microsoft Intune or similar, enforcing encryption, updates, screen lock and remote wipe.
6. Endpoint detection and response (EDR), such as Microsoft Defender for Business, monitoring every computer for suspicious behavior.
7. Email protection and encryption. Microsoft 365 can be configured for HIPAA use, and Microsoft provides a HIPAA BAA for in-scope services (Microsoft Learn). See is Microsoft 365 HIPAA compliant? and our guide to HIPAA-compliant email encryption.
8. BAAs with your EHR, eFax, phone/texting, check-in, telehealth, backup and IT vendors. Our BAA guide lists who needs one.
9. Contingency plan: backups, disaster recovery and emergency-mode operations are required implementation specifications under 45 CFR 164.308(a)(7).
10. Training at hire and yearly, focused on phishing and on what to do if something looks wrong, plus a written breach response plan.

Ransomware and third-party outages

HHS's position is that when ransomware encrypts patient data, a breach is presumed unless the practice can demonstrate a low probability that the information was compromised (HHS ransomware fact sheet). Prevention and immutable backups protect you from both downtime and notification obligations; our ransomware protection guide has the full playbook.

You also depend on vendors' security. When Change Healthcare, a major claims clearinghouse and unit of UnitedHealth Group, was hit by a cyberattack in late February 2024, HHS acknowledged the impact on health care operations across the country, and CMS responded with steps that included expediting enrollment for providers that needed to change clearinghouses (HHS statement, March 2024). Practices that already knew how to switch clearinghouses or submit claims another way were in a better position. Include your key vendors in your contingency planning.

What about the proposed HIPAA Security Rule changes?

HHS's Office for Civil Rights proposed significant Security Rule updates in late December 2024 (published January 2025), including making encryption and multi-factor authentication required rather than addressable (HHS OCR). As of October 2026 it remains a proposal; the mid-2026 federal regulatory agenda projected final action for July 2027 (McDermott, July 2026). Check HHS for the latest status. Either way, MFA and encryption are worth doing now. Our HIPAA Security Rule checklist and free HIPAA security checklist tool help you check where you stand.

How should a medical practice handle backups and record retention?

If your EHR is in the cloud, the vendor backs up the database, but you still need to back up everything else (Microsoft 365, scanned documents, local files, device configurations) and know exactly what the vendor keeps. If you run a local server, backups are entirely your responsibility.

• Ask the EHR vendor what's backed up, how often, how long it's kept, and how you'd get your full data if you left.
• Back up Microsoft 365 (email, OneDrive, SharePoint, Teams) with a dedicated backup service.
• Follow 3-2-1: three copies, two types of storage, one offsite, with at least one immutable copy that can't be altered.
• Test restores quarterly.
• Retention. Florida's Board of Medicine requires physicians to keep patient records for at least five years from the last patient contact, and notes that longer retention may be advisable (Florida Board of Medicine). HIPAA separately requires keeping security documentation for six years. Confirm your retention policy with your attorney and malpractice carrier.

Our backup and disaster recovery guide covers the details.

How much does IT cost for a small medical practice?

Expect one-time costs for computers, network equipment and setup; monthly subscriptions for the EHR, Microsoft 365, phones, fax and security; and a monthly fee for IT support. Here are honest planning ranges, not survey averages.

Ways to keep costs predictable:

• Replace computers on a four- to five-year schedule, a few at a time. Our computer replacement planner builds the schedule.
• Standardize models and configurations, so setup is fast and support is consistent.
• Price the cost of downtime. An hour without the EHR, multiplied by providers and visits, usually dwarfs the cost of a backup internet line. Try our downtime cost calculator.
• Read our managed IT services cost guide to understand what support should include.

What's the IT checklist for opening a new medical office?

Start at least 90 days before opening, because internet installation, network cabling, phone number porting and EPCS identity proofing all take time. Use this timeline.

90+ days out

1. Confirm the EHR and get its technical requirements in writing.
2. Order business internet for the new address and ask which providers actually serve the building; test cellular signal for the backup line.
3. Send the floor plan to your IT provider before walls close. Mark exam rooms, nurse station, lab, provider offices, front desk, check-in area and network closet.
4. Design cabling: at least two network drops per exam room (computer and phone, plus a spare), drops for lab equipment and medical devices, ceiling drops for Wi-Fi access points, and drops for printers, TVs and cameras. Run Cat6 to a central closet.
5. Plan the closet: ventilation, a dedicated circuit, a lock, and room for the rack, firewall, switches and UPS.
6. Start EPCS identity proofing for any new prescribers.

60 days out

7. Order hardware: PCs, monitors, mounts, tablets, printers, scanners, firewall, switches, access points and UPS units.
8. Start number porting for phones and fax; porting can take weeks.
9. Set up Microsoft 365 and user accounts with MFA.
10. Collect BAAs from every vendor that touches patient data.
11. Plan medical device integrations with the device and EHR vendors.

30 days out

12. Cabling installed and tested; internet and backup line live; failover tested.
13. Network configured: VLANs, firewall rules, Wi-Fi coverage checked room by room.
14. Computers and tablets configured with encryption, endpoint protection, device management, the EHR and printers.
15. EPCS access controls set up and tested by each prescriber.
16. eFax and phones configured, including after-hours routing and failover to cell phones.

Opening week

17. Walk through a full patient visit in every exam room: check-in, vitals, charting, prescribing, a printed label, a fax, checkout.
18. Test phones: inbound, transfers, voicemail, after-hours, failover, and 911 per your provider's guidance.
19. Unplug the primary internet and confirm the EHR, phones and card processing keep working.
20. Train staff on sign-in, MFA, screen locks, phishing, and the downtime procedure.
21. Update your risk analysis for the new office.

What mistakes do we see most in medical office IT?

The same handful of problems show up again and again:

1. Cloud EHR, no backup internet. The most common and most avoidable outage.
2. Shared exam-room logins that stay signed in all day.
3. The fax machine in the hallway printing referrals where anyone can read them.
4. Personal phones and texting apps used for patient communication without a BAA.
5. Check-in tablets that aren't managed, still signed in to someone's personal account.
6. Medical devices on the same network as guest Wi-Fi.
7. No one knows the downtime procedure until the day it's needed.
8. Former employees' accounts left active in email, the EHR or the fax portal.
9. No backup for Microsoft 365, on the assumption Microsoft keeps everything forever.
10. EPCS tokens tied to one provider's phone with no plan for when that phone is lost.

Two example scenarios

These are illustrative examples of common situations, not specific clients.

Example 1: A three-provider family practice in Palm Coast moving to a cloud EHR

The practice runs an older EHR on a server in a closet. The server is aging and the EHR vendor is pushing customers to its cloud version. Before migrating, the practice adds a cellular backup line and dual-WAN firewall, replaces two exam-room PCs that can't run Windows 11, and sets up Windows Hello for Business so providers unlock their machines with a PIN or fingerprint. Each provider completes EPCS identity proofing and enrolls a phone authenticator, with a hardware token kept as a backup. Faxes move to an eFax service that drops documents into the EHR's queue. After go-live, the old server is retired following a verified final backup, and its drives are securely wiped.

Example 2: A specialist opening a satellite clinic in DeLand

A specialist adds a two-exam-room satellite office. Because the EHR is cloud-based, there's no server to build. The checklist centers on internet (fiber plus cellular backup), cabling, a small managed network with separate segments for staff, devices and guests, two managed laptops on carts, a check-in tablet in kiosk mode, desk phones on the main office's cloud phone system, and eFax on a new local number. The downtime plan is a copy of the main office's, adjusted for the satellite's contacts and printed downtime reports.

Questions to ask your IT provider

• Have you supported medical practices on our EHR?
• Will you coordinate directly with the EHR, phone and fax vendors when something breaks?
• How do you handle new hires and departures, including EHR and EPCS access?
• How do you manage updates on computers connected to medical devices?
• What do you monitor, and what happens when an alert fires after hours? (Ask whether that means staffed 24/7 support or automated monitoring with alerts; they're different, and an honest provider will be clear.)
• Will you sign a BAA?
• What documentation will you provide for our HIPAA risk analysis?

Our guide to choosing a managed IT provider has more.

The bottom line

Good medical office IT comes from a handful of deliberate choices: an EHR model that matches your internet reality, exam-room computers that are fast for providers and locked for everyone else, e-prescribing and EPCS set up correctly, fax and phones that protect patient information, managed check-in devices, a segmented network with backup internet, and HIPAA safeguards applied consistently.

When those are in place, technology stops being the reason patients wait.

If you're opening a new office, switching EHRs, or just want to know where your gaps are, book a free 20-minute call. We support medical practices across Ormond Beach, Daytona Beach, Port Orange, Palm Coast and DeLand, and remotely across the US. See our IT services for what's included.