Yes. As a managed IT provider with access to systems that may contain PHI, Pantheon signs a Business Associate Agreement with healthcare clients. A BAA is required under HIPAA and establishes each party’s responsibilities for protecting patient information.

Pantheon implements access controls (unique user IDs, automatic logoff, encryption), audit controls (hardware, software, and procedural mechanisms to record and examine activity), integrity controls (protecting PHI from improper alteration or destruction), and transmission security (encrypting PHI sent over electronic networks).

Yes. Pantheon supports the IT infrastructure and endpoint environment that EHR systems run on — including patching, access control, backup, and network security. We work alongside your EHR vendor to ensure the surrounding environment meets HIPAA technical safeguard requirements.

Pantheon supports the infrastructure environment for all major EHR platforms including Epic, Cerner, Athenahealth, eClinicalWorks, NextGen, and others. We manage the workstations, servers, network, and security layer that EHR systems depend on.

Yes. The HIPAA Security Rule requires covered entities to conduct regular security risk assessments to identify vulnerabilities in systems that handle PHI. Pantheon supports this process by documenting your technical environment, identifying risks, and developing a remediation plan.

Healthcare organizations are among the most targeted sectors for ransomware. Pantheon’s layered approach — endpoint protection, email filtering, DNS filtering, MFA, and tested immutable backups — creates multiple barriers against ransomware. Tested backups allow recovery without paying a ransom if ransomware does execute.

Pantheon manages new employee onboarding including account creation, EHR access provisioning per your approved access levels, device setup, and permission assignment. For departing employees, Pantheon executes offboarding workflows that disable access, apply email retention per your policy, and reclaim licenses — preventing the access exposure that is a common HIPAA audit finding.

Pantheon activates its incident response plan: containment, investigation, notification support, and remediation documentation. HIPAA requires breach notification within 60 days of discovery. Pantheon helps identify the scope quickly and documents response actions for regulatory purposes.