BCA outlines the HIPAA, ransomware, backup and support questions Spokane clinics and practices can use to evaluate an IT partner, as healthcare remains the costliest industry for data breaches.
SPOKANE, Wash. – BCA, an IT company in Spokane, has released a set of questions that medical clinics, dental offices, specialty practices and other healthcare organizations in the region can use when evaluating an IT provider. The guidance is aimed at practice managers and owners who rely on an outside provider for help desk support, cybersecurity and system uptime, and who want clearer answers about how patient data and electronic health record (EHR) systems are protected.
The questions come as healthcare data breaches continue at record levels nationally. BCA notes that many smaller practices in Spokane County operate without dedicated in-house IT staff, which places more of the responsibility for security, backups and compliance documentation on their outside provider.
Healthcare, IT and Cybersecurity by the Numbers
Recent federal and industry data show why these questions matter for practices of every size.
| Category | Statistic | Source |
|---|---|---|
| Healthcare | 772 large healthcare data breaches (500+ records each) reported to HHS in 2025, a record year | HIPAA Journal analysis of HHS Office for Civil Rights data |
| Healthcare | About 138.5 million individuals affected by those 2025 breaches | HIPAA Journal analysis of HHS Office for Civil Rights data |
| Cybersecurity | $6.64 million average cost of a healthcare data breach, the highest of any industry for the 13th consecutive year | IBM Cost of a Data Breach Report 2026 |
| Cybersecurity | 33% of ransomware attacks on healthcare providers began with an exploited vulnerability, the most common technical root cause | Sophos, The State of Ransomware in Healthcare 2025 |
| IT | 42% of healthcare ransomware victims cited a lack of people or capacity as a contributing factor | Sophos, The State of Ransomware in Healthcare 2025 |
| IT | 51% of healthcare providers hit by ransomware restored data from backups, down from 72% the year before | Sophos, The State of Ransomware in Healthcare 2025 |
“Most of the practices we talk to aren’t short on concern about security,” said Josh Smith, CEO of BCA. “What they’re often missing is a clear picture of what their IT provider actually does: how backups are tested, who reviews access, and what happens when the EHR goes down on a Tuesday morning. Asking the right questions up front makes those answers part of the agreement.”
Questions About HIPAA Safeguards and Documentation
BCA recommends that practices start with compliance responsibilities. Key questions include whether the provider will sign a business associate agreement, how access to patient data is granted and reviewed, whether multi-factor authentication and encryption are in place across email, EHR and remote access, and how long activity logs are retained.
Practices should also ask how the provider documents these technical safeguards for auditors and cyber insurers. BCA notes that an IT provider can implement and document technical controls, but HIPAA compliance also depends on a practice’s own policies and staff training.
Questions About Ransomware, Patching and Backups
With exploited vulnerabilities now the most common technical cause of healthcare ransomware attacks in Sophos’ research, BCA suggests asking how quickly security updates are applied to servers, workstations and network equipment, and how the provider tracks systems that can no longer be patched.
On backups, the key questions are how often backups run, whether at least one copy is encrypted and kept offline or offsite, and when a full restore was last tested. “A backup nobody has restored is an assumption,” Smith said. “We’d rather a practice ask to see the last test result than find out during an outage.”
Questions About EHR Uptime, Remote Access and Medical Devices
Healthcare offices depend on EHR and practice management systems throughout the day, so BCA advises asking what the provider’s plan is if those systems go down, who coordinates with the software vendor, and how quickly the practice can expect to be back up and running.
Practices that offer telehealth or allow staff to work remotely should ask how those connections are secured. BCA also recommends asking whether medical devices and older equipment are kept on a separate network from front-office systems, and how aging hardware is identified and replaced before it becomes a security or reliability problem.
Questions About Support, Response Times and Accountability
Staffing capacity is a recurring theme in healthcare security incidents. Practices should ask who monitors their systems after hours, what response times are written into the agreement, whether on-site support is available locally, and how often the provider reports on security and system health.
BCA – Spokane Managed IT Services Company, founded in 1989, provides help desk and on-site support, cybersecurity, cloud backup and phone services to organizations across Spokane County. Details on its healthcare IT support in Spokane, including HIPAA safeguards and EHR uptime, are available at https://bca-wa.com/managed-it-support-services-healthcare-spokane/.
More information about the company and its services is available at https://bca-wa.com/. BCA expects the questions to be most useful during contract renewals, cyber insurance applications and annual risk assessments, when practices are already reviewing how their technology is managed.
About BCA
BCA is a managed IT service provider serving businesses in Spokane. The company provides ongoing technology support while working closely with clients to identify recurring IT challenges, inefficient workflows, and opportunities to use technology more effectively. BCA’s approach combines technical support, on-site interaction, technology planning, and automation with the goal of helping businesses reduce unnecessary work and make better use of their technology investments.
Contact Information
Name: BCA – Managed IT Services Company Spokane
Contact: Josh Smith, CEO
Address: 1912 N Division St #101, Spokane, WA 99207
Phone: (509) 535-5571
Email: marketing@bca-wa.com
Website: bca-wa.com
Media gallery
