Nexus
RMM · PSA

Compliance / HIPAA

HIPAA for MSPs

If any client handles protected health information, HIPAA's Security Rule reaches your MSP the moment you touch their systems — business associate agreement or not.

Why this reaches an MSP, not just the client

A dental office, a therapy practice, a small clinic — healthcare clients this size are common MSP business, and HIPAA doesn't have a small-practice exemption for the technical safeguards a vendor with system access is expected to support: access controls, audit logging, encryption in transit and at rest.

What the Nexus compliance module tracks

  • Technical safeguard posture — access control, audit controls, integrity, transmission security — tracked per client, not assumed
  • Every write action across the platform is audit-logged, which is itself part of the evidence a BAA conversation asks for
  • Encrypted secrets and per-tenant data isolation (PostgreSQL row-level security) are platform defaults, not a HIPAA-specific mode you have to remember to turn on
  • Gap reporting flags what's implemented versus still open, so a HIPAA conversation with a client starts from real posture, not a template checklist

This describes what the module tracks against HIPAA — not a claim that Nexus or any client on it is certified or audited against it. See the compliance & QBR module for the full picture, or read the blog for more on how we think about compliance tooling.

Other frameworks

SOC 2

The audit framework a lot of your clients' own customers require them to answer for — and that requirement flows straight down to you as their MSP.

NIST CSF

A widely-adopted, vendor-neutral structure for cybersecurity posture — Identify, Protect, Detect, Respond, Recover — that shows up in RFPs, cyber-insurance questionnaires, and board conversations alike.

PCI-DSS

Any client that takes card payments — a retail shop, a restaurant, a small e-commerce operation — answers to PCI-DSS, and their network security posture is frequently the MSP's responsibility to maintain.

Ready to see HIPAA posture tracked for real?

Join the design-partner cohort and we'll walk through the control mapping for your own clients.