A medical practice doesn’t get to reschedule its IT problems. The EHR that won’t load at 7:45 AM has a full waiting room attached to it. The question of internal IT versus a managed service provider is really a question about who answers during every hour patients are being seen, and how much depth stands behind that answer.
For most practices under about 50 people, the answer favors a managed provider with real healthcare experience, one that signs a business associate agreement and treats HIPAA documentation as part of the job. For larger groups with a good internal IT person already in the seat, the answer is usually not either-or. It’s co-managed: keep the person, add the depth.
Here’s the framework for working that out for your own practice.
The job you’re actually hiring for is four jobs
Write the internal IT job description for a medical practice honestly and it splits into four distinct roles.
Help desk. Providers, front desk, billing, clinical staff, all generating tickets at the pace of a clinic day. A login problem at check-in isn’t a ticket in a queue, it’s a line forming at the front desk.
HIPAA security. The Security Rule expects administrative, physical, and technical safeguards: risk assessments, access controls, encryption, audit logging, and a documented program you could hand to an auditor or a breach investigator. Cyber insurers ask for much of the same evidence. This is a specialty, and it’s the part of the job that quietly stops happening when the same person is also unjamming the exam-room printer. Our guide to HIPAA IT requirements for medical practices walks through what the documentation actually looks like.
The EHR environment. Not the EHR itself, the environment it depends on: the servers or hosted platform, the workstations in every exam room, the network between them, and the backups underneath all of it. When something inside the application breaks, the job is coordinating with the EHR vendor and owning the problem until it’s resolved, not claiming certified expertise inside the software.
Network and infrastructure. Wireless that reaches every exam room, connections to labs and imaging, phones, the second location the group is opening next year.
Each of those roles generates work every single week. When they collide, and in a clinic they collide daily, the urgent beats the important. The password reset happens now. The risk assessment, the backup test, and the audit-log review happen “when things calm down.” In a practice seeing patients five or six days a week, things do not calm down.
That’s not a knock on whoever sits in the seat. It’s arithmetic about the seat.
Coverage hours versus clinic hours
Here’s a comparison most practices never run on paper. Take your clinic hours, early starts, evening clinics, Saturday hours if you have them, and lay them against the hours one employee actually works after PTO, sick days, training, and lunch. The clinic is open more hours than any one person can cover, every single week, before you count a single vacation.
Whatever falls outside that overlap is uncovered time, and uncovered time in a medical practice isn’t abstract. It’s the Monday 7 AM EHR problem before your IT person arrives, the Saturday clinic with no support at all, and the overnight backup failure nobody sees until the day it matters.
A managed provider answers regardless of which individual is available, and most issues are resolved remotely within minutes, typically without anyone driving anywhere. The comparison isn’t one competent person against a faceless help desk. It’s one calendar against a bench.
Continuity: the risk nobody prices in
The quiet failure mode of the single-hire model isn’t a bad hire. It’s a good hire who leaves.
When one person has run the practice’s IT for years, they carry the map in their head: which vendor to call for the lab interface, where the backup actually lands, why the second wireless network exists, what the last risk assessment found. When they resign, retire, or take a better offer, the practice loses the map and the coverage on the same day, and then starts a search measured in months while the environment runs on autopilot.
A provider’s knowledge doesn’t work that way. Documentation, credentials, configurations, and history live in shared systems, so any engineer who picks up your ticket is working from the same map. Practices don’t think about this until the week it happens to them, and by then it’s the most expensive line on this whole comparison.
When an internal hire genuinely makes sense
An honest framework includes the other side. Internal IT earns its keep when:
- The group is large enough, usually past 50 people or spread across several locations, that there’s a full week of the right work every week
- Daily physical presence matters: heavy on-site equipment, frequent hands-on needs, clinical devices that want a person in the building
- Institutional knowledge is the point: someone who knows the providers, the workflows, and years of accumulated quirks in how the practice actually runs
Notice what’s on that list. Presence and familiarity are real advantages of a hire. HIPAA depth, full-week coverage, and continuity are not, because no single human can supply those alone. Which is why groups that reach the size where internal IT makes sense usually shouldn’t frame it as internal instead of a provider. The better structure is both.
The co-managed middle path for larger groups
Co-managed IT keeps your internal person as the owner of the environment and puts a provider behind them for everything one seat can’t hold. Your person keeps the day to day priorities, the relationships with providers and staff, and first call on anything local. The provider adds:
- Help desk overflow when the queue spikes, and coverage for vacations, sick days, and after hours
- Security tooling, monitoring, and the HIPAA documentation workload
- Escalation depth for hard server and network problems
- Project capacity for EHR migrations, new locations, and infrastructure refreshes
The practice stops betting its continuity on one person’s calendar, and the person in the seat stops drowning in password resets. For a growing group it’s also the scaling path: instead of hiring a second and third IT employee as locations are added, the internal person stays the owner and the provider scales behind them.
How an administrator should compare the cost
Without quoting anyone’s salary, the structure of the comparison stands on its own. An internal hire is a fixed full-time cost that buys one person’s hours and one person’s skill set, with security, monitoring, and backup tooling licensed separately on top. A managed agreement is a variable cost that tracks the environment you actually run, tooling included.
Braintek publishes its numbers: $150 to $250 per device per month plus $15 to $35 per staff mailbox, shared mailboxes free, Microsoft licensing billed separately. Medical practices tend to run more devices per employee than most businesses, exam-room workstations, front-desk machines, provider laptops, so counting your actual devices matters. We’ve worked the math through for real practice shapes in how much managed IT costs for a medical practice.
Then run the comparison that actually decides it: for each model, who answers at 7:45 AM when the EHR won’t load, who answers during Saturday clinic, and who answers during the two weeks a year your IT resource is on vacation? Price the model that covers all three.
Five questions that settle it for your practice
- List the systems your practice cannot see patients without. EHR, practice management, email, imaging or lab connections, backups. For each, could at least two people support it tomorrow morning? Every “no” is a single point of failure you’re currently accepting.
- Map your clinic hours against your IT coverage hours. Every uncovered hour is a bet that nothing breaks then.
- Pull your last HIPAA risk assessment. If you can’t find one, or it’s more than a year old, that gap decides more than this article does. A HIPAA security risk assessment is the fastest way to see where you actually stand.
- Ask what happened the last time something broke after hours. If the answer involves one person’s cell phone and some luck, that’s your continuity plan.
- If you have an internal IT person, ask what they’d do with ten reclaimed hours a week. If the answer is valuable, that’s the co-managed case in one sentence.
So which model fits?
- No internal IT, roughly 10 to 50 people: fully managed. One provider under a signed BAA, one predictable monthly number, HIPAA documentation handled, no single point of failure. Our medical practices page covers what that looks like for an independent practice.
- A good internal IT person, or a larger multi-location group: co-managed. Keep the person and the institutional knowledge, add the depth and coverage one seat can’t hold.
- In between and unsure: start with an assessment rather than a guess, and if you go the provider route, vet them like it matters. Our guide to choosing an MSP for a medical practice lists the questions worth asking, BAA first.
Braintek has supported Texas businesses since 2002, with local teams in Houston and DFW, and most issues are resolved remotely within minutes. If you want a no-pressure read on which model fits your practice, use the form below.