Healthcare
Field note
“Most healthcare organizations I meet have done the compliance paperwork. What is often missing is the link between those documents and the systems that run the day. A risk assessment that names the EHR and skips the fax server, the imaging workstation under the front desk, or the billing vendor's remote access tool will not stop anyone. The constraint that settles a decision is usually one nobody wrote down. My first job in the seat is to find it, put an owner next to it, and hand the CEO a short list: fix this first, here is the cost, here is who approves it.”
Paul Christian, Fractional CIO
When the scheduling system locks up, patients wait in the lobby and a provider sees them without the chart. In a clinic, technology risk is patient risk. Owners of practice groups, specialty providers, and home health and senior care operators know this. Many still have no technology executive with the authority to act on it.
A fractional CIO for healthcare holds that seat on retainer and reports to the CEO. The seat owns HIPAA exposure, EHR and practice management contracts, vendor agreements, and the recovery plan. Your outsourced IT provider keeps the systems running. Somebody senior has to decide which ones matter most. Paul Christian, who leads this work, has held executive technology seats in healthcare.
Why practices call a fractional CIO for healthcare
"Our IT provider says we're fine. Our cyber insurer says we're not."
The renewal questionnaire asks about multi-factor authentication, offline backups, and the date of your last tested restore. The provider answers with ticket counts. We go through it line by line, separate what is true from what is assumed, run the restore, and give the CEO answers that can be signed honestly. A payer or hospital system questionnaire gets the same treatment.
"The EHR contract renews in four months, and I don't know what we'd lose by leaving."
Most practices know what they pay. Fewer know what the contract says about data export, interface fees, or the price at renewal. We list what the organization actually uses, read the terms, and recommend renewing, renegotiating, or replacing while every option is still open.
"If we got hit tonight, I couldn't tell you when we'd be back."
Ransomware and a vendor outage raise the same question. How long until clinicians can see schedules and charts, and who decides what happens in the meantime? We get you a number that has been tested, and a downtime procedure the front desk has practiced.
"We have a business associate agreement with every vendor. I couldn't tell you what most of them say."
Vendor lists drift. A billing company gets sold. Two providers start using an AI note-taking app on their own. We build one register of every vendor that touches protected health information, match it to signed agreements, and name an owner for each. If staff are already putting patient information into AI tools, that gets handled first.
"A hospital, a payer, and a patient app all want records electronically. We still answer with a fax."
Fax and manual exports are where exchange usually breaks. We trace one record request from arrival to delivery, find each manual step, and price the fix: portal configuration, an API the EHR already supports, or a network connection. The goal is a request process with an owner and a response time.
What is changing, and why it matters this year
Information blocking is an enforcement issue.
HHS has said so, and the rules apply directly to providers, with disincentives under Medicare programs. A records request answered by fax, with nobody owning the process, is exposure.
EHR certification just got rewritten.
HHS finalized the HTI-5 rule on October 26, 2026. Certification requirements shape what vendors build and sell, so read your renewal terms with that in mind.
The HIPAA Security Rule overhaul is late.
HHS proposed it in January 2025, and the federal agenda now points to no earlier than July 2027. The current rule still requires a risk analysis. The proposal shows where expectations are heading, so work done now is not wasted.
Clinicians are also adopting AI note-taking faster than policies get written. We put those tools through the same vendor, business associate, and risk process as everything else.
Start with the decision in front of you.
An insurer renewal, a payer questionnaire, or last month's incident: bring whichever one put the decision on your desk. A founding partner reads it and will say plainly whether a seat, an Assessment, or neither fits.
Contact us