HIPAA Managed Network
When an auditor asks who can reach patient data on your network, you need a written answer. We start with a HIPAA Network Risk Assessment, contracted directly with the practice: a design that separates patient-data systems from everything else, a findings list, and the evidence your risk analysis needs for the network. From $3,500 for a single small site. Ongoing management of the firewall, switches and Wi-Fi then runs through your MSP at $1,795 per site per month: your MSP stays your contracting provider and help desk, and the network gets a senior engineer. Need the design and build first? See HIPAA compliant network engineering. Sacramento and the Bay Area. Last reviewed October 21, 2026.
What HIPAA Asks of the Network
The HIPAA Security Rule (45 CFR 164.312) names five technical safeguards: the rules for protecting electronic patient data (ePHI). Four of them land on the firewall (the box between your office and the internet), the switches (what everything plugs into) and the Wi-Fi. This is what each one means when the auditor is at your desk. In plain terms: a guest phone on your Wi-Fi should not be able to reach the imaging workstation, changes to the firewall should be on record, and you should be able to show both when asked.
| Safeguard (45 CFR 164.312) | What the auditor asks | What a managed network delivers |
|---|---|---|
| Access control (a) | Who can reach systems holding ePHI, and how is that enforced? | Segmentation: separate network lanes (VLANs) for clinical devices, office PCs, guest Wi-Fi and building systems, with firewall rules between them so traffic crosses between lanes only where a rule allows it; a named login on every device; remote staff reach only the apps they need (ZTNA) |
| Audit controls (b) | Can you show who accessed what, and when? | Firewall and VPN logs retained per your policy; quarterly access and policy reviews with written findings |
| Integrity (c) | How do you know configurations have not been altered? | Every device’s settings saved before and after each change, so any change can be shown line by line and undone; a change record naming who approved it |
| Transmission security (e) | Is ePHI encrypted in transit across the network? | Encrypted tunnels between offices (IPsec), inspection rules for encrypted traffic, staff Wi-Fi that asks each person for their own login (WPA2- or WPA3-Enterprise), and no shared Wi-Fi password on any network that carries patient data |
Person or entity authentication (d) is mostly an identity-provider control; we integrate the network with it (SAML, MFA) but do not run it. We are not auditors and do not certify compliance; we operate the network so the network portion of your risk analysis has evidence behind it.
The Plan
Priced at $1,795 per site per month and delivered through your MSP under their agreement with you. The plan includes automated monitoring and human response Mon–Fri, 8 AM–5 PM Pacific (see network monitoring). Two hours of standard changes a month are included; further work is $225 per hour with a 30-minute minimum. The assessment that comes first is priced on the assessment pricing page. This is what Compliance adds on top.
HIPAA network segmentation, written down: a VLAN and firewall-policy design separating clinical devices, workstations, guest Wi-Fi, printers and building systems. Delivered as a diagram and a policy table an auditor can read.
Every firewall rule, NAT and VPN tunnel reviewed each quarter: still used, still justified, owner named. Orphaned rules removed with a change record. Findings in writing.
We recommend what to keep and for how long, and configure the firewall to send logs where you keep them. Log storage and any security-monitoring platform (SIEM) are scoped separately, so you are not paying for a round-the-clock security desk (SOC) you did not ask for.
Configuration history, change records, review reports and the network diagram, ready to hand over when your risk analysis, your cyber insurer or the HHS Office for Civil Rights (OCR, the office that enforces HIPAA) asks.
Who This Fits
Three patterns we see in Sacramento and the Bay Area. If yours is different, the assessment will say so.
One to five locations, an EHR in the cloud, imaging or lab devices on the office network, a billing company with VPN access. HIPAA compliant connectivity for an outpatient clinic means each of those reaches only what it should; the risk is a flat network where a guest laptop can reach an imaging workstation. Fix: segmentation plus policy reviews, starting with a Network Risk Assessment.
Multi-site with a managed general-IT provider and no one owning the network. We take the network layer only and coordinate with the IT provider (co-managed: your IT provider stays in charge, we run the network alongside them), so the practice does not change help desks.
SOC 2 and HIPAA overlap; the office network is in scope even when the product runs in the cloud. We provide the office-network controls and evidence for both frameworks and stay out of the product environment.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Pre-staging and configuration happen remotely; cutover is on site or remote-hands guided, your choice. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Replacing a non-Fortinet firewall? See firewall migration. Want it watched afterward? See network monitoring.
FAQ
There is no certification for a HIPAA compliant network. The Security Rule requires technical safeguards: access control, audit controls, integrity, authentication and transmission security. A network meets them when systems holding ePHI are segmented and reachable only by authorized users, access is logged and reviewed, configurations are controlled and backed up, and traffic carrying ePHI is encrypted in transit. That is what a managed network has to deliver and prove.
It starts with a HIPAA Network Risk Assessment, delivered direct to the practice: segmentation design, findings list and the evidence map for the network portion of your risk analysis. Ongoing management, coordinated with your IT provider, runs on our Compliance plan: automated monitoring of the firewall, switches and Wi-Fi; configuration backup with every change recorded; documented segmentation; quarterly firewall policy, VPN and access reviews with written findings; log retention recommendations and configuration; and two hours a month of standard changes. Priority same-business-day response Mon–Fri, 8 AM–5 PM Pacific; outside those hours monitoring and alerts keep running, and emergency work is billed at the after-hours emergency rate when an authorized contact asks.
No. The risk analysis is yours or your compliance consultant's, and auditors audit. We operate the network so that the network-controls portion of that analysis has current evidence: diagrams, policy tables, change records and review reports.
The Network Risk Assessment is $3,500 for a single clinic site (one firewall, up to three switch groups, 100 connected devices and 6 access points), contracted directly with the practice, and produces the segmentation design and findings list. Mapping those findings to HIPAA Security Rule controls for your auditor is a $2,500 add-on; multi-clinic groups are priced by size on our assessment pricing page. Ongoing management is $1,795 per site per month for Edge Compliance, arranged through your MSP. Human response is Mon–Fri, 8 AM–5 PM Pacific; after-hours emergency work bills hourly when an authorized contact asks. Hardware, if a firewall replacement is needed, is quoted by exact part number; see Fortinet reseller.
No, and for practices that is the model. The assessment comes direct from us. Ongoing network management runs through your MSP: they stay your contracting provider and help desk, we do the network layer under their agreement, and the division of responsibility is documented so the risk analysis shows who owns what. Assessments can be contracted directly; recurring management for medical customers is contracted through an MSP.
Rarely more than one after-hours window. We build the VLANs and policies alongside the existing flat network, move device groups in a scheduled order, and keep rollback available until the last group is confirmed.
Vendor and remote-provider access moves from one shared VPN login to ZTNA (remote access that checks who the person is and what device they are on for every app, instead of handing over the whole network) or a per-vendor encrypted tunnel, with a named account and a second login check (MFA) through your identity provider, so each party reaches only the application they need. See the VPN-to-ZTNA guide for the method; as a standalone project, the ZTNA move is quoted after a short review of your users, rules and applications.
Sacramento and the surrounding cities on site; the San Francisco Bay Area and San Jose on site by arrangement; the rest of California remotely with on-site visits for cutovers.
Sources
Last reviewed October 21, 2026. Vendor documents and prices change; confirm against the linked pages before you decide.
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Other vendor names are trademarks of their respective owners, used to identify the products discussed. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by any vendor named here.
HIPAA Network Risk Assessment
Send the number of locations, your EHR and imaging or lab systems, who has remote access today, and the name of your IT provider if you have one. We return an assessment scope, a segmentation outline, and how ongoing management would run with your provider. The report, segmentation design and 30-60-90 plan are yours to keep. $3,500 for a single small site, with HIPAA control mapping a $2,500 add-on; larger networks are priced on the assessment pricing page. See a sample report (PDF).
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
