Your IT company probably installed a small program on every computer in your practice so its technicians can fix problems remotely. It runs with administrator rights and takes orders from a management console you’ve likely never seen.
That convenience is why attackers want it: whoever gets into that console can reach every computer it manages, so MSP remote access security is your practice’s security.
What’s actually happening in 2026
Attackers can get into a medical practice through its IT company’s remote access software: if they compromise that tool, they inherit its administrator access to every computer it manages. In June 2025, CISA warned that ransomware actors had been exploiting unpatched SimpleHelp remote monitoring and management (RMM) software since January 2025, including in an attack on customers of a utility billing software provider.
RMM software is the tool an IT provider uses to monitor and control your computers remotely.
The main flaw, CVE-2024-57727, affects SimpleHelp 5.5.7 and earlier and entered CISA’s Known Exploited Vulnerabilities (KEV) catalog on February 13, 2025; two related SimpleHelp flaws followed in April 2026. Fixes have existed since January 2025; the victims were running unpatched copies. In May 2025, Sophos reported attackers using a managed service provider’s own SimpleHelp tool to deploy ransomware and steal data from its customers.
SimpleHelp isn’t unique: the KEV catalog added exploited flaws in several other remote support and RMM products in 2025 and 2026. Verizon’s 2026 Data Breach Investigations Report found third parties involved in 32% of healthcare breaches.
Why this is a HIPAA problem, not just an IT problem
An IT company that manages or maintains systems holding patient records generally fits HIPAA’s definition of a business associate (45 CFR 160.103). That calls for a written business associate agreement, or BAA (45 CFR 164.502(e)), committing it to Security Rule safeguards, to reporting security incidents and to returning or destroying PHI when the contract ends, where feasible (45 CFR 164.314(a), 164.504(e)).
A BAA doesn’t hand off your own duties. HIPAA requires an accurate and thorough risk analysis and regular review of activity records such as audit logs (45 CFR 164.308(a)(1)(ii)(A) and (D)). CISA’s advice to MSP customers makes the same point: “Conduct a risk analysis for RMM software on the network.”
A January 2025 HHS proposal would require multifactor authentication (MFA) and yearly written verification of business associates’ safeguards, but it’s still only a proposal: HHS’s regulatory agenda targets final action for July 2027.
What to actually do about it
CISA’s next step for customers: if RMM is required, “ask third-party vendors what security controls are in place.” Put your IT provider in your HIPAA risk assessment, confirm the BAA is signed, then ask five questions.
- Ask which remote tools are installed and who can log in: CISA told customers to check for SimpleHelp even inside other vendors’ software, and a tool or technician account nobody listed can’t be assessed.
- Ask whether MFA is required on the management console: a stolen password alone shouldn’t open every PC, yet across industries Verizon found only 23% of third-party organizations fully fixed missing or improperly secured MFA on their cloud accounts.
- Ask how fast the provider patches its own tools: across industries, Verizon found only 26% of KEV-listed critical flaws fully fixed in 2025, with a median 43 days to a full fix.
- Ask whether unattended sessions are logged and shared with you: HIPAA requires regular review of activity records, and a 2 a.m. session nobody requested should show up there.
- Ask how access is removed if you part ways: an agent left behind is a door nobody watches, so get removal steps and the BAA’s return-or-destroy terms in writing.
Where ACS fits in
ACS’s free 30-minute IT & HIPAA assessment checks which remote access tools are on your computers and whether your IT provider has signed a BAA; our HIPAA compliance services include that review. Comparing providers? ACS signs BAAs with healthcare clients and works under SOC 2-aligned controls; see our managed IT services for medical practices.
