With final changes to the HIPAA Security Rule now pushed to July 2027 and healthcare still carrying the highest breach costs of any industry, the Manhattan IT provider is encouraging practices to strengthen their safeguards now.
NEW YORK – Manhattan Managed IT Services, a managed IT services provider in Manhattan, is encouraging healthcare organizations across the borough to keep improving their cybersecurity and HIPAA safeguards now rather than waiting for federal regulators to finalize changes to the HIPAA Security Rule. The company, also known as MMITS, provides managed IT support, cybersecurity and technology planning for medical practices and other healthcare organizations that handle protected health information (PHI).
The guidance comes as healthcare leaders weigh two developments that pull in different directions: a delayed federal timeline for new cybersecurity requirements, and continued evidence that breaches in healthcare cost more than in any other industry.
A Delayed Rule Does Not Pause Current Obligations
In late December 2024, the U.S. Department of Health and Human Services (HHS) announced a proposed overhaul of the HIPAA Security Rule aimed at strengthening protections for electronic protected health information (ePHI). The proposal would require regulated organizations to adopt specific technical measures such as encryption, multifactor authentication and network segmentation, along with annual penetration testing, more detailed risk analyses and written incident response plans that are tested at least once a year.
Final action on that rule has since slipped. Fierce Healthcare reported that the federal regulatory agenda now lists July 2027 for the final rule, a year later than the May 2026 target HHS had previously set. Hospital and provider groups had pushed back on the proposal, citing compliance costs and implementation timelines.
The delay does not change what is already required. The current Security Rule remains in effect and continues to require covered entities and applicable business associates to maintain administrative, physical and technical safeguards for ePHI and to conduct an accurate and thorough risk analysis. MMITS notes that many of the controls in the proposed rule, including multifactor authentication, encryption, tested backups and documented incident response, are already widely regarded as baseline protections for any organization that handles sensitive data.
Healthcare Still Faces the Highest Breach Costs
The financial case for acting early remains strong. According to IBM’s 2026 Cost of a Data Breach Report, as summarized by HIPAA Journal, healthcare breaches cost an average of $6.64 million per incident. That figure is down 10.5% from $7.42 million a year earlier, but healthcare still recorded the highest average breach cost of any industry. Across all industries, the global average rose to nearly $5 million, while the average for U.S. organizations reached $11.5 million.
For Manhattan practices, the risk is not only financial. Scheduling, electronic health records, billing, imaging and patient communications all depend on systems that must stay available. When a workstation fails, a cloud application goes offline or ransomware locks files, the disruption can delay care and interrupt revenue at the same time.
Common Gaps in Smaller Healthcare Organizations
According to MMITS, healthcare organizations typically have more complicated IT requirements than similarly sized businesses in other industries, because clinical operations must stay available while sensitive information stays protected. Smaller practices often operate without a dedicated CIO, security officer or internal IT department, leaving clinical and administrative leaders to manage technology decisions alongside patient care.
Responsibility is also frequently split across several vendors, with one company handling the network, another supporting the electronic health record and others managing phones, backups, security or Microsoft 365. When something goes wrong, staff can end up coordinating between providers instead of focusing on patients. MMITS also points to HHS warnings that legacy systems without current vendor support can introduce cybersecurity vulnerabilities, making an accurate technology inventory an important part of protecting ePHI.
One Partner for Support, Security and Compliance Readiness
MMITS addresses those gaps through a managed service model that combines day-to-day IT support with cybersecurity, technology lifecycle management and strategic planning. For healthcare clients, the company structures its approach around HIPAA requirements, including signing Business Associate Agreements and configuring technical safeguards for systems that store or access PHI.
Its healthcare services include endpoint monitoring and management through Ninja RMM, endpoint detection and response through SentinelOne, cloud security monitoring through Blue Mirror, and point-in-time backup for Microsoft 365 and Google Workspace through DropSuite. Clients can also receive security awareness training with simulated attacks, help with technical HIPAA readiness and security documentation, and quarterly vCIO meetings covering budgeting, lifecycle planning and security questionnaires.
The company reports that support tickets typically receive an initial response within 10 minutes and are often resolved in about 30 minutes. MMITS does not act as a compliance auditor; its role is to help healthcare organizations build and maintain the technology foundation needed to operate securely and prepare for compliance requirements. A full overview of the company’s managed IT support for healthcare organizations in Manhattan is available at https://manhattanmanageditservices.com/managed-it-support-for-healthcare-organizations-in-manhattan/.
Published Pricing on Month-to-Month Terms
MMITS publishes its pricing so that prospective clients can get a general idea of cost before going through a sales process. Its standard managed IT service is $150 per seat per month with a $1,000 monthly minimum and includes business-hours IT support, technology lifecycle management, SentinelOne EDR, quarterly vCIO meetings and on-demand strategic guidance. Microsoft, Google, Adobe, hardware and certain third-party licenses are purchased separately, and new clients pay a one-time onboarding fee equal to their first month’s service charges. Agreements are month-to-month rather than long-term contracts.
For smaller organizations that are not ready for full managed IT support, the company offers Security Essentials starting at $39 per seat per month, covering SentinelOne EDR, Ninja RMM and device lifecycle monitoring, with technical support available at an hourly rate.
With the final Security Rule still more than a year away, the months ahead give Manhattan healthcare organizations time to revisit their risk analyses, close gaps in authentication and backup, and establish clearer ownership of their technology before new federal requirements take effect.
About Manhattan Managed IT Services
Manhattan Managed IT Services (MMITS), a Cetusdata company, is a managed IT services provider serving businesses in Manhattan. The company provides IT support, managed cybersecurity, IT consulting and technology planning through a high-touch service model that combines day-to-day support with technology lifecycle management and quarterly vCIO guidance. MMITS works with organizations in industries with demanding security and uptime requirements, including healthcare, legal and accounting.
Contact Information
Manhattan Managed IT Services
1140 6th Ave FL 9 Suite 1052B
New York, NY 10036
Phone: +1 (646) 328-6307
Website: manhattanmanageditservices.com
Media gallery
