Questions before you call

Yes. A Business Associate Agreement is included with every MedFortress™ engagement at no additional cost. It is part of your Quote, so there is nothing separate to sign.

HIPAA requires a BAA from any vendor that creates, receives, maintains, or transmits protected health information on a covered entity’s behalf. An IT provider serving a medical practice who will not sign one is a liability, not a vendor.

No IT provider can make a practice HIPAA compliant, and you should be skeptical of any that says otherwise. HIPAA covers administrative, physical, and technical safeguards, and only some of those belong to your IT vendor.

What we own is the technical safeguard set and the documentation that shows it is working. Your policies, workforce training records, and physical security stay yours. MedFortress™ is Vulpine Solutions’ own service package, not a government or industry certification. No such certification exists for IT providers.

MedFortress™ is SMB Complete plus the HIPAA compliance layer. The underlying platform is identical: same monitoring, patching, endpoint detection, backup, and response targets.

MedFortress™ adds the BAA, healthcare-specific access controls, an annual documented Security Risk Analysis, a maintained HIPAA policy set, workforce training attestation tracking, an annual disaster-recovery test, an annual IT Assessment and Security Review at no charge, and audit-ready compliance documentation. If your business does not handle protected health information, SMB Complete is the right package.

No. MedFortress™ standardizes on Microsoft 365, and Vulpine Solutions does not support Google Workspace for practices handling electronic protected health information.

Outside healthcare this is not a constraint: SMB Complete includes Microsoft 365 Business Premium or Google Workspace Business Plus, your choice, at the same price.

Yes. We support the environment your clinical and line-of-business software runs on, and we coordinate directly with your software vendor when something breaks rather than sending your staff into a third-party support queue.

We are not a reseller for any EHR and we do not require you to change platforms. If your vendor publishes infrastructure requirements, we build to them.

Yes. Managed services run for the term set in your Quote, usually 12 months, and renew automatically at the end of that term.

If you don't want to renew, either of us can give 30 days written notice before the renewal date. If neither of us does, the agreement renews for another term.

Your agreement runs for the term in your Quote. If you leave early, there is an early-termination fee: half of what's left on your monthly service, plus any onboarding discount you received, plus the rest of any licenses we bought for you on a term commitment.

If you take those licenses with you or keep paying for them monthly, you don't pay for them in the fee. If we don't hold up our end and don't fix it after you tell us, you can leave without the fee, though you still pay for any licenses. Your Quote can set different terms.

Monthly fees can increase once a year, on the anniversary of your agreement, by up to the greater of 7% or the rise in the Consumer Price Index. You get at least 60 days written notice, which leaves time to decide before your renewal date.

Separately, if a vendor raises what it charges us for a product you use, such as Microsoft licensing, that increase is passed through to you with as much notice as we can give.

Yes. We carry Technology Errors & Omissions insurance, including cyber liability coverage, in commercially reasonable amounts.

If you need a certificate of insurance for your own vendor review or compliance process, we'll provide one on request.

Most clients are fully transitioned within two weeks.

Longer timelines happen when an outgoing provider is running out a contract or an environment needs remediation before it can be managed safely. You are told which of those applies before onboarding starts, not after.

Vulpine Solutions is not the right choice if you already have a full in-house IT department, if you are shopping for the cheapest break-fix hourly rate, or if you want unmonitored personal devices on your network.

For HIPAA-regulated practices, running Google Workspace is also a disqualifier: MedFortress™ standardizes on Microsoft 365. Every client environment is expected to meet the published security baseline.

We respond within one business day to schedule a 30-minute discovery call.

On that call we walk through your current environment: network, security, backups, vendors, and whatever prompted you to reach out. If the assessment makes sense from there, we complete it and give you a written report with a prioritized list of what to fix first. You keep the findings whether or not you hire us.