// Glossary
The terms that come up most when we’re explaining a quote, a security finding, or why a HIPAA-regulated practice needs something an ordinary small business doesn’t. Look one up here before you have to ask on a call.
A Business Associate Agreement is the contract HIPAA requires between a medical or dental practice and any vendor that creates, receives, maintains, or transmits protected health information on the practice’s behalf. If an IT provider touches patient data and won’t sign one, that’s not a vendor worth working with. A signed BAA is included with every MedFortress™ engagement at no additional cost.
Multi-factor authentication means proving who you are with more than a password, usually a code or an approval tap on your phone. Conditional access is the policy layer that decides when to ask for it: block a sign-in from a country you don’t operate in, require MFA from a personal device, let a managed laptop on the office network through without extra friction. The two are normally deployed together, and enforcing both on administrative and remote access is part of Vulpine Solutions’ security baseline. A standalone MFA and conditional access rollout runs $850 ($650 for clients already on a managed plan).
Endpoint Detection and Response watches laptops, desktops, and servers for suspicious behavior instead of only matching known virus signatures. It’s what catches a process trying to encrypt files across the network, or a script hiding in memory that ordinary antivirus never sees. Managed endpoint protection like this is part of the security baseline Vulpine Solutions maintains across every environment it manages.
A HIPAA Security Risk Analysis is the risk assessment the HIPAA Security Rule requires every covered entity to perform and keep current, evaluating the risks to the confidentiality, integrity, and availability of the electronic patient information it creates or stores. It’s a compliance obligation that belongs to the practice, not something an IT vendor can complete or certify on its behalf. Vulpine Solutions’ own IT & Security Review is a different assessment, of a practice’s computers, network, and security posture; it’s useful groundwork, but it isn’t a substitute for the Security Risk Analysis a HIPAA-covered practice is required to run.
Identity Threat Detection and Response is the newer half of the detection stack: instead of watching devices, it watches accounts. It flags signs that a login or a set of credentials has been compromised: an impossible-travel sign-in, a sudden jump in privilege, or a mailbox that starts forwarding mail somewhere it shouldn’t. SMB Essential can add SIEM and identity monitoring; it’s included at no additional cost on SMB Complete and MedFortress™.
Break-fix IT is billed per incident: nothing happens until something breaks, and the provider only gets paid once it already has. Managed IT is a flat monthly rate that includes ongoing monitoring, patching, and support, so the provider does better financially by preventing a problem than by waiting for one. Vulpine Solutions operates as a managed IT and cybersecurity provider, not a break-fix vendor, and its pricing is built around that difference.
A SIEM pulls logs and security events from computers, servers, and cloud services into one place and flags the patterns that actually matter, so a real incident doesn’t get lost in normal noise. It’s closely related to ITDR: a SIEM watches the systems, ITDR watches the accounts logging into them. SMB Essential can add SIEM and identity monitoring; it’s included at no additional cost on SMB Complete and MedFortress™.
A vCIO is outside IT strategy leadership without the cost of a full-time hire: someone who reviews your technology spend, plans upgrades before they turn into emergencies, and sits across the table during budget season the way an in-house CIO would at a bigger company. SMB Complete and MedFortress™ both include quarterly technology planning; SMB Essential can add advisory work if a business needs it.
Still sorting out what you need
Tell us what you’re dealing with and we’ll tell you plainly which of this applies to your business.
