Not every health or social-services NonProfit is automatically required to comply with HIPAA simply because it works with health-related information or provides services to vulnerable populations. Whether HIPAA applies depends on the organization's role, the information it handles, and the circumstances in which that information is created, received, maintained, or transmitted.
When HIPAA does apply to some or all of an organization's activities, however, technology becomes an important part of protecting that information. For a NonProfit with 20–100 employees, leadership should pay particular attention to five areas: sensitive data, access, devices, employees, and incident response.
The objective isn't for an Executive Director or COO to become a HIPAA or cybersecurity expert. Leadership does, however, need enough visibility to understand where sensitive information exists, how it is protected, who is responsible for protecting it, and what happens when something goes wrong.
A good place to start is with three questions:
What information do we have? Why do we have it? What requirements apply to how we protect it?
First, Determine Whether HIPAA Applies to Your NonProfit
One of the first mistakes an organization can make is beginning with an assumption.
A NonProfit might assume that HIPAA doesn't apply because it isn't a hospital or medical practice. Another organization might make the opposite assumption and believe that because it provides health or social services, everything it does automatically falls under HIPAA.
Neither is a good foundation for a security strategy.
Instead, leadership can begin with a simple framework:
Information → Role → Requirements
Start by understanding the information your organization collects, receives, stores, or transmits. Then determine the role your organization plays when handling that information and which legal, contractual, insurance, funding, or other requirements apply.
Determining whether an organization is a HIPAA covered entity, business associate, or has other specific obligations is ultimately a compliance and legal question. Your legal or compliance advisors should provide guidance when the answer isn't clear.
Your technology team or IT provider has a different responsibility: once the applicable requirements are understood, it should help translate those requirements into appropriate technical safeguards and operational practices.
That distinction is important.
An IT provider shouldn't be your lawyer, and your lawyer shouldn't have to configure your cybersecurity tools.
Good risk management requires the appropriate people to handle both sides of the equation.
If HIPAA Applies, Start by Understanding Where Sensitive Information Lives
Many organizations still think about data security in terms of a server sitting inside an office.
The modern NonProfit technology environment is usually much broader than that.
Sensitive information may be stored or accessed through cloud applications, Microsoft 365, laptops, tablets, smartphones, line-of-business applications, email, remote-access systems, and other technology employees use throughout the workday.
For health and social-services organizations with employees working in the community, information can also travel far beyond the walls of the main office.
That means leadership needs a broader view of the environment.
A useful framework is:
Data → Device → User
First, what sensitive data does the organization have and where does it live?
Second, which devices and systems can access that information?
Third, which users need that access to perform their jobs?
This sounds simple, but it changes the cybersecurity conversation.
Instead of asking only, “Is our server secure?” leadership begins asking, “Where can our sensitive information be accessed from, and who can access it?”
That is a much more useful question in an environment where employees may work from multiple locations and use mobile technology to provide services.
Mobile Devices Can Improve Service Delivery—and Create a Different Kind of Risk
Mobile technology can be enormously valuable to a social-services organization.
An employee working in the field can document services without returning to an office, communicate more efficiently, and access information needed to serve a client. Those efficiencies can directly support the organization's mission.
But mobility changes the security environment.
A desktop computer generally stays in one location. A tablet or laptop might travel between an office, vehicle, residential program, community facility, employee's home, and client location in a single week.
Sooner or later, leadership should ask:
What happens if one of those devices disappears today?
Not hypothetically someday. Today.
Does the organization know which employee had it? Can access to organizational information be disabled? Can the device be remotely locked? Can organizational data be wiped when appropriate? Who should the employee notify? Who takes responsibility for the technical response?
Those questions should have answers before a device is lost or stolen.
This is where centralized device management can become particularly important. Rather than treating every laptop or tablet as an independent piece of equipment, the organization can manage devices as part of a larger security environment.
The technology should support employees in the field without requiring the organization to surrender visibility or control.
HIPAA Security Is About People as Well as Technology
It's tempting to think about cybersecurity primarily in terms of products: antivirus software, firewalls, email security, backup systems, and other technical tools.
Those controls matter, but employees interact with the organization's information every day.
A well-protected organization therefore needs to think about security as an ongoing process involving both technology and people.
One useful framework is:
Protect → Train → Monitor → Respond
Protect means putting appropriate safeguards around users, devices, applications, email, and information.
Train means helping employees understand the risks they are likely to encounter and what the organization expects them to do. A sophisticated security system can still be undermined by a convincing phishing message or an employee who doesn't know how quickly a lost device needs to be reported.
Monitor means maintaining visibility into the environment rather than installing security tools and simply assuming they continue to work as intended.
And Respond means having a plan for what happens when prevention fails.
Here's a practical test for leadership:
An employee reports a suspicious email or missing device at 4:00 PM today. What happens during the next 60 minutes?
Who receives the report? Who evaluates the situation? Who takes technical action? Who determines whether the incident needs to be escalated?
If nobody is sure, the organization may have an incident-response gap regardless of how much security software it owns.
For NonProfits that need additional cybersecurity expertise, I-M Technology's SecureIT Managed Cyber Security services focus on managing cybersecurity as an ongoing responsibility rather than treating security as a one-time technology purchase.
Leadership Needs Visibility Without Becoming the Cybersecurity Department
Executive Directors and other NonProfit leaders sometimes find themselves caught between two extremes.
On one side, they understandably don't want to become cybersecurity specialists. They have programs to manage, employees to lead, boards to work with, funding to secure, and communities to serve.
On the other side, cybersecurity risk can't simply disappear from leadership's responsibility because an IT provider has been hired.
The answer is visibility without unnecessary technical complexity.
One way to structure that conversation is:
Risk → Owner → Status → Next Action
Suppose mobile-device loss is an identified risk. Leadership shouldn't need to know every technical detail of the mobile-device management platform.
It should know who owns the risk from a technology perspective, whether appropriate controls are currently in place, whether there are unresolved issues, and what action needs to happen next.
The same approach can be applied to backups, employee access, phishing, endpoint protection, cloud systems, and other important areas.
This is also useful at the board level.
A board generally doesn't need a report filled with technical terminology. It needs enough information to understand the organization's significant risks, how those risks are being managed, and where additional decisions or investments may be necessary.
Good cybersecurity management should make those conversations clearer, not more complicated.
A Real Connecticut NonProfit Example: Securing Mobile Data for 60+ Direct Support Professionals
United Cerebral Palsy of Eastern Connecticut (UCP-EC) provides residential services, day programs, employment support, and community inclusion for individuals with intellectual and developmental disabilities.
As the organization grew, technology became increasingly important to its everyday operations. In particular, more than 60 Direct Support Professionals used mobile iPads to document care in real time.
That mobility helped employees do their jobs, but it also created technology and security responsibilities that had to be managed.
At the time, IT oversight was being handled internally by non-technical staff. Leadership time was being consumed by IT issues, device management and software updates were inconsistent, HIPAA compliance concerns were growing, and lost or stolen mobile devices presented additional risk. Leadership also lacked confidence that sensitive client information was being adequately protected.
I-M Technology worked with UCP-EC to implement a managed IT strategy focused on security, compliance, operational efficiency, and support.
Rather than requiring employees to manually manage dozens of devices individually, staff iPads could be centrally managed. Software and security updates could be deployed remotely, and lost or stolen devices could be remotely locked or fully wiped when necessary. The engagement also included structured HIPAA tools and training designed to reduce compliance complexity for leadership.
That combination matters.
Securing mobile technology shouldn't mean making that technology so difficult to use that employees can't efficiently serve clients. At the same time, operational convenience shouldn't come at the expense of protecting sensitive information.
The objective is to accomplish both.
According to the UCP-EC case study, the organization achieved stronger protection of sensitive client data, greater confidence around HIPAA compliance, more secure and efficient mobile documentation, less leadership time spent dealing with IT problems, and more attention available for programs, people, and mission delivery.
The lesson extends beyond tablets.
As NonProfits introduce technology into more areas of service delivery, cybersecurity needs to evolve alongside those operational changes.
HIPAA Compliance Isn't a One-Time Technology Project
Another common mistake is treating compliance as something that can be completed once and checked off permanently.
Organizations don't remain static.
Employees join and leave. Devices are purchased and retired. Applications change. Cloud services are introduced. Programs expand. Vendors change. Employees begin working in new locations. Cybersecurity threats evolve.
The security environment therefore needs to evolve as well.
A practical ongoing framework is:
Assess → Improve → Train → Review
Assess the current environment and identify meaningful gaps.
Improve safeguards based on actual risks and applicable requirements.
Train employees so they understand their responsibilities.
Then review the environment periodically because yesterday's assessment describes yesterday's organization.
This is why buying a cybersecurity product by itself doesn't make an organization HIPAA compliant.
Technology safeguards are important, but they exist within a larger compliance program that can include administrative, organizational, legal, physical, and technical responsibilities.
The goal of the IT function is to make sure the technology side of that program is being appropriately managed—not to pretend that technology alone solves the entire compliance question.
Five Questions Every Executive Director Should Be Able to Answer
An Executive Director doesn't need to understand the configuration of every security tool, but there are several questions leadership should be able to answer confidently.
Do we know whether HIPAA applies to our organization and activities?
If the answer is uncertain, start there. Get the appropriate legal or compliance guidance rather than designing a security program around assumptions.
Do we know where sensitive information can be accessed?
Think beyond the server. Consider cloud applications, email, laptops, tablets, phones, remote access, and other systems employees use.
Do we know what happens when a device containing or providing access to sensitive information is lost or stolen?
Leadership should understand whether access can be disabled and devices can be appropriately secured remotely.
Do employees know what to do when something suspicious happens?
An employee recognizing a phishing attempt isn't particularly useful if they don't know where or how quickly to report it.
Finally:
Can leadership clearly explain the organization's biggest technology and cybersecurity risks?
If several of these questions are difficult to answer, that isn't a reason to panic.
It's a reason to investigate.
The Goal Isn't “HIPAA Technology.” It's Managing Risk While Supporting the Mission.
For health and social-services NonProfits, technology exists to support people.
It helps employees communicate, document services, collaborate, work in the community, protect information, and keep programs operating.
Cybersecurity should support those activities rather than becoming disconnected from them.
The best technology strategy therefore isn't necessarily the one with the most security products. It's the one that understands where sensitive information exists, who needs it, how employees work, what risks the organization faces, and how those risks should be managed without interfering with service delivery.
For organizations subject to HIPAA, that technology strategy becomes one part of a broader compliance responsibility.
For organizations that aren't subject to HIPAA, many of the underlying questions remain valuable anyway. Sensitive client information still deserves appropriate protection. Lost devices still create risk. Employees still encounter phishing. Backups still need to work. Leadership still needs visibility.
That's why the conversation shouldn't begin and end with:
“Are we HIPAA compliant?”
A better executive-level question is:
“Do we understand the information we're responsible for protecting, and can we demonstrate that we're managing the technology risks around it?”
If your health or social-services NonProfit isn't confident in the answer, schedule a Discovery Call with I-M Technology. We can talk through your current technology environment, where devices and information may be creating risk, and what questions your leadership team should be asking next.
