“Will you make us compliant?” We get asked this in almost every first conversation with a regulated business, and the honest answer is the one no sales pitch wants to give: no IT company can make you compliant, and you should be wary of any that says it can. What a good IT partner can do is real and valuable. It’s just not the same thing as taking compliance off your hands. Let’s explain where the line actually sits, because understanding it protects you.
Compliance is something a business holds, not something it buys
Whether the framework is HIPAA, the FTC Safeguards Rule, or CMMC, the regulation names the business as the responsible party. HIPAA holds the covered entity accountable. The FTC Safeguards Rule names the financial institution. CMMC requirements flow down to the defense contractor. None of these rules let you transfer that accountability to a vendor by signing a contract.
That means compliance is a state your organization is in, made up of policies people follow, decisions leadership makes, training staff completes, and controls that are actually running. An IT provider can build and operate a big chunk of those controls. It cannot decide your policies for you, cannot make your staff follow them, and cannot stand in your place if a regulator comes asking. When the auditor or insurer shows up, they sit down with you.
What your IT partner genuinely owns
This is not a story about IT providers doing less than you hoped. A capable partner carries a heavy share of the technical load, and that share is substantial.
We configure and maintain the technical safeguards: encryption on devices and in transit, unique logins and access controls, multi-factor authentication, patching, endpoint protection, and audit logging. We run backups and test that they actually restore. We monitor your environment and respond when something looks wrong. And we produce the evidence, the reports and logs that show a control was in place and working on a given date, which is what you hand an auditor or an insurer. We cover what that evidence should look like in the compliance reports your IT provider should give you.
When we handle protected or regulated data on your behalf, we also sign the agreement that makes our obligations legally binding, a Business Associate Agreement for HIPAA, or the equivalent flow-down language for CMMC. That is non-negotiable, and any provider who hesitates to sign one is showing you who they are.
This is the layered, practical work behind our People+ Framework: the controls that keep your data safe are also the controls that produce your compliance evidence. Done right, security and compliance are the same effort, not two bills.
What stays with you, no matter who your IT provider is
Some pieces of compliance cannot be outsourced, by design.
Your policies and procedures. Someone has to decide how your business handles data, who gets access to what, and how long records are kept. We can hand you templates and strongly recommended defaults, but adopting them is a leadership act, not an IT ticket.
Your people. Most breaches start with a person, not a server. Training your staff, enforcing the rules, and acting when someone ignores them is your job. We can run the training platform; we cannot make your team care.
Your business decisions. Which vendors you trust with regulated data, how much risk you accept, whether you fund a control we recommend, these are yours. The required risk analysis under HIPAA and the risk assessment under the Safeguards Rule depend on knowledge of your business that only you have.
Your breach response and notifications. If a reportable incident happens, the legal duty to investigate and notify falls on your organization. We help you respond technically and assemble the facts. The filing is yours.
The regulators are explicit about this shared structure. The FTC’s Safeguards Rule guidance requires you to name a qualified individual to run your program and to oversee your service providers, language that only makes sense if the responsibility is yours to delegate, not theirs to assume. HHS frames HIPAA the same way through the covered-entity and business-associate split described in its business associates guidance.
How to read a provider’s promises
When you’re evaluating IT companies, the language they use around compliance tells you a lot. A provider who says “we’ll make you HIPAA compliant” is either oversimplifying to close the deal or genuinely doesn’t understand the framework. Neither is who you want holding your regulated data.
The better answer sounds like this: “We’ll operate the technical controls these rules require, sign a BAA, give you evidence you can show an auditor, and help you understand the policy and training pieces you own.” That is a partner describing reality. We get into the broader version of this when we cover where responsibility sits across compliance frameworks and how shared accountability actually works day to day.
Where to start
If a vendor ever told you that hiring them checked your compliance box, it’s worth a second look. The goal isn’t to scare you off IT partners, it’s to make sure you have one that does its real job well and is honest about the rest. A good place to begin is mapping which controls your provider operates, which evidence you receive, and which policy and training pieces still sit unaddressed on your side. We’re happy to walk through that map with you, plainly and without pressure, so you know exactly where you stand.