Does Lavawall® replace my BAA?

No. The Business Associate Agreement is a contract between the covered entity and the business associate. Lavawall® provides the technical and administrative evidence supporting the controls the BAA covers.

Does Lavawall® cover the Privacy Rule and the Breach Notification Rule?

The Security Rule is mapped directly. Privacy Rule and Breach Notification Rule controls overlap with administrative safeguards and are supported in evidence collection through audit logs, access logs, and disclosure tracking.

Can the MSP itself be HIPAA-compliant?

An MSP is typically a Business Associate under HIPAA when it handles PHI as part of its service. Lavawall® produces the evidence the MSP needs for its own BAA-required posture and for the client's Covered Entity controls.

Buyer's guide · HIPAA

Best HIPAA compliance software for MSPs

MSPs serving US healthcare clients have to manage HIPAA Security Rule and Privacy Rule controls across many tenants, without enterprise-GRC pricing or a separate product instance per organisation. The best fit maps directly to the Security Rule, collects continuous endpoint and cloud evidence, and is multi-tenant by design. Our top pick on those criteria is Lavawall®.

Start your compliance wizard See the selection criteria

Security Rule · Privacy Rule · Breach Notification · multi-tenant

HIPAA (the Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information (PHI) in the United States. The Security Rule's administrative, physical, and technical safeguards carry specific control expectations, and the Privacy Rule and the Breach Notification Rule add further layers.

For MSPs serving US healthcare practices (dental offices, family medicine, specialty clinics, behavioural health, pharmacy chains, primary-care networks), HIPAA evidence collection has to scale across many client tenants without enterprise pricing. The MSP also typically signs a Business Associate Agreement (BAA), which makes the MSP's own posture part of the compliance picture.

See what Lavawall® does

Built and used internally by ThreeShield, an audit firm in Calgary. Built for MSPs and lean IT teams. Cross-platform patching, M365 / Entra / Azure / Google Workspace breach detection, 15+ compliance frameworks, kernel-free application control, smart helpdesk, multi-tenant remote support. One platform, native CAD billing.

Start the compliance wizard GRC & 15+ frameworks See pricing

What to look for

Seven criteria matter when an MSP evaluates HIPAA tooling for healthcare clients.

Direct HIPAA Security Rule control mapping. Direct mapping to 45 CFR §164.308, §164.310, §164.312, §164.314, and §164.316, covering the administrative, physical, technical, organisational, and policies-and-procedures safeguards.
Multi-tenant for MSPs. One console for all client tenants, with per-client isolation, billing, and co-branded reports. Not a single-tenant Vanta or Drata-style product.
Continuous endpoint and cloud evidence. PHI lives on Windows, macOS, and Linux endpoints and in M365 and Google Workspace tenants. Evidence has to come from those sources continuously, not from a quarterly questionnaire.
Business Associate Agreement awareness. The platform should deploy in a way compatible with the MSP's BAA obligations and provide the access logging the BAA expects.
Risk Analysis and Risk Management evidence. The Security Rule requires a documented Risk Analysis and Risk Management process. The platform should produce both.
Breach Notification Rule support. Evidence to support 60-day breach notification timelines, including affected-individual identification and the supporting log basis.
Audit-firm credibility. Platforms built or used by audit firms with real healthcare-compliance experience.

Options to evaluate

Four categories of tool show up in HIPAA buying processes for MSPs.

Lavawall®

Multi-tenant MSP platform with HIPAA framework first-class.

Direct HIPAA Security Rule mapping. Continuous evidence from Windows, macOS, and Linux endpoints and M365 / Google Workspace tenants. Multi-tenant by design with per-client isolation and co-branded reports. Risk Analysis and Risk Management workflow templates. Audit logging structured for Breach Notification Rule timelines. Built and used by ThreeShield, an audit firm with healthcare-compliance experience including HIPAA, BC HIA, and Alberta HIA.

Best when: MSPs serving US healthcare practices want one platform for HIPAA evidence and the broader security stack.

Compliancy Group / HIPAA Secure Now / Accountable HQ

Healthcare-focused HIPAA tools.

Popular in the dental and primary-care space. Strong on documentation and questionnaire workflow, lighter on continuous endpoint and cloud evidence collection.

Best when: healthcare practices with limited IT need guided HIPAA documentation.

Vanta / Drata / Secureframe

Single-tenant SaaS GRC with a HIPAA module.

Strong onboarding for a single SaaS company. Not designed for MSP multi-tenant delivery.

Best when: a single SaaS company handles PHI under a BAA with its customers.

SharePoint + Excel + audit-firm engagement

Documentation-led approach.

Many small healthcare practices are still on this model. It works for the smallest practices but does not scale to MSP service delivery across many tenants.

Best when: a single very small healthcare practice has its own audit relationship.

How Lavawall® fits

Lavawall® treats the HIPAA Security Rule as a first-class framework, with direct mapping to 45 CFR §164.308 (administrative), §164.310 (physical), §164.312 (technical), §164.314 (organisational), and §164.316 (policies and procedures) safeguards.

Continuous endpoint and cloud evidence covers encryption posture, audit logging, access control, password policies, MFA enforcement, automatic logoff, integrity controls, transmission security, workstation security, and removable-media handling. All of it is collected from the actual Windows, macOS, and Linux endpoints and the M365 and Google Workspace tenants, not asserted on a form.

Multi-tenant by design means an MSP serving 30 dental practices and 5 primary-care clinics manages all of them from one console with per-client isolation. Reports can be co-branded for the practice owner. ThreeShield, the audit firm that built Lavawall®, has direct healthcare-compliance experience.

Start your HIPAA readiness →

Frequently asked

Does Lavawall® replace my BAA?: No. The Business Associate Agreement is a contract between the covered entity and the business associate. Lavawall® provides the technical and administrative evidence supporting the controls the BAA covers.
Does Lavawall® cover the Privacy Rule and the Breach Notification Rule?: The Security Rule is mapped directly. Privacy Rule and Breach Notification Rule controls overlap with administrative safeguards and are supported in evidence collection through audit logs, access logs, and disclosure tracking.
Can the MSP itself be HIPAA-compliant?: An MSP is typically a Business Associate under HIPAA when it handles PHI as part of its service. Lavawall® produces the evidence the MSP needs for its own BAA-required posture and for the client's Covered Entity controls.