Five questions to ask your IT provider

Use this with the MSP you already trust. These questions help owners and managers understand evidence and ownership. Completing the list does not prove compliance or guarantee protection.

1. 1. What evidence shows our backups can be restored?

   Ask for the last restore test date, who ran it, and how long a restore would take for the systems you rely on day to day.

2. 2. How are staff access and departures handled?

   Confirm who removes accounts the same day someone leaves, and whether shared logins are still in use.

3. 3. Which systems have MFA and current security updates?

   Cover email, EMR, remote access, and any admin portals. Ask how patching is tracked for clinic devices.

4. 4. Who does what during a suspected incident?

   Clarify clinic, MSP, and EMR vendor roles, and how you would keep seeing patients if systems were unavailable.

5. 5. What rules govern staff use of AI with practice information?

   Ask which tools are approved, where data is stored, and how consent or decline is handled when recordings are involved.