An IT compliance audit is a documented check of your systems, accounts, data handling, and written policies against a named standard. It ends in findings backed by evidence, not a verbal “looks fine to me.” If the auditor can’t hand you a written record of what they examined, what they found, and what to fix first, you bought a conversation.
We’ve run IT for Metro Atlanta organizations for thirty years, and one complaint never changes: nobody will say what the audit covers. So here is the plain version of an IT audit for compliance in Atlanta, from scope to deliverables, for law firms, medical practices, nonprofits, and churches.
What an IT Compliance Audit in Atlanta Actually Is
The standard is the whole point. It might be HIPAA’s Security Rule, a client’s outside-counsel guidelines, your cyber insurer’s questionnaire, or the card brands’ rules. We pick the yardstick first, then check whether the controls it demands exist, whether they work, and whether they’re written down.
Those are three separate tests, and organizations fail them separately: a firewall rule nobody documented fails the third, while a backup policy with no restore ever performed fails the second, even though everyone in the office believes the data is safe.
Audit, Vulnerability Scan, or Penetration Test: Not the Same Job
Vendors blur these three on purpose, usually under a banner like “holistic cyber posture.” That phrase means nothing you can put in a contract.
A vulnerability scan is software comparing your systems against a list of known weaknesses. It finds the unpatched server and the open port, it’s fast and inexpensive, and it’s narrow.
A penetration test is a person trying to exploit those weaknesses to see how far they get. It answers “could someone break in,” not “are we doing what the standard requires.”
An audit checks whether the controls a standard requires exist, work, and are documented. That’s why it usually makes sense to audit first and test second.
Paying someone to attack a network that’s missing basic controls only proves what you already knew, at a higher hourly rate.
None of the three replaces the others. A scan alone is not a HIPAA risk analysis, and an audit alone won’t tell you whether a determined attacker can get past your firewall.
HIPAA Versus General Compliance: Two Rulebooks, Overlapping Work
HIPAA and everything else share most of the technical checking. They differ in who wrote the rulebook and what you must be able to show when someone asks.
What HIPAA Requires You to Prove
HIPAA is prescriptive where it counts. The Security Rule treats the risk analysis as a required implementation specification, not an addressable one, and it requires covered entities and business associates to “conduct an accurate and thorough assessment” of risks to electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)). You then have to manage the risks that analysis turns up.
This isn’t theoretical. OCR enforcement actions have repeatedly cited inadequate risk analysis, and HHS publishes its own guidance on what a risk analysis should contain.
One more requirement catches people out: any IT provider that touches PHI needs a business associate agreement with you. That includes us, and it includes whoever you use now. If you run a practice in Decatur or Buckhead and can’t find yours, start there. We cover the day-to-day side in what HIPAA-compliant IT support really involves in Atlanta.
General Compliance for Law Firms, Nonprofits, and Churches
Outside healthcare, no single federal IT statute hands you a checklist. The yardstick comes from somewhere else, and you need to know where before the audit starts.
For lawyers, it’s a professional duty. ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to client information. Georgia has its own Rule 1.6, so confirm the current Georgia wording with the State Bar before you quote it in a policy. Client contracts and insurer questionnaires then turn “reasonable” into specific questions about MFA, backups, and incident response. We lay out the practical side in IT support built for Atlanta law firms.
Churches and nonprofits usually answer to donors, insurers, and card brands. PCI DSS version 4.0 is built on twelve high-level requirements, and a church with a donation terminal or an online giving page often completes a self-assessment questionnaire against them.
For everyone else, NIST’s Cybersecurity Framework 2.0, published in February 2024, organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It gives a non-HIPAA client a neutral way to map findings when nobody has mandated a standard.
What Gets Checked, and Why Each Area Matters
Every area on the list earns its place because of a specific way organizations get hurt. If an auditor can’t tell you the reason behind a check, it’s probably padding.
The Network Security Audit: Firewalls, Wi-Fi, and Remote Access
A network security audit starts at the edge. We read the firewall rules, because “temporary” exceptions from three years ago are a classic way in. We also run an external scan to see what the internet sees, and the results are often a surprise to the person who owns the network.
Then we look at Wi-Fi. Guests and staff belong on separate networks, because a visitor’s infected laptop shouldn’t be able to see your file server.
Remote access gets close attention. Remote desktop exposed to the internet and shared VPN logins are common findings, and both are how intruders get in during a weekend with nobody watching.
The last question is segmentation. Do the clinical systems or client-file servers sit on their own network segment, or does everything share one flat network? Network paths are where an intruder moves sideways, and a flat network lets one compromised front-desk PC reach everything.
Access, Data, and the Paper Trail
Identity is where many intrusions begin, so we check multifactor authentication on email and remote access first. Then we look at who holds admin rights and whether they need them, and whether accounts for departed staff were actually disabled. We routinely find a former employee’s login still alive a year later.
On the data side, we check endpoints, encryption on laptops and drives, and logging. We also check backups, and a backup only counts after someone has tested a restore. Having a green checkmark in the backup console is not evidence.
Then comes the paper. Written policies, training records, and vendor agreements (BAAs where HIPAA applies) are what an investigator, a client, or an insurer will ask to see. A control that works but isn’t documented still fails the audit. For clinics, our piece on cybersecurity for medical practices, beyond the checkbox goes deeper on the technical controls.
What You Actually Receive: Audit Deliverables, Item by Item
“A comprehensive report” tells a buyer nothing. We name the deliverables before work starts so you can hold us to them. Under our cybersecurity and compliance services, you get:
- a scope and asset inventory
- evidence-backed findings with risk ratings
- a control-by-control gap assessment
- a plain-English summary for the managing partner or board
- a written HIPAA security risk assessment where HIPAA applies
- a ranked remediation plan with owners and dates
The IT Compliance Gap Assessment, Control by Control
The compliance gap assessment lists every control in the chosen standard and marks it met, partly met, or missing, with the evidence beside it. It’s the part you hand to a client or insurer who asks how you stack up.
Findings follow a fixed shape, so nobody has to decode them. A typical one reads: Remote desktop is reachable from the internet on the file server. Evidence: external scan, port 3389 open. Risk: high. Fix: close the port, require VPN with MFA. Effort: half a day. Owner: office manager. Each finding says what we saw, how we know, how bad it is, what fixes it, and who is responsible.
The one-page summary is separate, because your managing partner or board needs the decisions, not the port numbers.
The HIPAA Security Risk Assessment: The Written Record
For practices, the HIPAA security risk assessment in Atlanta is the document an OCR investigator asks for first. It records where ePHI lives, what threatens it, how likely and how serious each threat is, and what you decided to do. It’s the written record that the required analysis happened.
Nonprofits and small businesses outside HIPAA get the same underlying work, packaged differently. The output is an IT risk assessment for a small business that an owner or board can read in one sitting, without a glossary.
Remediation Planning: Turning Findings Into a Fix List Someone Owns
A findings list without owners is a wish list. The remediation plan ranks every item by risk and effort, not by how alarming it sounds, and attaches a name and a date to each one.
You’ll notice the plan doesn’t treat everything as an emergency. That’s deliberate, and it’s also why nobody gets pushed into an enterprise package they don’t need.
Sequencing the Fixes: Quick Wins Before Big Projects
Quick wins go first because they’re cheap and they close real doors. A typical first pass turns on MFA for email and remote access, disables accounts for departed staff, and confirms that one backup restores end to end. Only then do we schedule segmentation and encryption work.
Bigger items, like network segmentation or replacing unsupported systems, become scheduled projects with an owner and a budget. Some risks you’ll choose to live with, and that’s allowed. Documented risk acceptance means an owner signs off on the residual risk in writing, so the decision is on record instead of being a silent oversight.
Every fix then gets a retest. We check that the port is actually closed and that the restore actually completes, because “done” and “worked” are different claims.
How Often to Audit: Annual Baseline, Earlier When Things Change
Run a full audit at least once a year. Between audits, do quarterly access reviews and vulnerability scans, so stale accounts and new weaknesses don’t sit for twelve months.
The right cadence depends on three things: how sensitive your data is, how fast your environment changes, and what your contracts or insurers require. A busy medical practice should lean toward the frequent end, while a ten-person nonprofit with little sensitive data can sit at the annual minimum.
The rules may also shift. HHS proposed Security Rule changes in early 2025, including a technology asset inventory and network map. Every audit we run already builds that inventory, so you won’t redo the work however the rule lands.
Events That Mean You Audit Early
Don’t wait for the calendar when something big changes. Audit early after:
- a new EHR or practice-management system
- an office move or new location
- a merger, or a new partner or practice joining you
- a security scare, even one that turned out to be nothing
- a client contract or insurer renewal that asks for evidence you don’t have
Each of these changes who can reach what, which is exactly what a prior audit can no longer tell you.
Choosing Who Runs Your Audit in Metro Atlanta
If you’ve been burned, you already know the pattern: a phone tree, a ticket number, a support desk that has never heard of your practice, and an auditor who never set foot in your office. Whether you’re in Buckhead, Decatur, Woodstock, or somewhere in between, an audit run from a spreadsheet can’t tell whether the server closet is locked or the guest Wi-Fi reaches the billing PC. Someone needs to walk the building.
Cost tracks scope, not an enterprise bundle. The number of users, locations, systems, and the standard you’re measured against drive the price. We won’t put a flat figure on a page, but our Atlanta managed IT pricing for 2026 breakdown shows what moves it. If you’re still comparing providers, how to choose a managed IT provider without getting burned is a decent checklist even if you don’t pick us.
We’re a family-run shop with a small team, and our technicians answer the phone directly. The people who learn your environment during the audit are the same ones who stay on the account for the fixes, instead of rotating out and leaving you to re-explain everything.
So before you sign with anyone, us included, ask for a written scope and a sample deliverable. If they can’t produce one, that tells you what the real audit will look like. When you’re ready, call a Metro Atlanta technician or request a quote for an audit scoped to your environment, and we’ll start with what you actually need to prove.
Frequently asked questions
Does a vulnerability scan satisfy HIPAA’s risk analysis requirement?
No. A scan finds known technical weaknesses, but HIPAA requires an accurate and thorough assessment of risks to ePHI, covering where the data lives, what threatens it, and how you’ll manage each risk. A scan can feed into that analysis, but it can’t replace the written document.
Do churches and small nonprofits need an IT audit if HIPAA doesn’t apply?
Usually yes, though the yardstick is different. Insurers, donors, and card brands set the expectations, and a church with online giving or a donation terminal may have to complete a PCI DSS self-assessment. The audit produces a risk assessment your board can read and act on.
Do I need a business associate agreement with my IT provider?
If you’re a covered entity under HIPAA and your IT provider can access PHI, yes. HIPAA requires a business associate agreement with any vendor that touches PHI. Ask for it before the audit begins, and if your current provider hasn’t offered one, that’s a finding in itself.
Should we run a penetration test before or after the audit?
After, in most cases. The audit confirms the basic controls exist and work, so the test spends its time on real questions instead of rediscovering missing MFA or an exposed remote desktop port.
Who should own the fixes after the audit?
Every finding gets a named owner and a date in the remediation plan. That might be your office manager, a partner, or your IT provider. If an owner decides to accept a risk instead of fixing it, they sign off on that in writing.
