Segmentation you can show
A documented VLAN and firewall-policy design separating clinical devices, workstations, guest Wi-Fi, printers and building systems. Delivered as a diagram and a policy table an auditor can read.
HIPAA Managed Network
HIPAA managed network services.
Segmentation, reviews and evidence, run for you.
We start with a HIPAA Network Risk Assessment: a segmentation design, a findings list and the evidence map for the network portion of your risk analysis, delivered direct to the practice. Ongoing management of the firewall, switching and Wi-Fi is then arranged with or through your IT provider, so the practice keeps one help desk and one business-associate relationship, and the network layer gets a senior engineer. Published price, Sacramento and the Bay Area. Last reviewed 2026-10-11.
What HIPAA Asks of the Network
The Security Rule's technical safeguards, mapped to the network layer.
The HIPAA Security Rule (45 CFR 164.312) names five technical safeguards. Four of them land on the firewall, the switches and the Wi-Fi. This is what each one means when the auditor is at your desk.
| Safeguard (45 CFR 164.312) | What the auditor asks | What a managed network delivers |
|---|---|---|
| Access control (a) | Who can reach systems holding ePHI, and how is that enforced? | Segmentation: clinical, business, guest and IoT VLANs with firewall policy between them; named accounts on every device; ZTNA for remote staff |
| Audit controls (b) | Can you show who accessed what, and when? | Firewall and VPN logs retained per your policy; quarterly access and policy reviews with written findings |
| Integrity (c) | How do you know configurations have not been altered? | Version-controlled configuration backups with diffs on every change; change records with approver |
| Transmission security (e) | Is ePHI encrypted in transit across the network? | IPsec between sites, TLS inspection policy, Wi-Fi with WPA3-Enterprise or at minimum WPA2-Enterprise, no shared PSKs on clinical SSIDs |
Person or entity authentication (d) is mostly an identity-provider control; we integrate the network with it (SAML, MFA) but do not run it. We are not auditors and do not certify compliance; we operate the network so the network portion of your risk analysis has evidence behind it.
The Plan
Edge Compliance: the plan built for clinics and health SaaS.
Priced at $1,795 per site per month and delivered with or through your IT provider under their agreement with you. This is what it adds beyond monitoring.
Quarterly policy and access reviews
Every firewall rule, NAT and VPN tunnel reviewed each quarter: still used, still justified, owner named. Orphaned rules removed with a change record. Findings in writing.
Log retention recommendations
We recommend what to keep and for how long, and configure the FortiGate to send logs to your retention target. Storage and SIEM are scoped separately so you are not paying for a SOC you did not ask for.
Evidence on demand
Configuration history, change records, review reports and the network diagram, exportable when your risk analysis, your insurer or an OCR inquiry asks.
Who This Fits
Outpatient clinics, dental and specialty practices, health SaaS.
Three patterns we see in Sacramento and the Bay Area. If yours is different, the assessment will say so.
Outpatient and specialty clinics
One to five locations, an EHR in the cloud, imaging or lab devices on the LAN, a billing company with VPN access. The risk is flat networks where a guest laptop can reach an imaging workstation. Fix: segmentation plus policy reviews.
Dental and veterinary groups
Multi-site with a managed general-IT provider and no one owning the network. We take the network layer only and coordinate with the IT provider, so the practice does not change help desks.
Health SaaS and digital health
SOC 2 and HIPAA overlap; the office network is in scope even when the product runs in the cloud. We provide the office-network controls and evidence for both frameworks and stay out of the product environment.
Track Record
The numbers behind the outcomes.
We only do networks. That is not a limitation — it is why the outcomes are different.
Engineering
20+
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Delivery
300+
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Availability
99.99%
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Ownership
100%
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Sacramento, the Bay Area, and remote across California.
Pre-staging and configuration happen remotely; cutover is on site or remote-hands guided, your choice. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Replacing a non-Fortinet firewall? See firewall migration. Want it watched afterward? See network monitoring.
FAQ
HIPAA managed network questions.
What is a HIPAA compliant network?
There is no certification for a HIPAA compliant network. The Security Rule requires technical safeguards: access control, audit controls, integrity, authentication and transmission security. A network meets them when systems holding ePHI are segmented and reachable only by authorized users, access is logged and reviewed, configurations are controlled and backed up, and traffic carrying ePHI is encrypted in transit. That is what a managed network has to deliver and prove.
What does HIPAA managed network service include?
It starts with a HIPAA Network Risk Assessment, delivered direct to the practice: segmentation design, findings list and the evidence map for the network portion of your risk analysis. Ongoing management, coordinated with your IT provider, runs on our Compliance plan: 24/7 monitoring of the firewall, switches and Wi-Fi; version-controlled configuration backup; documented segmentation; quarterly firewall policy, VPN and access reviews with written findings; log retention recommendations and configuration; and two hours a month of standard changes. Priority same-business-day response during business hours; outside business hours monitoring and alerts keep running, and emergency work is available at hourly emergency rates when an authorized contact asks.
Do you perform the HIPAA risk analysis or audit?
No. The risk analysis is yours or your compliance consultant's, and auditors audit. We operate the network so that the network-controls portion of that analysis has current evidence: diagrams, policy tables, change records and review reports.
How much does it cost?
The Network Risk Assessment is $3,500 for a single clinic site (one firewall, up to three switch groups, 100 connected devices and 6 access points), contracted directly with the practice, and produces the segmentation design and findings list. Mapping those findings to HIPAA Security Rule controls for your auditor is a $2,500 add-on; multi-clinic groups are priced by size on our assessment pricing page. Ongoing management is $1,795 per site per month for Edge Compliance, arranged with or through your IT provider. Human response is business hours; after-hours emergency work bills hourly when an authorized contact asks. Hardware, if a firewall replacement is needed, is quoted separately.
We have an IT company already. Do we switch?
No, and for practices that is the model. The assessment comes direct from us. Ongoing network management runs with or through your IT provider: they stay your help desk and business associate, we do the network layer under their agreement, and the division of responsibility is documented so the risk analysis shows who owns what. Health SaaS companies without an IT provider can contract with us directly.
Does segmentation mean downtime?
Rarely more than one after-hours window. We build the VLANs and policies alongside the existing flat network, move device groups in a scheduled order, and keep rollback available until the last group is confirmed.
What about remote access for billing companies and providers?
Vendor and remote-provider access moves from a shared VPN to ZTNA or per-vendor IPsec with named accounts and MFA through your identity provider, so each party reaches only the application they need. See the VPN-to-ZTNA guide for the method.
Where do you work?
Sacramento and the surrounding cities on site; the San Francisco Bay Area and San Jose on site by arrangement; the rest of California remotely with on-site visits for cutovers.
Sources
Checked against primary sources.
Last reviewed 2026-10-11. Vendor documents and prices change; confirm against the linked pages before you decide.
- HHS: HIPAA Security Rule, technical safeguards, 45 CFR 164.312
- HHS Office for Civil Rights: Security Rule guidance
- Fortinet documentation: VLANs and firewall policy (FortiOS administration guide)
- Ambio Edge Networks services and pricing
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Other vendor names are trademarks of their respective owners, used to identify the products discussed. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by any vendor named here.
HIPAA Network Review
Tell us how many sites and what holds ePHI.
Get an assessment scope and a segmentation plan.
Send the number of locations, your EHR and imaging or lab systems, who has remote access today, and the name of your IT provider if you have one. We return an assessment scope, a segmentation outline, and how ongoing management would run with your provider.
What Happens Next
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.