Managed IT pricing tiers for a behavioral health practice with 10 to 50 users.

Managed IT for a behavioral health practice in Pennsylvania typically runs $150 to $250 per user per month. Big U Computers charges $165 per user per month for support, workstation management, and 24/7/365 network and security monitoring. Our $220 per user per month plan adds Microsoft 365 backup, email security, Microsoft 365 tenant protection, and security awareness training, which is the tier most practices handling protected health information should be on. For a 20 person counseling center, that is $3,300 to $4,400 per month. Below roughly $120 per user per month, something has usually been removed, and it is often the security layer HIPAA expects you to have.

Here is what sits behind those numbers, what gets left out of cheaper quotes, and how to compare two proposals without guessing.

What Is Actually Included at Each Price Level

Price differences between IT providers almost always come down to what is bundled into the monthly fee. This is the honest version.

What you get	Under $120	$165	$220
Remote support during business hours	Yes	Yes	Yes
Workstation and software management	Yes	Yes	Yes
Network administration	Limited	Yes	Yes
24/7/365 security monitoring	No	Yes	Yes
Antivirus with EDR	Ask	Yes	Yes
Endpoint backup	No	Yes	Yes
Dark web monitoring	No	Yes	Yes
Virtual CIO and quarterly business reviews	No	Yes	Yes
VoIP phone system support	No	Yes	Yes
Signed BAA	Ask	Yes	Yes
Microsoft 365 backup	No	No	Yes
Email security	No	No	Yes
Microsoft 365 tenant protection	No	No	Yes
Security awareness training	No	No	Yes

The four rows at the bottom are the whole difference between our two tiers, and they are all about email and Microsoft 365. If your scheduling, documents, and email live in Microsoft 365, that is where a breach is most likely to start. A plan that monitors your office network but not your cloud accounts is watching the wrong door.

The Five Costs Practices Forget to Budget For

The per user fee is not the whole picture. Budget for these as well.

1. Microsoft 365 licensing, roughly $12 to $26 per user per month depending on the plan. The higher tiers include the security and compliance features a covered entity actually needs.
2. Your records platform. Credible, TherapyNotes, SimplePractice, and Valant all bill separately from your IT provider.
3. Hardware replacement on a four to five year cycle, roughly $900 to $1,400 per workstation. Spreading this across the year avoids a painful quarter.
4. Onboarding and network assessment. Most providers charge a one time project fee to document your environment and fix what they find. Ask for the number up front.
5. Your annual security risk analysis. HIPAA requires one. Some providers include it, some quote it separately, and some do not offer it at all.

Why HIPAA Changes What You Need to Buy

A retail shop and a counseling practice can run on the same number of computers and still need very different IT plans. The difference is what happens when something goes wrong.

If a retail shop loses a laptop, it loses a laptop. If your practice loses a laptop with client notes on it and that laptop is not encrypted, you may be looking at a reportable breach, patient notification, and a conversation with the Office for Civil Rights.

That is why a practice needs a few things a general small business plan often leaves out:

• Encryption on every device that can reach client information, so a lost laptop stays a lost laptop.
• Access controls and audit logging, so you can show who opened what and when.
• Backups that have actually been restored and tested, not just scheduled.
• Email and cloud account security, because stolen passwords are now the most common way in.
• A signed Business Associate Agreement with any vendor that can reach client information, including your IT provider.

That last one is worth checking today. If your current IT company has not signed a BAA with you, that is a gap in your compliance file, and it is a simple one to close.

How to Compare Two IT Quotes Side by Side

Two proposals can look thirty dollars apart per user and be completely different services. Ask every provider these eight questions and write the answers down.

1. Is the price per user or a flat monthly fee, and what happens when we add staff?
2. Is after hours support included, or billed hourly when we call at 7 p.m.?
3. What is your response target for a mission critical issue, and where is it written down? Ours is a one hour response with a four hour restoration target, in our service agreement.
4. Will you sign a Business Associate Agreement?
5. If we leave, who owns our documentation, passwords, and licenses, and how long does the handover take?
6. Is support for our records platform included, or is that out of scope?
7. Is onsite support included in the monthly fee, or billed separately? Ours is billed separately at $200 per hour, discounted 20 percent under agreement. Most practices need it rarely, but you should know the number before you need it.
8. How long is the contract, and what is the exit process?

Question five tells you the most. Some IT companies keep your passwords and network documentation to themselves, which makes leaving painful and is meant to. You should get full written documentation of your network, licenses, and credentials in plain language, whether or not you ever plan to leave.

What a 20 Person Practice Actually Pays

Twenty users on our $220 plan is $4,400 per month, or $52,800 per year, fully managed and aligned to HIPAA expectations.

Compare that to hiring. A single part time IT person in Eastern Pennsylvania runs roughly $45,000 to $60,000 per year once you include payroll taxes and benefits. That person works business hours, takes vacation, and does not come with a security monitoring platform, an email security stack, backup software, or anyone to cover them when they are out.

For a practice of this size, the math usually favors a managed provider. For a practice closer to 50 users, a hybrid model starts to make sense, with one internal person handling day to day requests and an outside provider covering security, monitoring, and after hours.

What This Looks Like in Practice

We have supported CMSU Behavioral Health and Developmental Services for ten years. They deliver the full spectrum of mental health and drug and alcohol services, which means their technology has to hold up to requirements most small businesses never encounter.

We also implemented and continue to maintain their Credible environment, including platform support and new feature rollouts. In practical terms, when the records platform vendor pushes a change, their clinical staff are not the ones left working out what changed. That is the part most IT companies do not cover, because most IT companies have never worked inside a behavioral health records system.

About Big U Computers

Big U Computers is a family owned IT provider in Macungie, Pennsylvania, serving practices and small businesses from Allentown and Bethlehem through Danville, Bloomsburg, and Lewisburg.

• Ten years supporting behavioral health IT in Pennsylvania
• Direct experience implementing and maintaining the Credible records platform
• We sign a Business Associate Agreement with every covered entity client
• One hour response on critical issues
• After hours remote support for practices running evening appointments
• 24/7/365 network and security monitoring
• We work to HIPAA and NIST frameworks and are knowledgeable on PCI
• Full written documentation of your network, licenses, and passwords, in plain English

Want a straight answer on what your practice would pay? Call 570.340.0800 or book a free consult. We will tell you the number on the first call.

Big U Computers | P.O. Box 523, Macungie, PA 18062 | 570.340.0800 | bigucomputers.com