How Does Co-Managed IT Work for a Hospital That Already Has an IT Team?

Co-managed IT works by splitting responsibility: the hospital's internal IT team keeps ownership of clinical systems, users, and daily operations, while a partner such as Five Nines Technology Group adds 24/7 security monitoring, incident response, compliance support, and strategic planning the team cannot staff alone.

Picture a 25-bed hospital with a four-person IT department. They know which nursing unit prints to which printer, which physician still logs in from a personal laptop, and how the EHR behaves after a vendor update. They are good. They also go home.

Your team runs the hospital's IT. Who watches it at 2 AM?

That question carries more weight than it sounds. The 2026 Sophos Active Adversary Report, which analyzed 661 incident response and managed detection cases, found that 88% of ransomware payloads were deployed outside business hours. Attackers do not wait for your team. They wait for your team to leave.

What Does a Hospital's IT Team Keep in a Co-Managed Model?

Short answer: In a co-managed model, the hospital's IT team keeps ownership of the systems that require institutional knowledge: the EHR and clinical applications, user support, device integrations, and local decisions. Five Nines adds coverage around that work, not instead of it. Nobody hands over the keys to the building.

This is the part most hospital IT leaders get wrong about co-managed IT. They hear "managed service provider" and assume replacement. The opposite is true. The model only works because your team already knows the environment better than any outside provider ever will.

What changes is the weight on their shoulders. The work that requires someone awake at 3 AM, or a specialist your budget cannot justify, moves to a partner. The work that requires knowing Dr. Patel's workflow stays home.

What Does Five Nines Take On in a Co-Managed Hospital Partnership?

Short answer: Five Nines Technology Group typically takes on the work that needs round-the-clock staffing or specialized security skill: in-house Security Operations Center monitoring, endpoint detection and response, managed SIEM, vulnerability management, incident response planning, HIPAA compliance support, and vCIO-level strategy.

Those services already exist in the Five Nines catalog, and our guide to which managed IT services support growing healthcare organizations walks through each one. Co-managed delivery changes who touches what, not what gets delivered. The SOC watches your environment around the clock. When it sees something, an analyst investigates rather than forwarding a raw alert to an inbox nobody opens until 7 AM.

The compliance side matters as much as the security side for hospitals. Your team can configure MFA. Proving to an auditor that MFA has been enforced every day for the past year is a different job, and it is the job that tends to slide when the same four people are also fixing printers.

The Hidden Risk

An alert that fires at 2 AM and waits until morning is not a detection. It is a timestamp on a breach. Sophos found attackers reached Active Directory a median of 3.4 hours after intrusion.

What Happens When Something Goes Wrong at 2 AM?

Short answer: In a co-managed model, the SOC detects and investigates first, contains the threat within pre-approved limits, then escalates to the hospital's on-call contact using an agreed playbook. Your team is woken up for decisions, not for discovery.

That last sentence is the whole point. Today, many hospital IT teams are the discovery mechanism. A nurse calls the house supervisor, who calls the on-call tech, who drives in to find out what happened.

A working co-managed handoff looks like this:

1. Detect. The Five Nines SOC sees suspicious behavior on an endpoint or account.
2. Investigate. An analyst confirms whether it is real, ruling out the false positives that burn out on-call staff.
3. Contain. Pre-approved actions run immediately, such as isolating a workstation or disabling a compromised account. 
4. Escalate. The hospital's designated contact gets a call with what happened, what was done, and what decision is needed. 
5. Document. Every step lands in the incident record, which doubles as HIPAA evidence.

The contain step is where hospitals need the most care. Isolating a workstation on a medication cart at 2 AM is a clinical decision as much as a security one. A good co-managed agreement names which systems the SOC can act on alone and which require a phone call first.

Which Hospital Systems Can a SOC Contain Without Calling You First?

Short answer: It depends on what the system touches. Five Nines recommends hospitals draw a Clinical Containment Line before signing: systems the SOC can isolate on its own, systems it can contain and then call about, and clinical systems where the hospital decides first. A workstation on a medication cart is never just a laptop.

This is where hospital co-managed IT differs from co-managed IT anywhere else. In a law firm, isolating an infected laptop at 2 AM is an easy call. In a hospital, the same move on the wrong device can stop medication administration or cut off a lab interface mid-shift.

The Five Nines Clinical Containment Line

The line gets drawn once, in daylight, by the people who know the floor. That is why the hospital team's knowledge is not replaced in a co-managed model. It becomes the rulebook the SOC follows at night.

Weighing co-managed against fully managed instead? Our comparison of co-managed and fully managed IT walks through that decision. [TO CONFIRM: link to the live Co-Managed vs. Fully Managed post]

Is Co-Managed IT Cheaper Than Hiring More Hospital IT Staff?

Short answer: For most hospitals with small IT teams, co-managed IT costs less than building 24/7 coverage internally. Staffing one seat around the clock takes about 4.2 full-time employees at 40 hours each, before vacation, sick leave, turnover, or security specialization. 

The math is simple: 168 hours in a week divided by 40 hours per person. And that covers one chair, filled by a generalist. A real security operations function needs analysts who do nothing but watch, tune, and investigate.

The question for a CFO is not whether co-managed IT has a cost. It is what the alternative costs. The IBM Cost of a Data Breach Report 2025 put the average healthcare breach at $7.42 million, the highest of any industry, with the longest identification and containment time at 279 days.

What Leadership Misses

Healthcare breaches took 279 days to find and contain in IBM's 2025 research. Most of that time, someone could have been watching. Nobody was assigned to.

How Do You Know Which Stage of After-Hours Coverage Your Hospital Is In?

Short answer: The Five Nines Shared Watch Model sorts hospital IT coverage into four stages, based on who is watching when the internal team goes home. Many hospitals with capable IT teams sit at Stage 2: they bought the tools, but nobody is assigned to read the alerts overnight.

The Five Nines Shared Watch Model

The jump from Stage 2 to Stage 3 is where co-managed IT earns its keep. Stage 2 feels safe because the dashboards exist. Stage 3 is safe because a person is assigned to them.

Five Nines Insight

Buying a security tool without someone to watch it moves the problem from "we can't see" to "we saw it Monday."

What Does Five Nines Usually Find in Hospitals That Already Have IT Teams?

Short answer: The patterns Five Nines engineers look for are rarely skill gaps. They are coverage gaps: alerts without owners, one person holding critical knowledge, and compliance evidence that depends on someone remembering to collect it.

• The alert inbox nobody owns. Security tools send alerts to a shared mailbox or a single admin. Overnight and weekend alerts get triaged in bulk on the next business day.
• The one-person system. One team member is the only person who fully understands the firewall, the backup jobs, or the EHR interfaces. Their vacation is a risk event.
• On-call fatigue. The same two or three people rotate on call indefinitely. False alarms wake them up, so real alarms start getting slower responses.
• Evidence by memory. HIPAA safeguards are in place, but proof of them lives in screenshots taken the week before an audit rather than in a continuous record.
• Insurance questionnaire drift. The cyber insurance application says 24/7 monitoring. The staffing model says business hours.

What Should a Hospital Ask Before Choosing a Co-Managed IT Partner?

Short answer: Ask who watches your environment overnight, what they can do without calling you, how they hand off to your team, and who owns HIPAA evidence. The answers reveal whether a provider offers a real Security Operations Center or just a monitoring platform with a phone number.

1. Who is watching our environment at 2 AM on a Sunday, and are they your employees?
2. Which containment actions can your team take without calling us, and who decides that list?
3. How do you escalate to our on-call staff, and how fast?
4. Will you work inside our existing tools, or require us to replace them?
5. Who produces the evidence our HIPAA auditor will ask for, and how often is it updated?
6. What happens to the relationship if our internal team grows or shrinks?
7. What does a monthly report to our leadership actually contain?

Who Is Watching Your Hospital's Systems Tonight?

If your team is strong and your nights are still uncovered, the gap is not talent. It is hours.

The Five Nines Co-Managed Coverage Review identifies:

• Which alerts fire after hours and where they go today
• Which systems depend on a single person's knowledge
• How your cyber insurance attestations compare with your actual coverage
• Where your HIPAA evidence is continuous and where it is collected by hand
• Which responsibilities your team should keep, and which a partner should carry

You leave with a responsibility map for your hospital: who owns what, who watches when, and where the Shared Watch Model places you today.

Your team already runs the hospital's IT. The question is whether anyone has their back at 2 AM.