Encryption at Rest and in Transit
Laptops, servers, backups and email, with the configuration recorded so you can show when it was applied rather than assert that it was.
Sandy Compliance
IT Compliance Services in Sandy, Utah
Being compliant and being able to prove it are two separate problems, and the second one is where most Sandy practices and firms come unstuck. We build the controls and we leave behind the evidence.
HIPAA, PCI DSS and FERPA work for regulated Sandy offices
Documentation written to be handed to an auditor
Security questionnaires answered honestly, not hopefully
The Distinction That Matters
IT Compliance Services in Sandy: The Controls and the Proof
Our IT compliance services in Sandy, Utah cover the technical half of HIPAA, PCI DSS and FERPA, and the evidence that proves it: encryption at rest and in transit, access control and least privilege, audit logging kept for the period your framework requires, retention set to the regulation rather than to whatever the software defaulted to, and written policy that describes your actual environment instead of a template with your name on the front.
The half we do not cover, we say so. Your policies, your training records, your vendor agreements and the call on whether an incident is reportable stay yours, and any provider claiming to make you compliant on its own is overselling. What we can do is make sure that when a health system near the Alta View campus or a district vendor working with Canyons School District sends you a security questionnaire, the answers come from what is actually configured. Rates are published, the agreement is monthly, and the documentation leaves with you if you do.
What triggers the call, nine times out of ten: not an audit. A health system sends a counselling practice a business associate agreement and a security questionnaire before renewing a referral relationship, and the practice has thirty days to answer questions about encryption, access logs and retention that nobody in the building can answer. That deadline is what most of this work is really up against.
Drawing the Line
The Part IT Owns and the Part You Own
Compliance is not one job. It splits into technical controls, written policy, and the evidence that connects the two. IT can own the controls outright, encryption, access management, logging, backup, retention enforcement, endpoint protection. It can produce most of the evidence automatically. It cannot own your policies, your staff training records, your vendor agreements or your breach notification decisions, and any provider promising to make you compliant on its own is describing something that does not exist.
That distinction matters commercially, because it decides what you should be paying for. A consultant who writes beautiful policy but never touches your systems leaves you with a document that does not describe reality. A provider who hardens your systems but writes nothing down leaves you unable to prove any of it. Auditors ask for both, and they ask for them together.
Do It Yourselves
Consultant Only
Solzorro Managed+
Technical controls
Whatever got set up
Recommended, not built
Configured and maintained
Written documentation
A template off the web
Thorough
Written from your setup
Evidence on request
A frantic week
Ask the auditor
Pulled from live systems
Keeping it current
Until someone leaves
Next engagement
Reviewed twice a year
Questionnaire answers
Guesswork
Second-hand
Answered from what is running
What it costs
Hidden until it fails
Project fee
Inside the monthly plan
The Technical Side
What We Build and Document
The controls below are the ones auditors and questionnaires ask about most often, and each one leaves a record you can hand over.
Access Control and Least Privilege
Who can reach which records, reviewed rather than accumulated. Most findings we see are old accounts that outlived the person or the role.
Audit Logging and Retention
Access to protected records logged and kept for the period your framework requires, which is the evidence nobody thinks about until it is requested.
Backup and Retention Rules
Retention set to what the regulation asks for rather than what the software defaulted to, and restores tested so the copies are known to work.
Written Policy and Procedure
Documents describing your actual environment, not a downloaded template with your name at the top. Auditors recognise the difference immediately.
Business Associate and Vendor Review
Which vendors touch protected data, what agreements exist, and where the gaps are before somebody else finds them.
Questionnaire and Audit Support
We answer the technical sections of client and insurer questionnaires from what is actually configured, and flag anything that would be a stretch.
Twice Yearly Security Review
Two Microsoft security audits a year on Managed+, worth over $1,000, which doubles as a scheduled compliance check rather than an annual scramble.
Compliance rests on the day-to-day work, so this pairs with managed IT services in Sandy and the controls come from our Sandy cybersecurity services. The wider practice is on our compliance services pillar, with sector detail on the healthcare, dental and law firm pages, and the Sandy overview covers the rest.
What to Ask a Provider
Every Provider Says They Handle Compliance.
Every Provider Says They Handle Compliance.
Four Ways to Find Out If They Do.
Four things worth establishing before you hand anyone your regulated systems, all of them answerable in a first conversation.
We Say What We Do Not Cover
Nobody makes you compliant on their own. We are clear about which half is ours and which stays yours.
Evidence, Not Reassurance
Documentation generated from your live configuration, so what is written matches what is running.
Priced Before You Ask
Rates are on the pricing page, and compliance work is not a mystery surcharge.
You Keep What We Build
Leave any month and the documentation, configuration records and evidence go with you.
Who This Is For
Sandy Offices With a Framework to Answer To
Four kinds of business this city has a lot of, each carrying records that someone external has the right to inspect.
Medical & Dental Practices
Independent practices in the ring around the Alta View campus, running practice management software that holds protected health information all day.
Behavioral Health & Counseling
Therapy and counselling groups, a category growing alongside the 56-bed Intermountain Behavioral Health Center that opened at Alta View in June 2026.
Schools & Education Services
Tutoring, testing, curriculum and software vendors working with districts, where student records bring FERPA obligations most small vendors have never read.
Insurance & Financial Advisory
Agencies, adjusters and advisory firms of the kind clustered near WCF Insurance on Towne Ridge Parkway, answering to carriers as often as to regulators.
Getting There
From Probably Fine to Provably Fine
Most offices are further along than they fear on controls and further behind than they think on evidence. This is the order we work in.
1
Establish What Applies
HIPAA, PCI, FERPA, a carrier's own standard, or several at once. Scoping this properly stops you buying work for a framework that was never going to apply to you.
2
Measure the Gap
We assess what is configured against what the framework requires and give you a written list, ranked, with the items that would fail an audit tomorrow at the top.
3
Close and Record
We fix the technical gaps and document them as we go, because a control implemented six months ago with no record of when is difficult to defend.
4
Keep It True
Two reviews a year, updated documentation when your systems change, and questionnaire answers drawn from current configuration rather than from memory.
No Mystery Surcharge
Compliance Is Where Providers Stop Publishing Their Numbers
Ask most IT companies what compliance support costs and the answer becomes a meeting. Our plan pricing is public, the controls and documentation sit inside it, and the only things quoted separately are genuine projects such as a first full gap assessment or a formal audit engagement. Compare tiers on the pricing page, or see what is bundled in Managed+.
“If I want to do it, they’ll talk me through it. There’s a lot of flexibility to meet me where I am, and that was key. That was a decision that we made I don’t know how many years ago, but I’ve never looked back.”
Ken
CEO
“The entire Solzorro team is amazing. We have yet to have an issue they cannot work out for us. Hiring Solzorro was the best decision our company has made in a very long time!!!”
Sonya
Finance & Admin Director
“Solzorro came so much out on top. Mostly because of their experience, secondly because they knew our company, and third because they were willing to work with me to make it different and make it better.”
Sam
Director of IT
“I have worked with Solzorro now for many years. When it comes to an IT company, this one is the best. We “interviewed” many companies and found this one to be the best fit with our company culture and values. They have helped us greatly in becoming more HIPAA compliant.”
Shawn
Director of Operations
“We made the switch to Solzorro about a year ago and it has been one of the best business decisions we have ever made. Our system rarely goes down and when it does they are quick to respond.”
Tyson
CEO
“If you’re looking for an MSP that combines technical excellence with outstanding customer service and true partnership, I can’t recommend Solzorro highly enough. On a scale of 1 to 10, they’re a 20.”
Rob
COO
“Perfect accommodation, pricing, and support for our business. Highly recommend them for managed IT services!”
Sheldon
Customer & Quality Engineer
“Great IT company. They ALWAYS respond very quickly. Staff is knowledgeable and very friendly. Solzorro literally is the best IT I have ever worked with.”
Debbie
Admin Assistant
“If I want to do it, they’ll talk me through it. There’s a lot of flexibility to meet me where I am, and that was key. That was a decision that we made I don’t know how many years ago, but I’ve never looked back.”
Ken
CEO
“The entire Solzorro team is amazing. We have yet to have an issue they cannot work out for us. Hiring Solzorro was the best decision our company has made in a very long time!!!”
Sonya
Finance & Admin Director
“Solzorro came so much out on top. Mostly because of their experience, secondly because they knew our company, and third because they were willing to work with me to make it different and make it better.”
Sam
Director of IT
“I have worked with Solzorro now for many years. When it comes to an IT company, this one is the best. We “interviewed” many companies and found this one to be the best fit with our company culture and values. They have helped us greatly in becoming more HIPAA compliant.”
Shawn
Director of Operations
“We made the switch to Solzorro about a year ago and it has been one of the best business decisions we have ever made. Our system rarely goes down and when it does they are quick to respond.”
Tyson
CEO
“If you’re looking for an MSP that combines technical excellence with outstanding customer service and true partnership, I can’t recommend Solzorro highly enough. On a scale of 1 to 10, they’re a 20.”
Rob
COO
“Perfect accommodation, pricing, and support for our business. Highly recommend them for managed IT services!”
Sheldon
Customer & Quality Engineer
“Great IT company. They ALWAYS respond very quickly. Staff is knowledgeable and very friendly. Solzorro literally is the best IT I have ever worked with.”
Debbie
Admin Assistant
The Real Questions
Sandy Compliance: Honest Answers
What Sandy practices and firms ask us, usually with a deadline already attached.
We take card payments and keep patient records. Which rules actually apply to us?
Both HIPAA and PCI DSS, and they are not the same shape. HIPAA governs protected health information and is enforced through investigation and audit, usually after a complaint or a breach. PCI DSS is a contractual standard imposed by the card brands through your processor, and non-compliance shows up as fees or a lost merchant account rather than a regulator. The practical effect is that your card environment should be separated from your clinical systems so that one does not drag the other into scope. That separation is the first thing we look at.
What does an auditor ask for that most Sandy offices cannot produce?
Logs and dates. Almost everyone can describe their controls. Far fewer can show who accessed a particular record last March, when encryption was enabled on a specific laptop, when a departed employee's access was actually revoked, or that a backup restore was ever tested. The controls are usually present. The record proving they were present at the relevant time is what is missing, and it cannot be created after the fact without being obvious.
Our current provider says we are compliant but will not show us anything. What does moving to you involve?
It starts with a gap assessment rather than a migration, because you should know what you have before anyone changes it. We document what is configured, compare it against your framework, and give you a ranked written list. Then we move the systems the same way we move any client: tooling in parallel, cutover after hours, credentials from the outgoing provider inventoried and rotated. The difference on a regulated move is that we record the state of everything on the way through, so you have a dated baseline.
A hospital system sent us a business associate agreement. What are we agreeing to?
In substance, that you will protect their patients' information to the same standard they do, report breaches within a defined window, restrict what your own subcontractors can do with the data, and return or destroy it when the relationship ends. It is a real contract with real liability, not a formality. Before signing, the questions worth answering are whether you can genuinely meet the breach notification timeline, whether every vendor touching that data has an equivalent agreement in place, and whether you can produce access logs if they ask.
How long do we have to keep records, and does that change how backups are set up?
It changes them significantly. Most defaults in backup software are built around recovering from last week, not around a six year retention obligation, and the two need different storage and different cost planning. Retention also cuts the other way: holding records longer than required increases what you would have to disclose after a breach. We set retention to what your framework actually requires, document the schedule, and make sure deletion happens as designed rather than never.
What does the compliance work cost on top of the monthly plan?
The ongoing controls and documentation sit inside Managed+ at $135 per user per month, including the two annual Microsoft security reviews. A first full gap assessment against a framework is a scoped project quoted before it starts, as is supporting a formal external audit. We do not charge a percentage-of-fear premium for the word compliance, and the plan rates are public on the pricing page.
How much of this is IT and how much is written policy we have to own?
Roughly speaking, we can own the technical controls and the evidence they generate, which is a large share of any framework. You own the parts that are decisions rather than configuration: your policies, your workforce training records, your vendor agreements, your sanctions process, and the judgment call about whether an incident is reportable. We will draft policy that matches your environment and tell you what needs a signature, but a provider claiming to take all of it off your hands is overselling.
If we leave, do we keep the documentation you built for us?
Yes. The documentation, configuration records, policy drafts and evidence are yours, and they leave with you along with credentials and licensing details. We put that plainly because compliance documentation is exactly the kind of asset a provider can use to make leaving painful, and holding it hostage is a good way to make a client compliant and resentful at the same time. Agreements here are monthly with no buyout, and that applies to this work like everything else.
Find Out What You Cannot Prove Yet
A conversation about which framework applies to your Sandy business, what an auditor would ask for, and how much of it you could produce this week.