Headline finding · measured 2026-09-03
77% of MSPs marketing to healthcare don't mention HIPAA compliance.
Sharper than it looks, because the buyer is specific and the obligation transfers.
77% No HIPAA compliance claim (9,617)Mentions HIPAA compliance (2,822)
65% Neither CMMC nor NIST listed (2,591)CMMC or NIST listed (1,402)
12,439 firms name healthcare as a target vertical; 9,617 make no HIPAA compliance claim, as of 2026-09-03. The government split (3,993 firms targeting government, 2,591 listing neither CMMC nor NIST) was last measured 2026-08-26 against a base of 33,792 and was not re-run.
Limitations
- We measure what a company lists publicly, not what it holds, so this is a disclosure gap first and a capability gap second.
- Target verticals are on file for 28,418 of 39,351 firms, so both vertical counts are floors.
- The government sub-figure on this card was last measured 2026-08-26 against a base of 33,792 firms and has not been re-measured. Do not read it against this edition's base.
- The limitation is itself the story: if you have it, say it.
What to do with this
- Give each regulated vertical its own page and state the framework by name on it.
- Publish the specific artifact a buyer will ask for, BAA willingness, CMMC level, NIST mapping, rather than a generic compliance paragraph.
Cite this
MSP Signal, "77% of MSPs marketing to healthcare don't mention HIPAA compliance.", measured 2026-09-03. https://mspsignal.com/msp-trends/healthcare-compliance-gap
More findings
15,35615,356 US places have no MSP within 25 miles, 24% of the country's populated places.0.01★It makes no measurable difference. Isolated MSPs average 4.67★ across 20 reviews; MSPs in dense markets average 4.69★ across 21.71%71% of rated MSPs sit at 4.8★ or higher. Half have fewer than 9 reviews.36.8The median MSP scores 36.8. Half the directory lists no services at all.
◂ All 92 findings