Most small practice owners have no reference point for this. They know what they pay their biller and what the rent is. IT sits in a category where the invoices arrive irregularly, the work is invisible, and there's no way to tell whether the number is reasonable.
So here's a frame that holds up, and where the money should go first.
The three ways practices actually buy IT
The break-fix guy. You call when something's broken. You pay hourly, usually somewhere between $100 and $175 in this market. Cheap until the year you need him a lot, and structurally opposed to prevention — nobody gets paid for the problem that didn't happen.
The managed service provider. A monthly fee per user or per device, typically $100 to $200 per user per month depending on what's included. Predictable, and it buys monitoring, patching, and a helpdesk. It usually does not buy strategy. An MSP will keep your machines updated and will not tell you your domain expires in five weeks or that your intake form emails patient details to a Gmail account.
Fractional leadership. A senior person for a few hours a month who owns the decisions — what to buy, what to retire, which vendor is underperforming, what your actual risks are. Ranges widely; call it $1,500 to $3,000 a month for a small practice, less if the work is project-shaped.
Most practices under twenty people need less of the second than they're buying and more of the third than they've ever had.
Where the first dollars should go
If a practice asked me to spend their budget in order, it would be this — and the first four cost almost nothing.
One: multi-factor authentication everywhere. Email, practice management, billing portal, remote access. Usually free, usually unfinished. Highest-value item on this list by a wide margin.
Two: backups you've actually restored from. Not "we have backups." A restore, tested, with someone watching. An untested backup is a belief.
Three: account offboarding. A written step for what happens the day someone leaves. Most practices have at least one active account belonging to someone who left.
Four: the one-page inventory. What systems hold patient data, which vendor runs each, who to call. An afternoon of work that pays off entirely during a crisis.
Five: then the monitoring, the endpoint management, the new firewall, whatever the vendor is proposing.
Nearly every practice I look at wants to start at five. The first four are unglamorous, and they're where the actual risk lives.
The number that matters more than the monthly
Ask yourself: how long can this practice operate if the systems are down?
Not theoretically. Concretely. If the practice management system is unavailable Monday morning, do you see patients on paper, or do you send them home? If the answer is "we send them home," you know what a day costs you — count the appointments. That number is your real IT budget ceiling, and most owners have never done the multiplication.
A practice billing $8,000 a day that would lose two days to a serious incident is carrying $16,000 of exposure. Against that, an annual spend that felt indulgent starts looking like insurance priced correctly.
What to ask before you sign anything
What am I getting that I'm not getting now, specifically? What's not included that I'll be billed separately for? Who owns the decision about what we buy — you or me? If I leave, what do I take with me, and in what format? What does the first ninety days look like, in deliverables?
A vendor who answers that last one with a list of things that will exist when they're done is worth more than one who answers it with a service description.
The honest summary
For most practices under twenty people: a few thousand a year buys the foundation done properly, and a monthly relationship buys someone who keeps it from drifting. Spending more than that without the first four items above is buying a better lock for a door that's propped open.