Table of Contents
Healthcare
What does HIPAA's Security Rule actually require from a medical practice's IT setup?
HIPAA's Security Rule establishes enforceable technical safeguards that every covered entity must implement. Most small practices have heard of HIPAA but have never done the work to verify their IT environment actually satisfies it.
The rule requires unique user credentials for every workforce member. Shared logins are a HIPAA violation and a security liability regardless of how small your practice is. Role-based access controls must limit each employee to only the PHI they need for their specific job function. Your EHR, file servers, and email systems must generate audit logs tracking who accessed what patient data and when, and you must actually review those logs.
Any PHI transmitted over a network must be encrypted. Unencrypted email containing patient information is a violation even if no one intercepts it. Encryption at rest is required for stored PHI.
You also need a contingency plan in writing: a data backup plan, a disaster recovery plan, and an emergency mode operation procedure. HHS auditors will request these documents. Most small practices have none of them.
Most critically, HIPAA requires an annual Security Risk Analysis (SRA) documenting your threats, vulnerabilities, and control gaps. This is the single most-cited deficiency in HHS enforcement actions. A managed IT provider for healthcare handles these technical requirements as part of your standard service agreement and generates the documentation your SRA requires.
How does ransomware affect healthcare practices differently than other businesses?
Healthcare practices face compounded consequences when ransomware hits. Most businesses lose access to files and face recovery costs. Healthcare practices face all of that, plus mandatory HIPAA breach notification to HHS, potential patient care disruptions, and exposure of protected health information to criminals who specifically target it.
Modern ransomware attacks use double extortion. Attackers infiltrate your network, exfiltrate PHI first, then encrypt your systems. Whether you pay or refuse, you almost certainly have a reportable breach under 45 CFR Part 164.400-414. The ransom payment does not satisfy your notification obligation.
The care disruption is unique to healthcare. When EHR systems go offline, staff reverts to paper, medication errors increase, appointments are canceled, and revenue stops. For outpatient practices, recovery takes weeks. The financial damage from a single ransomware incident commonly exceeds what a practice spends on IT in two to three years.
Healthcare is also a preferred target because patient records are more valuable than financial data on dark web markets. A single record combines a Social Security number, insurance identifiers, diagnosis codes, medications, and contact information in one file.
Prevention requires layered controls: endpoint detection and response (EDR) on every device, network segmentation isolating your EHR from general internet traffic, immutable offsite backups tested monthly, and a written incident response plan that names your cyber insurance carrier, your HIPAA attorney, and your managed security provider. Our managed security services include all of these with healthcare-specific configuration.
Legal
What are law firms' cybersecurity obligations under ABA ethics rules?
The ABA has established cybersecurity as a core professional obligation with real disciplinary consequences. Three rules define the framework.
ABA Rule 1.1 (Competence) requires attorneys to maintain competence in the technology relevant to their practice. This includes understanding how your firm stores, transmits, and protects client data. Ignorance of your own IT environment does not satisfy this standard.
ABA Rule 1.6(c) (Confidentiality) requires lawyers to make "reasonable efforts" to prevent unauthorized access to client information. ABA Formal Opinion 477R clarified that "reasonable" scales with data sensitivity. For a practice handling litigation strategy, M&A documents, or criminal defense matters, the bar is high. Storing client files on an unencrypted drive or sharing documents through consumer file-sharing apps does not meet this standard.
ABA Formal Opinion 483 extended these obligations further: attorneys now have a proactive duty to monitor for data breaches and a timely obligation to notify affected clients when one occurs. Discovering a breach months after the fact, because there was no monitoring in place, is itself a compliance failure.
In practice, every law firm must implement multi-factor authentication, encrypt all client communications and stored files, conduct documented security risk assessments, train staff on phishing recognition, and maintain a written incident response plan. State bar associations are increasingly active in investigating firms that fall short. See our full guide to ABA cybersecurity requirements for law firms for a complete breakdown by rule.
Accounting
What is the FTC Safeguards Rule and what does it actually require of CPA and accounting firms?
The FTC Safeguards Rule, substantially updated in 2023, requires financial institutions, including CPA firms, tax preparers, and bookkeeping practices, to implement a comprehensive information security program protecting client financial data. This is an enforceable federal regulation, not an industry guideline.
The rule requires designating a qualified individual to oversee your information security program and report to firm leadership at least annually. You must conduct a written risk assessment identifying threats to client financial data, current controls in place, and documented gaps.
On the technical side, the 2023 amendments added specific mandates that many firms assumed were already covered. Encryption of customer financial data at rest and in transit is now explicitly required. Multi-factor authentication (MFA) is required for all systems containing client financial data, with very limited exceptions. You must have a patch management program keeping software and systems current. Access controls limiting data access to staff who need it for their role are required, not recommended.
You must also develop a written incident response plan covering how the firm responds to a breach, who gets notified, and the timeline for notification. Vendor management is included: any third party with access to client data must be contractually required to maintain appropriate safeguards.
Firms that believed they were compliant under the original Safeguards Rule may not be under the 2023 version. The encryption and MFA mandates are new specificity. Our breakdown of the FTC Safeguards Rule for accounting firms covers every requirement with implementation guidance.
How do accounting firms keep systems secure and available during tax season?
Tax season creates a specific risk pattern for accounting firms. February through April 15 is when downtime is most catastrophic and when security mistakes are most likely to happen simultaneously.
Staff works extended hours under deadline pressure. They move faster through email, approve document requests with less scrutiny, and are more susceptible to social engineering. Attackers know this. Phishing campaigns targeting accounting professionals spike during tax season, with convincing fake IRS notices, fraudulent client document requests, and spoofed software vendor alerts arriving in inboxes when response time pressure is highest.
The right approach operates on two parallel tracks before the season begins.
The first is technical readiness: all systems fully patched before January 1, backup systems verified and tested in December, all staff credentials audited with MFA confirmed on every account including tax software portals, and secure remote access configured for staff working extended hours from home or satellite offices.
The second is incident readiness: your managed IT services provider should have explicit escalation procedures and documented SLAs for your season window. A four-hour response time that's acceptable in August is not acceptable on April 14. Your provider should know your calendar in advance, not learn about it when you call in a panic mid-season.
The controls required by the FTC Safeguards Rule, encrypted storage, MFA, access controls, and a written incident response plan, are also the controls that prevent the specific disasters accounting firms face during their highest-stakes weeks.
Real Estate
How do real estate brokerages protect clients from wire fraud and business email compromise?
Real estate wire fraud is one of the fastest-growing financial crimes targeting small businesses. Attackers compromise the email account of an agent, title company, or closing attorney, monitor the inbox for weeks, then send fraudulent wire transfer instructions to buyers at the moment before closing. A buyer wires their entire down payment to a criminal account. The FBI's Internet Crime Complaint Center reports wire fraud losses in real estate transactions reach hundreds of millions annually. Recovery is rare once funds leave a domestic account.
The attack begins with a compromised email account through a phishing link or a reused password. The attacker reads email silently for days or weeks, learning names, transaction timelines, and communication patterns. When closing approaches, they send fake wire instructions from a spoofed address that differs from the real one by a single character.
Prevention requires layered controls. Email security must detect display name spoofing, look-alike domains, and account takeover behavior. Standard spam filters don't catch these targeted attacks. MFA on every agent email account removes the most common initial attack vector: a stolen password alone can't compromise an MFA-protected account.
Every brokerage needs a written wire verification policy requiring verbal confirmation via a pre-established phone number before any transfer is made. This single control stops most wire fraud attempts cold. Security awareness training for agents reinforces the behavioral side. Our IT services for real estate include all of these controls built around brokerage operations.
Construction
Why are ransomware groups specifically targeting construction companies, and what can firms do about it?
Construction was considered low-priority by cybercriminals for years. That changed as the industry digitized. Project management platforms, BIM files, bid documents, subcontractor contracts, and financial systems now sit on connected networks, often protected by consumer-grade security that hasn't kept pace with the threat landscape.
Ransomware groups target construction firms for specific reasons. Project data including proprietary designs, bid pricing, and financial terms has direct competitive value. Tight margins mean even short downtime creates contractual penalties, cascading schedule delays, and subcontractor conflicts that multiply the financial damage. The operational footprint of a construction business, field teams, mobile devices, subcontractor access, remote job sites, creates significantly more attack surface than a typical office environment. Mid-size firms are large enough to have money but often lack enterprise-grade security.
The typical attack starts with a phishing email targeting a project manager, estimator, or administrator. The attacker gains a foothold, maps the network over days or weeks, identifies where project files and financial systems live, and deploys ransomware when they've positioned themselves to maximize damage.
The most effective controls for construction: EDR on all devices including field laptops and tablets, MFA on all accounts and project management platforms, network segmentation limiting subcontractor access, tested backups stored off-site and off-network, and an incident response plan covering what happens when systems go down at an active job site. Our IT services for construction are built around this operational profile.
IT Management and Managed Services
What is the actual difference between a managed IT provider and break-fix IT support?
Break-fix IT is reactive by design. Something breaks, you call someone, they fix it, you pay per incident. The incentive is fundamentally misaligned: the more things break, the more the provider earns. There is no financial motivation to prevent problems, maintain documentation, or care about your environment between calls.
Managed IT is proactive. A managed service provider (MSP) monitors your systems continuously, applies patches before vulnerabilities are exploited, detects hardware failure before it causes downtime, and maintains your infrastructure in a documented, known state. You pay a flat monthly fee regardless of issue volume. The MSP's incentive aligns with yours: fewer problems means less labor cost for them.
The difference compounds over time. Break-fix environments accumulate technical debt: outdated systems, inconsistent configurations, unpatched vulnerabilities, and no documentation. When something serious goes wrong, there's no baseline to restore to and no institutional knowledge of what normal looks like.
Managed environments maintain configuration baselines, change logs, and tested recovery procedures. Recovery is faster because the environment is known.
For regulated industries, this distinction becomes a compliance issue. Break-fix IT cannot produce the documentation that HIPAA, FTC Safeguards, and ABA ethics require. Managed IT, done correctly, generates compliance documentation as a byproduct of normal operations: patch logs, access audit trails, backup test records, and risk assessment documentation.
A quick test: ask your current IT provider for last month's patch compliance report and your endpoint protection coverage percentage. If they can't produce both within 24 hours, you're paying for break-fix under a different label.
What should every business ask before hiring a managed IT or managed security provider?
Most businesses evaluate MSPs on responsiveness and price. Neither predicts whether your environment will be secure, compliant, or reliably available over time. Here is what to ask instead.
SLAs with real commitments: Ask for their service level agreement and read the remedies section. What response times are guaranteed for critical outages? What happens when they miss those commitments? An MSP confident in their performance backs their SLAs with contractual language.
Security stack specifics: "We handle security" is not an answer. Ask exactly what endpoint protection tool is deployed on client machines. Is it a managed EDR solution with 24/7 SOC monitoring, or consumer antivirus that runs locally and emails you alerts? Ask whether they operate their own security operations center or resell someone else's.
Industry-specific experience and references: Healthcare, legal, and accounting have compliance requirements a generalist IT provider may not satisfy. Ask whether they currently serve clients in your industry, ask for references by name, and call those references. Align their security framework to NIST CSF 2.0 or CIS Controls as a baseline. See our guide on how to choose a managed IT provider for the full evaluation framework.
Onboarding process: Ask how they onboard new clients. A serious provider starts with a full environment audit before deploying any tools. Skip this step and you don't know what you're securing.
Escalation path: Know who handles your account day to day and who gets called at 2am for a critical outage. Get both names in writing before you sign.
Ready to Get Your Questions Answered Directly?
The questions above cover the biggest concerns we hear across every vertical we serve. If your situation doesn't fit neatly into one of them, that is usually a sign you need a conversation, not more FAQ content. Cobrix Solutions works with healthcare practices, law firms, accounting firms, real estate brokerages, and construction companies across the country.
Schedule a Free IT Assessment | Contact Our Team
FAQPage Schema
```json
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "What does HIPAA's Security Rule actually require from a medical practice's IT setup?",
"acceptedAnswer": {
"@type": "Answer",
"text": "HIPAA's Security Rule requires unique user credentials for every workforce member, role-based access controls, audit logs tracking PHI access, encryption for all PHI transmitted over a network, and encryption for stored PHI. It also requires a written contingency plan including a data backup plan, disaster recovery plan, and emergency mode procedure. Most critically, it requires an annual Security Risk Analysis documenting threats, vulnerabilities, and control gaps. This is the most-cited deficiency in HHS enforcement actions."
}
},
{
"@type": "Question",
"name": "How does ransomware affect healthcare practices differently than other businesses?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Healthcare practices face compounded consequences: file loss, recovery costs, mandatory HIPAA breach notification to HHS, potential patient care disruptions, and criminal exposure of protected health information. Modern attacks use double extortion: attackers exfiltrate PHI first, then encrypt systems. Whether you pay or refuse, you almost certainly have a reportable breach. Care disruptions are unique to healthcare: EHR downtime causes appointment cancellations, medication errors, and revenue loss that can take months to recover."
}
},
{
"@type": "Question",
"name": "What are law firms' cybersecurity obligations under ABA ethics rules?",
"acceptedAnswer": {
"@type": "Answer",
"text": "ABA Rule 1.1 requires attorneys to maintain technology competence. ABA Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to client information. ABA Formal Opinion 483 added a proactive duty to monitor for breaches and notify affected clients promptly. In practice, every firm must implement MFA, encrypt client communications and stored files, conduct security risk assessments, train staff on phishing, and maintain a written incident response plan."
}
},
{
"@type": "Question",
"name": "What is the FTC Safeguards Rule and what does it actually require of CPA and accounting firms?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The FTC Safeguards Rule requires CPA firms and tax preparers to implement a comprehensive information security program. The 2023 amendments mandate: a designated qualified individual overseeing security, a written risk assessment, encryption of client financial data at rest and in transit, MFA on all systems containing client data, a patch management program, access controls, a written incident response plan, and security requirements for any vendor with access to client data."
}
},
{
"@type": "Question",
"name": "How do accounting firms keep systems secure and available during tax season?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Tax season requires two parallel tracks. Technical readiness: all systems patched before January 1, backups verified in December, MFA confirmed on all accounts including tax software portals, and secure remote access configured before season begins. Incident readiness: your managed IT provider needs explicit escalation procedures and documented SLAs for your season window, with after-hours coverage. A four-hour response time acceptable in August is not acceptable on April 14."
}
},
{
"@type": "Question",
"name": "How do real estate brokerages protect clients from wire fraud and business email compromise?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Wire fraud starts with a compromised email account. Attackers monitor inboxes for weeks learning transaction timelines, then send fake wire instructions at closing. Prevention requires: advanced email security detecting display name spoofing and look-alike domains, MFA on all agent email accounts, and a written wire verification policy requiring verbal confirmation of wire instructions via a pre-established phone number before any transfer is made. This single procedural control stops most wire fraud attempts."
}
},
{
"@type": "Question",
"name": "Why are ransomware groups specifically targeting construction companies, and what can firms do about it?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Construction firms hold valuable project data including proprietary designs and bid pricing, operate on tight margins where downtime multiplies financial damage, and have large attack surfaces from field devices, mobile workers, and subcontractor access. Effective controls include: EDR on all devices including field laptops, MFA on all accounts and project platforms, network segmentation limiting subcontractor access, tested off-site backups, and an incident response plan covering job site downtime scenarios."
}
},
{
"@type": "Question",
"name": "What is the actual difference between a managed IT provider and break-fix IT support?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Break-fix IT is reactive: something breaks, you pay to fix it. The provider has no incentive to prevent problems. Managed IT is proactive: continuous monitoring, patching before vulnerabilities are exploited, and flat-rate pricing that aligns the provider's incentives with yours. For regulated industries, managed IT also generates the compliance documentation that HIPAA, FTC Safeguards, and ABA ethics require as a byproduct of normal operations. Break-fix IT cannot produce this documentation."
}
},
{
"@type": "Question",
"name": "What should every business ask before hiring a managed IT or managed security provider?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Ask for their SLA and read the remedies section. Ask exactly what endpoint protection tool is deployed and whether there is 24/7 SOC monitoring. Ask for references from clients in your specific industry. Ask how they onboard a new client: a serious provider starts with a full environment audit before deploying any tools. Ask who handles your account day to day and who is on call at 2am for critical outages. Get both names in writing before you sign."
}
}
]
}
```
SEO Metadata
Meta Title: Managed IT and Cybersecurity FAQ | Cobrix Solutions
Meta Description: Expert answers on managed IT and cybersecurity for healthcare, legal, accounting, real estate, and construction businesses. No fluff, just facts.
Primary Keyword: managed IT and cybersecurity FAQ
Secondary Keywords: healthcare IT FAQ, law firm cybersecurity, FTC Safeguards Rule, wire fraud prevention real estate, construction ransomware, managed IT services
URL Slug: /blog/managed-it-cybersecurity-faq
Target Verticals: Healthcare, Legal, Accounting, Real Estate, Construction
Word Count: ~2,700
Number of Questions: 9 (2 healthcare, 1 legal, 2 accounting, 1 real estate, 1 construction, 2 IT management)
Schema Questions: 9