Expert answers for healthcare, legal, accounting, real estate, and construction businesses. Select your industry on the left to get started.
HIPAA's Security Rule establishes enforceable technical safeguards that every covered entity must implement. Most small practices have heard of HIPAA but have never done the work to verify their IT environment actually satisfies it.
The rule requires unique user credentials for every workforce member. Shared logins are a HIPAA violation and a security liability regardless of how small your practice is. Role-based access controls must limit each employee to only the PHI they need for their specific job function. Your EHR, file servers, and email systems must generate audit logs tracking who accessed what patient data and when.
Any PHI transmitted over a network must be encrypted. Unencrypted email containing patient information is a violation even if no one intercepts it. Encryption at rest is required for stored PHI.
You also need a contingency plan in writing: a data backup plan, a disaster recovery plan, and an emergency mode operation procedure. HHS auditors will request these documents. Most small practices have none of them.
Most critically, HIPAA requires an annual Security Risk Analysis (SRA) documenting your threats, vulnerabilities, and control gaps. This is the single most-cited deficiency in HHS enforcement actions. Our healthcare IT services handle these requirements as part of your standard service agreement.
Healthcare practices face compounded consequences when ransomware hits. Most businesses lose access to files and face recovery costs. Healthcare practices face all of that, plus mandatory HIPAA breach notification to HHS, potential patient care disruptions, and exposure of protected health information to criminals who specifically target it.
Modern ransomware attacks use double extortion. Attackers infiltrate your network, exfiltrate PHI first, then encrypt your systems. Whether you pay or refuse, you almost certainly have a reportable breach under 45 CFR Part 164.400-414. The ransom payment does not satisfy your notification obligation.
The care disruption is unique to healthcare. When EHR systems go offline, staff reverts to paper, medication errors increase, appointments are canceled, and revenue stops. The financial damage from a single ransomware incident commonly exceeds what a practice spends on IT in two to three years.
Prevention requires layered controls:
Our managed security services include all of these controls with healthcare-specific configuration.
The ABA has established cybersecurity as a core professional obligation with real disciplinary consequences. Three rules define the framework.
ABA Rule 1.1 (Competence) requires attorneys to maintain competence in the technology relevant to their practice. This includes understanding how your firm stores, transmits, and protects client data. Ignorance of your own IT environment does not satisfy this standard.
ABA Rule 1.6(c) (Confidentiality) requires lawyers to make reasonable efforts to prevent unauthorized access to client information. ABA Formal Opinion 477R clarified that "reasonable" scales with data sensitivity. Storing client files on an unencrypted drive or sharing documents through consumer file-sharing apps does not meet this standard.
ABA Formal Opinion 483 extended these obligations further: attorneys now have a proactive duty to monitor for data breaches and a timely obligation to notify affected clients when one occurs. Discovering a breach months after the fact is itself a compliance failure.
In practice, every law firm must:
State bar associations are increasingly active in investigating firms that fall short. See our IT services for law firms and our full guide to cybersecurity requirements for law firms for a complete breakdown by rule.
The FTC Safeguards Rule, substantially updated in 2023, requires financial institutions — including CPA firms, tax preparers, and bookkeeping practices — to implement a comprehensive information security program protecting client financial data. This is an enforceable federal regulation, not an industry guideline.
The rule requires designating a qualified individual to oversee your information security program and report to firm leadership at least annually. You must conduct a written risk assessment identifying threats to client financial data, current controls in place, and documented gaps.
The 2023 amendments added specific mandates that many firms assumed were already covered:
Firms compliant under the original Safeguards Rule may not be under the 2023 version. See our IT services for accounting firms and our full breakdown of the FTC Safeguards Rule for accounting firms for implementation guidance on every requirement.
Tax season creates a specific risk pattern for accounting firms. February through April 15 is when downtime is most catastrophic and when security mistakes are most likely to happen simultaneously.
Staff works extended hours under deadline pressure. Phishing campaigns targeting accounting professionals spike during tax season — with convincing fake IRS notices, fraudulent client document requests, and spoofed software vendor alerts arriving when response time pressure is highest.
Track 1 — Technical Readiness (before January 1):
Track 2 — Incident Readiness:
Our managed IT services include proactive season preparation and documented SLAs that hold up when stakes are highest.
Real estate wire fraud is one of the fastest-growing financial crimes targeting small businesses. Attackers compromise the email account of an agent, title company, or closing attorney, monitor the inbox for weeks, then send fraudulent wire transfer instructions to buyers at the moment before closing. The FBI's Internet Crime Complaint Center reports wire fraud losses in real estate transactions reach hundreds of millions annually. Recovery is rare once funds leave a domestic account.
The attack begins with a compromised email account through a phishing link or a reused password. The attacker reads email silently for days or weeks, learning names, transaction timelines, and communication patterns. When closing approaches, they send fake wire instructions from a spoofed address that differs from the real one by a single character.
Prevention requires layered controls:
The verbal verification policy is the single highest-ROI control available. It stops most wire fraud attempts and costs nothing to implement beyond a written procedure. See our IT services for real estate and our full guide to wire fraud prevention for real estate brokerages.
Construction was considered low-priority by cybercriminals for years. That changed as the industry digitized. Project management platforms, BIM files, bid documents, subcontractor contracts, and financial systems now sit on connected networks often protected by consumer-grade security that has not kept pace with the threat landscape.
Why construction is now a primary target:
Most effective controls for construction firms:
Our IT services for construction and manufacturing are built around this operational profile. See also our guide on managed IT for construction companies.
Break-fix IT is reactive by design. Something breaks, you call someone, they fix it, you pay per incident. The incentive is fundamentally misaligned: the more things break, the more the provider earns. There is no financial motivation to prevent problems, maintain documentation, or care about your environment between calls.
Managed IT is proactive. A managed service provider (MSP) monitors your systems continuously, applies patches before vulnerabilities are exploited, detects hardware failure before it causes downtime, and maintains your infrastructure in a documented, known state. You pay a flat monthly fee regardless of issue volume. The MSP's incentive aligns with yours: fewer problems means less labor cost for them.
The difference compounds over time. Break-fix environments accumulate technical debt: outdated systems, inconsistent configurations, unpatched vulnerabilities, and no documentation. When something serious goes wrong, there is no baseline to restore to.
For regulated industries, this distinction becomes a compliance issue. Break-fix IT cannot produce the documentation that HIPAA, FTC Safeguards, and ABA ethics require. Managed IT generates compliance documentation as a byproduct of normal operations: patch logs, access audit trails, backup test records, and risk assessment documentation.
A quick test: ask your current IT provider for last month's patch compliance report and your endpoint protection coverage percentage. If they cannot produce both within 24 hours, you are paying for break-fix under a different label. See what Cobrix Managed IT includes.
Most businesses evaluate MSPs on responsiveness and price. Neither predicts whether your environment will be secure, compliant, or reliably available over time. Here is what to ask instead.
1. SLAs with real commitments
Ask for their service level agreement and read the remedies section. What response times are guaranteed for critical outages? What happens when they miss those commitments? An MSP confident in their performance backs their SLAs with contractual language.
2. Security stack specifics
"We handle security" is not an answer. Ask exactly what endpoint protection tool is deployed on client machines. Is it a managed EDR solution with 24/7 SOC monitoring, or consumer antivirus that emails you alerts? Ask whether they operate their own security operations center or resell someone else's.
3. Industry-specific experience and references
Healthcare, legal, and accounting have compliance requirements a generalist IT provider may not satisfy. Ask whether they currently serve clients in your industry, ask for references by name, and call those references. Align their security framework to NIST CSF 2.0 or CIS Controls as a baseline. See our full guide on how to choose a managed IT provider for the complete evaluation framework.
4. Onboarding process
A serious provider starts with a full environment audit before deploying any tools. Skip this step and you do not know what you are securing.
5. Escalation path
Know who handles your account day to day and who gets called at 2am for a critical outage. Get both names in writing before you sign.
Ready to put these questions to us? Contact our team or book a free assessment.
Expert IT, security, and AI automation tailored to your industry. No generic advice, no unnecessary upsells.