https://www.beefedupit.com/blog/ Plain-English IT, cybersecurity and HIPAA guidance for small businesses and medical and dental practices. en-us https://www.beefedupit.com/blog/common-security-holes-small-business/ https://www.beefedupit.com/blog/common-security-holes-small-business/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Most small business breaches don't start with genius hackers. They start with ordinary gaps: no multi-factor authentication, reused or shared passwords, former employees who still have access, unpatched computers, untested backups and email that anyone can spoof. Each of the 20 holes in this guide can be checked in about five minutes, and most can be fixed with tools you already pay for, especially if you're on Microsoft 365. https://www.beefedupit.com/blog/backup-and-disaster-recovery-guide/ https://www.beefedupit.com/blog/backup-and-disaster-recovery-guide/ Mon, 05 Oct 2026 12:00:00 GMT Backup & Continuity Good backup means at least three copies of your data, on two kinds of storage, with one copy off-site and one copy that can't be changed or deleted (immutable), plus regular test restores that prove it works. Disaster recovery is the written plan for how fast you get running again. HIPAA requires covered practices to have a data backup plan, a disaster recovery plan and an emergency mode operation plan, and Microsoft 365 data needs its own backup because Microsoft protects the service, not your mistakes. https://www.beefedupit.com/blog/business-associate-agreement-baa-it-guide/ https://www.beefedupit.com/blog/business-associate-agreement-baa-it-guide/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance A business associate agreement (BAA) is the contract HIPAA requires before any vendor creates, receives, maintains or transmits patient information for your practice. Your IT provider, Microsoft 365, backup service, cloud EHR, VoIP phone system, e-fax and secure email vendors almost always need one; your internet provider usually doesn't. Microsoft includes its BAA by default in its Data Protection Addendum, but it doesn't make you compliant — you still have to configure and use the services securely. https://www.beefedupit.com/blog/cyber-insurance-requirements-checklist/ https://www.beefedupit.com/blog/cyber-insurance-requirements-checklist/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Cyber insurers now expect a baseline of security controls before they'll offer coverage: multi-factor authentication on email, remote access and admin accounts; endpoint detection and response (EDR); tested backups kept offline or immutable; regular patching; security training; tight control of admin accounts; and a written incident response plan. The biggest claim risk is answering the application inaccurately. In a 2022 federal case, an insurer got a policy rescinded after a ransomware attack revealed MFA wasn't in place as the application stated. Verify every answer with your IT provider and keep evidence. https://www.beefedupit.com/blog/dental-imaging-network-and-computer-guide/ https://www.beefedupit.com/blog/dental-imaging-network-and-computer-guide/ Mon, 05 Oct 2026 12:00:00 GMT Dental Practice IT Dental imaging needs three things to work reliably: operatory PCs that meet your imaging vendor's specs with sensors plugged directly into rear USB ports, a wired gigabit network to a central imaging server or share, and Windows updates that are tested on one PC before they reach the rest. Size storage for CBCT growth, back up the image files and imaging database together, and keep a written troubleshooting checklist at the front desk. https://www.beefedupit.com/blog/dental-office-it-guide/ https://www.beefedupit.com/blog/dental-office-it-guide/ Mon, 05 Oct 2026 12:00:00 GMT Dental Practice IT A dental office needs reliable practice management software (on a dedicated server or in the cloud), business-grade Windows 11 computers in every operatory, a wired gigabit network for imaging, a phone system that meets 911 rules, internet with automatic failover, tested backups, and HIPAA safeguards like multi-factor sign-in and encryption. Plan it as one system, write down who supports what, and budget for replacing computers every four to five years. https://www.beefedupit.com/blog/ehr-downtime-and-internet-failover-plan/ https://www.beefedupit.com/blog/ehr-downtime-and-internet-failover-plan/ Mon, 05 Oct 2026 12:00:00 GMT Medical Practice IT Every practice needs a written EHR downtime plan, and HIPAA requires the core of it: backups, disaster recovery and emergency-mode operations. The practical plan has five parts: a backup internet line (usually cellular) that fails over automatically, battery backup for network gear, printed or offline downtime reports, paper workflows with a back-entry process, and phones that fail over to cell. Test it at least once a year, because an untested plan usually fails on the day you need it. https://www.beefedupit.com/blog/hipaa-breach-response-plan/ https://www.beefedupit.com/blog/hipaa-breach-response-plan/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance Treat every suspected incident as a possible breach: contain it, preserve evidence, and call your IT provider, cyber insurer and attorney within hours. A breach of unsecured PHI is presumed reportable unless a documented four-factor risk assessment shows a low probability of compromise. Notify affected patients without unreasonable delay and within 60 days of discovery; breaches affecting 500 or more people also require notice to HHS and, if more than 500 residents of a state, the media — while smaller breaches are reported to HHS within 60 days after the end of the calendar year. HHS presumes ransomware that encrypts ePHI is a breach. https://www.beefedupit.com/blog/hipaa-compliant-email-encryption/ https://www.beefedupit.com/blog/hipaa-compliant-email-encryption/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance HIPAA doesn't ban email or name a specific encryption method. It requires you to protect patient data in transit, and encryption is the standard way to do that. Server-to-server TLS is a good baseline but isn't guaranteed, so use message-level encryption, such as Microsoft Purview Message Encryption, for patient information sent outside your practice. Patients can ask to receive their own information by regular, unencrypted email; if they do, warn them of the risk, confirm they still want it, and document it. https://www.beefedupit.com/blog/hipaa-security-risk-assessment-guide/ https://www.beefedupit.com/blog/hipaa-security-risk-assessment-guide/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance A HIPAA security risk assessment (the Security Rule calls it a 'risk analysis') is a required, written evaluation of every threat to the electronic patient data your practice creates, receives, stores or sends — how likely each is, how much harm it would cause, and what you'll do about it. OCR expects it to cover all ePHI, be documented, drive a risk management plan, and be updated regularly. Small practices can use the free HHS SRA Tool; review it at least yearly and after major changes. https://www.beefedupit.com/blog/hipaa-security-rule-checklist-small-practices/ https://www.beefedupit.com/blog/hipaa-security-rule-checklist-small-practices/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance The HIPAA Security Rule (45 CFR Part 164, Subpart C) requires every practice that handles electronic patient data to run a risk analysis, then put administrative, physical and technical safeguards in place and document them. 'Addressable' does not mean optional — you must implement it, or write down why not and use an alternative. For a small practice, Microsoft 365 Business Premium plus a written risk analysis, policies, training, tested backups and signed business associate agreements covers most of the checklist. https://www.beefedupit.com/blog/hipaa-security-rule-proposed-changes/ https://www.beefedupit.com/blog/hipaa-security-rule-proposed-changes/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance In January 2025, HHS proposed the biggest update to the HIPAA Security Rule since 2013: no more 'addressable' safeguards, mandatory MFA and encryption, a written asset inventory and network map, 72-hour restoration, regular vulnerability scans, annual penetration tests and compliance audits. As of October 5, 2026, it is still only a proposal. No final rule has been published, and the federal regulatory agenda lists it as a long-term action with final action targeted for July 2027. The current Security Rule remains in force, and most of the proposed controls are worth doing now because insurers, OCR investigators and attackers already expect them. https://www.beefedupit.com/blog/how-to-choose-a-managed-it-provider/ https://www.beefedupit.com/blog/how-to-choose-a-managed-it-provider/ Mon, 05 Oct 2026 12:00:00 GMT Small Business IT Choose a managed IT provider the way you'd choose a doctor or accountant: check their experience with businesses like yours, how they secure their own systems, what the contract really says about response times, termination and returning your data, and whether they'll sign a business associate agreement if you handle patient data. Ask for references, insist on documentation you own, and plan the handover from your current provider before you sign. https://www.beefedupit.com/blog/hurricane-preparedness-it-florida-business/ https://www.beefedupit.com/blog/hurricane-preparedness-it-florida-business/ Mon, 05 Oct 2026 12:00:00 GMT Backup & Continuity Atlantic hurricane season runs June 1 to November 30. Florida offices should get data into the cloud with tested backups, put servers and network gear on UPS battery backup and off the floor, set up phone forwarding and remote work before a storm, and photograph and inventory equipment for insurance. When a hurricane watch is issued (conditions possible within 48 hours), finish backups and shut down cleanly; after the storm, check for water and power stability before turning anything back on. https://www.beefedupit.com/blog/is-microsoft-365-hipaa-compliant/ https://www.beefedupit.com/blog/is-microsoft-365-hipaa-compliant/ Mon, 05 Oct 2026 12:00:00 GMT HIPAA & Compliance Microsoft 365 can be used in a HIPAA-compliant way, but it is not compliant out of the box. Microsoft includes a HIPAA Business Associate Agreement by default in its Data Protection Addendum for in-scope services like Exchange Online, SharePoint, OneDrive, Teams, Intune and Entra ID. Your practice is still responsible for configuration: multi-factor sign-in, message encryption, data loss prevention, audit logs, device management, retention and a documented risk analysis. For most small practices, Microsoft 365 Business Premium includes the tools to do this; Business Standard leaves important gaps. https://www.beefedupit.com/blog/it-security-for-cpa-firms-ftc-safeguards-wisp/ https://www.beefedupit.com/blog/it-security-for-cpa-firms-ftc-safeguards-wisp/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity CPA and tax preparation firms are 'financial institutions' under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule (16 CFR Part 314) applies to them regardless of size. It requires a written information security program (WISP) with a Qualified Individual, a risk assessment, MFA for anyone accessing your systems, encryption, staff training, vendor oversight and an incident response plan. Since May 13, 2024, firms must also notify the FTC within 30 days of discovering a breach of unencrypted information affecting 500 or more consumers. The IRS reinforces this: preparers confirm they know about their data security obligations when they get or renew a PTIN, and IRS Publication 5708 provides a sample WISP. https://www.beefedupit.com/blog/managed-it-services-cost-guide/ https://www.beefedupit.com/blog/managed-it-services-cost-guide/ Mon, 05 Oct 2026 12:00:00 GMT Small Business IT Most managed IT providers charge a flat monthly fee per user or per device, plus a one-time onboarding fee and separate charges for projects, hardware and software licenses. Published industry surveys show a wide spread, with many providers charging somewhere between $50 and $150 per user or device per month for core support, and security-heavy all-inclusive plans often costing more. The cheapest quote is rarely the cheapest outcome: compare what's included, what's excluded, response times and contract terms, not just the monthly number. https://www.beefedupit.com/blog/mdm-vs-byod-company-managed-devices/ https://www.beefedupit.com/blog/mdm-vs-byod-company-managed-devices/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Letting staff use personal phones for work with zero management means company and patient data lives on devices you can't lock, wipe or even count. Mobile device management (MDM) such as Microsoft Intune fixes this: company-owned devices get full management, and personal phones get app protection policies that guard only work apps and data, so you can remove company data without touching anyone's photos. IT cannot see personal texts, photos, browsing history or the location of a personal phone. https://www.beefedupit.com/blog/medical-office-it-guide/ https://www.beefedupit.com/blog/medical-office-it-guide/ Mon, 05 Oct 2026 12:00:00 GMT Medical Practice IT A small medical practice needs a cloud or hosted EHR with a backup internet line, secure exam-room computers with fast individual sign-in, e-prescribing set up to meet Florida's e-prescribing law and the DEA's two-factor rules for controlled substances, a HIPAA-ready fax and phone setup, managed check-in tablets, and core HIPAA safeguards like multi-factor sign-in, encryption, managed devices and tested backups. Plan these together, sign BAAs with every vendor, and budget for steady replacement. https://www.beefedupit.com/blog/microsoft-365-business-basic-vs-standard-vs-premium/ https://www.beefedupit.com/blog/microsoft-365-business-basic-vs-standard-vs-premium/ Mon, 05 Oct 2026 12:00:00 GMT Microsoft 365 Business Basic gives you email, Teams and web-only Office apps. Business Standard adds the installed desktop apps. Business Premium adds the security and device management most offices actually need: Intune, Defender for Business, Entra ID P1 with Conditional Access, and Purview data protection. As of October 2026 Microsoft lists Basic at $7, Standard at $14 and Premium at $22 per user per month (annual commitment, with Teams), so for any office handling patient, client or financial data, Premium is usually the right default. https://www.beefedupit.com/blog/microsoft-intune-small-business-guide/ https://www.beefedupit.com/blog/microsoft-intune-small-business-guide/ Mon, 05 Oct 2026 12:00:00 GMT Microsoft 365 Microsoft Intune is Microsoft's cloud service for managing and securing company laptops, desktops, phones and tablets. It sets up new PCs automatically with Windows Autopilot, enforces encryption and updates, installs apps, checks that devices are healthy before they can reach company data, and lets you wipe company data from a lost or stolen device. It's included in Microsoft 365 Business Premium, and a small office can usually roll it out in a few weeks. https://www.beefedupit.com/blog/multi-factor-authentication-guide/ https://www.beefedupit.com/blog/multi-factor-authentication-guide/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and Microsoft says it blocks over 99.2% of account compromise attacks. Not all MFA is equal: passkeys and FIDO2 security keys are phishing-resistant, authenticator apps with number matching are a solid baseline, and text-message codes should be a last resort. Small offices on Microsoft 365 should turn on security defaults at minimum, or Conditional Access with Business Premium, and roll out MFA in phases with a plan for shared workstations and staff without company phones. https://www.beefedupit.com/blog/phishing-and-business-email-compromise-guide/ https://www.beefedupit.com/blog/phishing-and-business-email-compromise-guide/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Business email compromise (BEC) cost U.S. victims over $3 billion in 2025, according to the FBI's IC3, and it usually starts with a phishing email that steals a Microsoft 365 sign-in. The best defenses are phishing-resistant MFA, Defender for Office 365 filtering, SPF/DKIM/DMARC on your domain, external-sender tags, alerts on suspicious inbox rules, and, most important, a rule that any new or changed bank details are verified by phone using a number you already have. If money goes out, call your bank to recall it and file at IC3.gov immediately. https://www.beefedupit.com/blog/ransomware-protection-small-business/ https://www.beefedupit.com/blog/ransomware-protection-small-business/ Mon, 05 Oct 2026 12:00:00 GMT Cybersecurity Most ransomware gets in through a phished or reused password, a remote-access system without multi-factor authentication, or an unpatched internet-facing device. The defenses that matter most are MFA on everything, prompt patching, endpoint detection and response (EDR), strong email filtering, no everyday admin rights, and backups attackers can't delete. If you're hit, isolate affected machines, call your IT provider and insurer, report to the FBI, and don't pay without legal advice: the FBI and CISA discourage payment, and Treasury's OFAC warns it can violate sanctions. https://www.beefedupit.com/blog/small-office-network-wifi-phone-guide/ https://www.beefedupit.com/blog/small-office-network-wifi-phone-guide/ Mon, 05 Oct 2026 12:00:00 GMT Small Business IT A reliable small office network has five parts: a business-grade firewall, managed switches with Power over Ethernet, separate networks (VLANs) for staff, guests, phones and specialty devices, properly placed business Wi-Fi access points, and an internet connection sized for your real usage with a backup line that takes over automatically. Add a cloud phone system or Microsoft Teams Phone, good cabling, and a UPS, and most small offices can expect a network that runs for years with little drama. https://www.beefedupit.com/blog/windows-10-end-of-support-what-businesses-should-do/ https://www.beefedupit.com/blog/windows-10-end-of-support-what-businesses-should-do/ Mon, 05 Oct 2026 12:00:00 GMT Small Business IT Microsoft stopped supporting Windows 10 on October 14, 2025. PCs still on it only get security fixes through the paid Extended Security Updates (ESU) program, which costs more each year and ends completely in October 2028. Upgrade any PC that can run Windows 11, replace those that can't, and treat any unpatched Windows 10 PC that touches patient or client data as a security and compliance risk.