VoIP for a Professional Office: What Actually Matters When Choosing
Choosing a phone system for a CPA firm, medical practice or law office, including the compliance questions nobody asks until afterwards.
-
-
Multi Factor Authentication: Doing It Properly, and the Gaps Most Businesses Leave
Not all MFA is equal, and partial coverage is where most businesses actually sit. Which methods to prefer, and the accounts that get forgotten.
-
Dark Web Monitoring: Useful Signal or Expensive Anxiety?
An honest look at what dark web monitoring does and does not tell you, and what to do with the alert when one arrives.
-
The Attacks That Work on Arizona Small Businesses Are Not Technical
The three social engineering patterns that actually succeed against small businesses, drawn from real incident reports, and the one control that stops most of them.
-
The HIPAA Security Rule Overhaul: Where It Actually Stands
The proposed Security Rule update has slipped, and anyone telling you it is imminent is selling something. What the current position is and what to do meanwhile.
-
A Letter Arrived From OCR. What Happens Next.
What an Office for Civil Rights letter usually means, what it will ask for, and the first things to do in the days after it arrives.
-
How to Choose an IT Provider for a Medical Practice, and What to Ask Them
There is no such thing as a HIPAA certified IT company. Here is what to ask instead, and which answers should worry you.
-
Moving Your EHR to the Cloud Without Creating a HIPAA Problem
What to sort out before, during and after an EHR migration so that the move does not leave protected health information somewhere you have forgotten.
-
Business Associate Agreements: What Your Practice Should Require From an IT Vendor
A signed BAA is the start, not the finish. What the agreement should say, what it cannot do for you, and the vendors practices forget to cover.
-
Why a Firewall Is Not Enough: Logging and Monitoring for HIPAA
HIPAA expects you to record and review system activity. What that means in a practice that does not have a security team, and why it matters after an incident.