Medical, accounting and legal firms hold personal details, financial records, health information, legal documents and identity records. If that information is exposed or unavailable, the firm may face downtime, client concerns and privacy or regulatory obligations.
This checklist gives owners and practice managers a practical starting point. The exact requirements depend on the information you hold and the rules that apply to your profession.
1. Protect accounts and limit access
Require multi-factor authentication for email, file storage, practice systems and remote access. Give everyone an individual account, store passwords in an approved business password manager and keep administrator access separate from daily work.
Give staff only the records needed for their role. Review access when responsibilities change and disable former staff promptly.
2. Verify unusual messages and payments
Treat unexpected attachments, changed bank details and urgent requests for passwords or payment as reasons to pause. Verify the request using a phone number already held in the firm's records, not the details in the message.
Give staff a quick way to report suspicious email without fear of blame.
3. Manage every work device
Install current updates and managed security protection on business computers, phones, applications and network equipment. Someone should review alerts and follow up devices that stop reporting.
Remote workers should use business-managed devices where practical. Keep client or patient records out of personal email, personal storage and shared family computers.
4. Back up important information
Identify the files, email, practice records, billing data and settings the firm needs to recover. Back them up automatically and keep recovery copies protected from the main system.
Test restores at planned intervals. Record what was tested, how long it took and whether anything was missing.
5. Prepare for an incident
Write down who staff should contact, how to report an affected device and who can make urgent business decisions. Include insurer details and a safe communication method if email is unavailable.
The plan should say when the firm will seek legal, privacy, insurance or regulatory advice. Keep an offline copy and test the contact process.
Checks for each type of firm
Medical clinics
Use individual logins in reception and consulting rooms. Review how referrals, scans and patient messages are stored and sent. Limit access to patient information and check who can export it.
Accounting firms
Pay particular attention to tax file numbers, payroll, bank details and client document exchange. Use an approved secure portal for sensitive files where practical and verify payment changes through a trusted contact.
Legal firms
Protect matter files, identity documents, settlement information and trust account processes. Use clear approval steps for payments and verify every change to payment instructions.
Make the checklist routine
Review accounts, access, backups and devices when staff or systems change, not only after an incident. Keep the process short enough to use and clear enough for staff to understand.
Ask JCPIT about a scoped security review for your firm if you want a practical checklist for your practice manager. We will confirm the systems and access involved before identifying technical gaps.
