Medical, accounting and legal firms hold the kind of information criminals love: personal details, financial records, health information, legal documents and identity paperwork.
If that information is stolen, locked or exposed, the damage is not just technical. It can lead to lost trust, downtime, client complaints, regulatory problems and a very stressful week for everyone involved.
The good news is that strong cybersecurity does not have to be complicated. This checklist is written for busy business owners and practice managers who want practical steps they can actually use.
Why professional firms are a common target
Cyber criminals often target smaller professional firms because they know you are busy, rely heavily on email, and may not have a full-time IT team watching for problems.
For medical clinics, accounting practices and law firms, the risk is higher because the information you store is sensitive and valuable. Criminals may try to steal it, sell it, use it for identity fraud, or pressure you into paying a ransom to get it back.
Common risks include:
- Fake emails that trick staff into giving away passwords
- Invoices with changed bank details
- Stolen client or patient files
- Locked computers due to ransomware
- Unauthorised access to cloud systems
- Lost laptops or phones containing sensitive data
Your cybersecurity checklist
Use this checklist as a practical starting point. You do not need to fix everything in one day, but every item you address lowers your risk.
1. Turn on multi-factor authentication
Multi-factor authentication means staff need more than just a password to log in. Usually, it is a code or approval on a phone.
This is one of the most effective protections for email, cloud storage, accounting software, practice management systems and remote access. If a password is stolen, the criminal still has another barrier to get through.
Start with:
- Email accounts
- Microsoft 365 or Google Workspace
- Cloud accounting software
- Medical or legal practice systems
- Remote desktop or VPN access
2. Use strong, unique passwords
Reusing passwords is risky. If one website is breached, criminals may try the same password on your email, banking or business systems.
Use a password manager to create and store strong passwords for each account. This is safer than spreadsheets, notebooks or saved browser passwords shared across the team.
Also make sure former staff no longer have access to business systems. When someone leaves, their accounts should be disabled promptly.
3. Protect email from scams
Email is still one of the main ways criminals get into small businesses. They may pretend to be a supplier, client, principal solicitor, doctor, partner or the ATO.
Put simple rules in place so staff know what to do when something feels off. For example, any request to change bank details should be checked by phone using a known number, not the number in the email.
Train staff to watch for:
- Unexpected attachments
- Urgent payment requests
- Emails asking for passwords
- Slight changes in sender names or email addresses
- Links to fake login pages
4. Back up important data
Backups are your safety net if files are deleted, corrupted or locked by ransomware. But a backup only helps if it works and can be restored quickly.
Make sure critical data is backed up regularly, including documents, emails, client files, patient records, billing information and system settings.
Your backup should be:
- Automatic, so it does not rely on someone remembering
- Protected from unauthorised access
- Stored separately from your main systems
- Tested regularly to make sure recovery works
5. Keep computers and software updated
Updates often fix security weaknesses. Delaying them can leave the door open to known attacks.
Keep operating systems, browsers, business software, phones, tablets and security tools up to date. If your firm uses old software that no longer receives updates, it may be time to plan a replacement.
6. Limit access to sensitive information
Not every staff member needs access to every file. Limiting access reduces the damage if an account is compromised or a mistake is made.
For example, reception staff may not need access to all financial records. Junior staff may not need access to archived legal matters. Temporary staff should only have access to what they need for their role.
Review access regularly, especially when staff change roles or leave the business.
7. Secure laptops, phones and remote work
Professional firms often work across offices, court, client sites, home and mobile devices. That flexibility is useful, but it needs to be controlled.
Make sure work devices have screen locks, encryption, security software and the ability to be wiped if lost or stolen. Avoid using personal email accounts or personal cloud storage for client, patient or business files.
If staff work from home, they should use secure access methods and avoid shared family computers for sensitive work.
8. Have a plan for cyber incidents
When something goes wrong, speed matters. A clear plan helps your team respond calmly instead of guessing under pressure.
Your plan should cover:
- Who to contact first
- How to disconnect affected devices
- Who can approve urgent decisions
- How to communicate with clients or patients if needed
- Where backups are located
- When to seek legal, insurance or regulatory advice
Keep a printed copy or offline copy of the plan. If email or files are unavailable, you still need to know what to do.
Extra considerations for medical, accounting and legal firms
Medical clinics
Patient information is highly sensitive. Clinics should pay close attention to access control, secure messaging, backups, and how scanned documents or referral letters are stored and shared.
Be careful with shared logins at reception or consulting rooms. Individual logins make it easier to see who accessed what and reduce confusion if something goes wrong.
Accounting firms
Accounting firms are attractive targets because they handle tax file numbers, payroll, bank details and business financial records.
Be especially cautious around tax time, payment requests and client file sharing. Use secure portals where possible instead of sending sensitive documents by normal email.
Legal firms
Law firms deal with confidential matters, settlements, trust accounts and identity documents. Criminals may attempt invoice redirection or try to intercept settlement details.
Use strict approval steps for payments and trust account transactions. Any change to payment details should be confirmed using a trusted contact method.
Make cybersecurity part of daily business
Cybersecurity is not a one-off project. It is a set of habits, checks and safeguards that protect your firm every day.
The best approach is to keep it simple, documented and reviewed. Staff should know what is expected, who to ask for help, and how to report anything suspicious without fear of blame.
If you are not sure where your firm stands, JCPIT Support can help. We offer a free security check for small businesses, including medical, accounting and legal firms, to identify practical gaps and recommend clear next steps.
Contact JCPIT Support today to book your free security check and get a clearer picture of how well your firm is protected.
