The scams that land in Decatur inboxes
Small offices seldom face the dramatic version of hacking. What actually arrives is a fake invoice, a hijacked mailbox, a stolen password used from another country, or ransomware let in through an old, unpatched laptop. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints nationwide in 2025, with reported losses of just over $3 billion. Georgia ranked tenth among states for total complaints that year, at 25,936.
Decatur's mix of organizations makes it a natural target. Counseling and medical practices hold health records that sell well and fall under HIPAA. Law offices near the courthouse handle settlement and closing funds, which makes a spoofed email with new wire details very dangerous. Nonprofits pay vendors and hold donor data, often with a small staff that has never been trained to spot a fake. None of them are too small to be noticed, because the attacks are automated and aimed at everyone.
The layers we put in place
- Multifactor sign-in on email, the records system, remote access and every admin account. We set it up so staff approve a prompt on their phone, not type codes all day.
- Email filtering that holds phishing, spoofed senders and bad attachments before they reach anyone, plus a one-click way to report something odd.
- Endpoint detection and response on every computer. If a program starts acting like ransomware, renaming and scrambling files in bulk, the tool can pull that computer off the network.
- People who read the alerts. Alerts go to our team, who look into them and act. They don't sit in an unread inbox.
- Regular patching, with any exceptions written down and reviewed.
- Clean accounts. Departed staff and volunteers removed quickly, admin rights limited and shared passwords moved into a password manager.
- Separate networks for the waiting-room TV, visitor Wi-Fi and security cameras, walled off from practice and client data.
- Short training and realistic test phishing emails, so staff know what a trap looks like.
HIPAA for small practices
Census data shows 68 offices of non-physician mental health practitioners in Decatur's 30030 and 30033 ZIP codes, plus hundreds of other health care establishments. Many are run by one or two clinicians. The HIPAA Security Rule still expects a risk analysis, access controls, audit logs, encryption where it is reasonable and a plan for emergencies. We set up and document the technical side: encrypted devices, secure telehealth, multifactor sign-in, logging and tested backups. We also help you collect business associate agreements from your vendors. Your practice keeps responsibility for its own policies and training records. We give you the evidence to show what is in place.
Practices that treat substance use may also fall under federal confidentiality rules for those records. We can't give legal advice, but we can make sure the technical controls support whatever your counsel advises.
Nonprofits and grant requirements
Grant agreements and funders increasingly ask how an organization protects data. Some ask for multifactor sign-in or a written security policy. We help you answer those questions truthfully, close the gaps that would cause problems and keep costs in line with a nonprofit budget.
If something does happen
If an account is hijacked or malware gets onto a computer, we lock it down quickly, work out what was accessed, restore clean systems and help you decide who needs to be told. That could be clients, patients, your insurer, your bank or a regulator. A short written incident plan, agreed before anything goes wrong, makes those first hours far less frantic.
Where we begin
Our security review looks at mail and cloud settings, recent logins, how each computer is protected, the firewall, the backups and the list of admin accounts. The result is a short report in plain English, ranked by risk. Turning on multifactor sign-in and blocking old login methods can usually happen in the first week or two. After that we keep watching, review accounts monthly and bring a security update to each quarterly meeting.
Questions about cybersecurity
Is antivirus enough for a small practice?
No. Antivirus catches known malware but misses most stolen-password logins and phishing. Multifactor sign-in, email filtering and endpoint detection close those gaps.
Will this help with our cyber insurance renewal?
Usually, yes. Insurers often ask about multifactor sign-in, endpoint detection and protected backups. We help you answer accurately and fix anything that would count against you.
