09/04/2026
Your own account is probably the weakest one in your office.
We see it constantly. The owner skipped the MFA rollout because it was slowing them down. No screen timeout. Password shared with whoever helps with the books.
Meanwhile that's the account that can approve payments, get into everything, and email your whole staff without anyone thinking twice.
Attackers don't care who's in charge. They care what the account can do. Which is why the boss should have the tightest security in the building, not the loosest.
Nobody loves hearing that from their IT guy. But if your staff sees you skipping the login prompt, you don't really have a policy.
We wrote up what else we find walking into medical offices around Virginia. Worth a read even if you're not in healthcare, because most of it applies to any small business.
https://www.topnotchcomputers.com/blog/top-notch-blog-1/hipaa-technology-requirements-for-small-medical-practices-16