Managed IT for Medical, Legal, and Financial Practices in Springfield, Dayton, and Columbus
A monthly fee runs the protection: 24/7 security monitoring, patching, document backup, staff security training, and a person reviewing every alert. Hands-on work is billed by the hour at our published rate. Two numbers, both on our pricing page, before anyone calls you.
Designed for regulated practices with 2–50 staff that don’t employ internal IT.
Most of the practices we work with have the same core problem: they need IT that works reliably, keeps them on the right side of their regulators and insurers, and doesn’t require someone on staff who understands firewalls and HIPAA simultaneously. They’ve usually been through one of two experiences — either they’re paying an hourly break-fix provider who shows up after things fail, or they’re cobbling together free tools and hoping nothing breaks during an audit cycle.
Our managed model is different. We put a documented set of security controls on every covered machine, the platform watches them around the clock, and a person reviews every alert. The monthly fee covers that platform. When something needs hands, remote or on-site, it’s billed by the hour at the published rate, so you can see what you paid for people and what you paid for protection.
We’ve been doing this since 2004, and we work exclusively with practices in the 2–50 person range. We know what regulators actually ask for, what insurers actually require on applications, and what controls actually matter at your scale — versus what’s designed for enterprise environments and doesn’t translate to a 12-person medical practice or a 6-attorney law firm.
What’s Included in Your Monthly Cost
The platform services below are covered by the monthly fee, priced per user, device, and site; we’ll give you the exact number at your assessment. Hands-on labor is billed by the hour at the published rate.
24/7 SOC Monitoring and Threat Detection
A Security Operations Center monitors your systems around the clock using endpoint detection and response (EDR) on every workstation and server, SIEM log analysis that correlates events across your environment, and automated containment that isolates compromised machines before an attack spreads. When the monitoring detects a threat at 2am, the machine can be isolated before your staff arrives in the morning.
Encrypted Backups and Disaster Recovery
Document backup is included on every plan: the office files on every covered workstation, backed up twice a day, with versions you can restore yourself at no charge. Full server and system-image backup is a separate product, with immutable, encrypted copies stored offsite so ransomware can’t overwrite them; recovery testing is a separately priced add-on to it.
Email Security and DNS Filtering
Advanced email filtering blocks phishing, malware, and spoofed messages before they reach your inbox. DNS filtering prevents access to known malicious websites across your entire network. Email encryption for sensitive communications and retention/archiving policies configured to your regulatory requirements.
Identity and Access Management
Multi-factor authentication enforced on email, remote access, and administrative accounts. Enterprise password management so your team uses unique, strong passwords without writing them down. Role-based access controls that limit who can see what, and audit logs documenting every login attempt.
Security Awareness Training
Ongoing training with simulated phishing campaigns that test your team’s response to realistic attacks. Completion tracking and certificates for every staff member, kept on record for insurers and regulators. Total annual time commitment per employee: roughly 2–3 hours spread across the year.
Policy Development and Compliance Documentation
Written security policies covering acceptable use, incident response, data handling, and remote access, aligned to HIPAA, GLBA, Ohio Rule 1.6, FTC Safeguards Rule, and CIS/NIST frameworks. The policy library and staff acknowledgment tracking are quoted as project work.
Network Management and Patch Management
Firewall configuration and management, automated patch deployment across all workstations and servers, vulnerability scanning, and secure remote access configuration. Updates are applied systematically — not when someone remembers — and the patch status is on record.
Help Desk and On-Site Support
One number to call for any IT issue. Most problems are handled remotely; on-site visits when hardware needs hands — network work, equipment setup, or vendor coordination. Hands-on time is billed by the hour at the published rate, after-hours and weekends at a higher rate. Your staff calls us instead of trying to fix it themselves.
Answers for Your Insurer or Auditor
When an insurer, auditor, or examiner asks how your controls are set up, we put the answer in writing from the records of what’s actually in place. That’s hands-on work at the published rate.
What We Can Document for You
These records are kept as part of the services you buy. Compiling them for an insurer, auditor, or examiner is hands-on work at the published rate.
✓ Privileged access documentation
✓ Password manager status
✓ SOC monitoring summaries
✓ Patch & vulnerability summary
✓ Vulnerability scan results
✓ Secure remote access config
✓ Backup test results
✓ Business continuity & disaster recovery plan
✓ Encrypted email configuration
✓ Retention/hold settings
✓ Phishing simulation results
✓ Policy acknowledgment records
Updated quarterly. Ready for insurance applications, regulatory examinations, and audit documentation requests.
“I have been a client of Capstone Technology for 16 years. No matter the concern; network issues, software, hardware, HIPPA, you name it, Capstone has the answers. Beyond the technical capabilities, what makes Capstone unique is accessibility and personal touch. I have always worked with Brian and no matter what time of day or night, he has been available. He is always pleasant, attentive and gets the job done. I am proud to be a client of Capstone Technologies Group.”
How This Works in Practice
You call one number. Whether it’s a printer that won’t connect, a new hire who needs accounts set up, a vendor asking technical questions, or a laptop that’s acting strange — you contact Capstone and we handle it. Most issues are handled remotely. On-site visits happen when the situation requires hands-on work.
You don’t manage the security. The monitoring platform watches your environment 24/7. Patches are deployed automatically. Backups run on schedule. Email filtering blocks threats before they reach your inbox. If something needs your attention, we tell you — otherwise, it’s handled.
You don’t assemble the documentation. When your cyber insurance renewal, your regulator, or a malpractice carrier asks about your security controls, we write up the answer from the records of what is actually in place — not a checklist you filled out yourself. That write-up is hands-on work at the published rate.
You know what IT costs every month. One fee for the platform, agreed in writing before we start. Hands-on work shows up as its own line at the published hourly rate, so the January platform number is still the July platform number, and a server problem shows up as hours, not as a mystery.
Our security tiers and rates are published on our pricing page for anyone to read; your managed-IT number is put in writing at the assessment.
Industry-Specific Managed IT
The core managed IT services are the same across industries. What changes is the regulatory framework, the compliance documentation, and the specific systems your practice depends on. Each industry page covers the regulations, controls mapping, and evidence requirements specific to your vertical.
“Capstone Technologies has provided service since 2002. They were involved with the installation and maintenance of the network system and continue to provide excellent service at a reasonable cost. I have used their services in multiple businesses and have no hesitation in recommending Capstone Technologies Group. With all the new rules and regulations in relation to security, I am glad to have Brian Sammons from Capstone Technologies for all my IT needs.”
Frequently Asked Questions
The monthly fee runs the platform: endpoint detection with 24/7 security monitoring, DNS filtering, automated patching, remote monitoring, document backup on every workstation, security awareness training for your staff, and a person reviewing every alert. No per-ticket billing for the protection itself — alerts, questions about your covered tools, and the automated response are all inside the monthly price. Hands-on work beyond the stack is approved by your authorized contact at the published rate before it starts. The monthly fee is based on the users, devices, and sites in your environment.
A Security Operations Center (SOC) is a team of security analysts supported by automated detection tools that monitor your systems around the clock. It detects, investigates, and responds to threats in real time. This matters because attacks typically deploy outside business hours — nights, weekends, holidays — when nobody at your practice is watching. Without 24/7 monitoring, a ransomware attack that starts Friday evening isn’t discovered until Monday morning, by which point your data may already be encrypted. With SOC monitoring, that same attack can be detected and contained within minutes.
We develop written security policies, implement the controls those policies describe, and keep the records showing that the controls are operating. The documentation is aligned to whatever regulatory framework applies to your practice — HIPAA, GLBA, Ohio Rule 1.6, FTC Safeguards Rule, or a combination. When your insurer, regulator, or examiner requests documentation, it’s already current and formatted for their requirements. We also coordinate directly with your insurance broker during renewals if needed.
Typical onboarding takes 2–4 weeks depending on the size of your environment and what’s already in place. We start with an assessment of your current setup, then deploy controls in a sequence that minimizes disruption to daily operations. Your team’s main involvement is enrolling in MFA and completing their first round of security training. Most of the work happens in the background.
In most cases, yes. We assess what you have during the initial review and tell you honestly what can stay and what needs to be replaced or upgraded. We don’t push unnecessary hardware purchases — if your current equipment supports the security controls we need to deploy, we work with it. If something does need to be replaced, we’ll explain why and give you options at different price points.
Yes. Adding users or devices adjusts your monthly cost proportionally. If you open a second location, we extend the same monitoring, backups, security controls, and documentation to that site. The controls and the records behind them scale with your environment — you don’t need to negotiate a new contract or switch to a different service tier.
Capstone Technologies Group has been providing managed IT and cybersecurity services to Ohio practices since 2004. If you’re currently managing IT without dedicated staff — or paying hourly for reactive support and hoping for the best — we should talk about what a managed model would cost for your environment.
We provide managed IT to practices in Springfield, where we’re based, and in Dayton and Columbus.
Schedule Your IT Assessment
15-minute call to review your current setup, identify the gaps, and walk through what the managed plan would cost for your practice.
Pick a 15-minute slot that works for you
We return every call by the next business day.
Send us the details and we’ll follow up by the end of the next business day
