Managed IT for Medical, Legal, and Financial Practices in Springfield, Dayton, and Columbus
A monthly fee runs the protection: 24/7 security monitoring, patching, document backup, staff security training, and a person reviewing every alert. Hands-on work is billed by the hour at our published rate. Two numbers, both on our pricing page, before anyone calls you.
Designed for regulated practices with 2–50 staff that don’t employ internal IT.
Book 15 minutes for written security findings
15 minutes on the phone, then your managed-plan number in writing.
Most of the practices we work with have the same core problem: they need IT that works reliably, keeps them on the right side of their regulators and insurers, and doesn’t require someone on staff who understands firewalls and HIPAA simultaneously. They’ve usually been through one of two experiences — either they’re paying an hourly break-fix provider who shows up after things fail, or they’re cobbling together free tools and hoping nothing breaks during an audit cycle.
Our managed model is different. We put a documented set of security controls on every covered machine, the platform watches them around the clock, and a person reviews every alert. The monthly fee covers that platform. When something needs hands, remote or on-site, it’s billed by the hour at the published rate, so you can see what you paid for people and what you paid for protection.
We’ve been doing this since 2004, and we work exclusively with practices in the 2–50 person range. We know what regulators actually ask for, what insurers actually require on applications, and what controls actually matter at your scale — versus what’s designed for enterprise environments and doesn’t translate to a 12-person medical practice or a 6-attorney law firm.
What the Monthly Fee Runs
The platform services below are covered by the monthly fee, priced per user, device, and site. We’ll give you the exact number at your assessment.
Security Monitoring, Around the Clock
Software on every workstation and server watches for the behavior of an attack, not just known viruses. On the tiers that include it, a 24/7 security operations center reviews what it finds, and a compromised machine can be cut off from the network before anyone arrives at your office. Every alert that reaches us is read by a person.
Encrypted Backups and Disaster Recovery
Document backup is included on every plan: the office files on every covered workstation, backed up twice a day, with versions you can restore yourself at no charge. Full server and system-image backup is a separate product, with immutable, encrypted copies stored offsite so ransomware can’t overwrite them; recovery testing is a separately priced add-on to it.
Email Security and DNS Filtering
Advanced email filtering blocks phishing, malware, and spoofed messages before they reach your inbox. DNS filtering prevents access to known malicious websites across your entire network. Email encryption for sensitive communications and retention/archiving policies configured to your regulatory requirements.
Identity and Access Management
Multi-factor authentication enforced on email, remote access, and administrative accounts. Enterprise password management so your team uses unique, strong passwords without writing them down. Role-based access controls that limit who can see what, and audit logs documenting every login attempt.
Security Awareness Training
Ongoing training with simulated phishing campaigns that test your team’s response to realistic attacks. Completion tracking and certificates for every staff member, kept on record for insurers and regulators. Total annual time commitment per employee: roughly 2–3 hours spread across the year.
Network Management and Patch Management
Firewall configuration and management, automated patch deployment across all workstations and servers, vulnerability scanning, and secure remote access configuration. Updates are applied systematically — not when someone remembers — and the patch status is on record.
What Is Billed by the Hour or Quoted as a Project
These are the jobs that need a person. They are billed at the rates in your agreement, or quoted as a project in writing, and your authorized contacts decide who can approve chargeable work.
Help Desk and On-Site Support
One number to call for any IT issue. Most problems are handled remotely; on-site visits when hardware needs hands — network work, equipment setup, or vendor coordination. Hands-on time is billed by the hour at the published rate, after-hours and weekends at a higher rate. Your staff calls us instead of trying to fix it themselves.
Policy Development and Compliance Documentation
Written security policies covering acceptable use, incident response, data handling, and remote access, aligned to HIPAA, GLBA, Ohio Rule 1.6, FTC Safeguards Rule, and CIS/NIST frameworks. The policy library and staff acknowledgment tracking are quoted as project work.
Answers for Your Insurer or Auditor
When an insurer, auditor, or examiner asks how your controls are set up, we put the answer in writing from the records of what’s actually in place. That’s hands-on work at the published rate.
What We Can Document for You
These records are kept as part of the services you buy. Compiling them for an insurer, auditor, or examiner is hands-on work at the published rate.
✓ Privileged access documentation
✓ Password manager status
✓ SOC monitoring summaries
✓ Patch & vulnerability summary
✓ Vulnerability scan results
✓ Secure remote access config
✓ Backup test results (with the recovery-testing add-on)
✓ Business continuity and disaster recovery plan (project work)
✓ Encrypted email configuration
✓ Retention/hold settings
✓ Phishing simulation results
✓ Policy acknowledgment records
Kept current as the services run. Ready for insurance applications, regulatory examinations, and audit documentation requests.
“I have been a client of Capstone Technology for 16 years. No matter the concern; network issues, software, hardware, HIPPA, you name it, Capstone has the answers. Beyond the technical capabilities, what makes Capstone unique is accessibility and personal touch. I have always worked with Brian and no matter what time of day or night, he has been available. He is always pleasant, attentive and gets the job done. I am proud to be a client of Capstone Technologies Group.”
How This Works in Practice
You call one number. Whether it’s a printer that won’t connect, a new hire who needs accounts set up, a vendor asking technical questions, or a laptop that’s acting strange — you contact Capstone and we handle it. Most issues are handled remotely. On-site visits happen when the situation requires hands-on work.
You don’t manage the security. The monitoring platform watches your environment 24/7. Patches are deployed automatically. Backups run on schedule. Email filtering blocks threats before they reach your inbox. If something needs your attention, we tell you — otherwise, it’s handled.
You don’t assemble the documentation. When your cyber insurance renewal, your regulator, or a malpractice carrier asks about your security controls, we write up the answer from the records of what is actually in place — not a checklist you filled out yourself. That write-up is hands-on work at the published rate.
You know what IT costs every month. One fee for the platform, agreed in writing before we start. Hands-on work shows up as its own line at the published hourly rate, so the January platform number is still the July platform number, and a server problem shows up as hours, not as a mystery.
Our security tiers and rates are published on our pricing page for anyone to read; your managed-IT number is put in writing at the assessment.
How Switching Works
Onboarding takes 2 to 4 weeks depending on the size of your office and what is already in place. We start with the assessment, then put the controls in place in an order that causes the least disruption to your day. Your part is enrolling in multi-factor authentication and finishing the first round of security training.
Industry-Specific Managed IT
The core managed IT services are the same across industries. What changes is the regulatory framework, the compliance documentation, and the specific systems your practice depends on. Each industry page covers the regulations, controls mapping, and evidence requirements specific to your vertical.
“Capstone Technologies has provided service since 2002. They were involved with the installation and maintenance of the network system and continue to provide excellent service at a reasonable cost. I have used their services in multiple businesses and have no hesitation in recommending Capstone Technologies Group. With all the new rules and regulations in relation to security, I am glad to have Brian Sammons from Capstone Technologies for all my IT needs.”
Frequently Asked Questions
The monthly fee runs the platform: endpoint detection with 24/7 security monitoring, DNS filtering, automated patching, remote monitoring, document backup on every workstation, security awareness training for your staff, and a person reviewing every alert. No per-ticket billing for the protection itself — alerts, questions about your covered tools, and the automated response are all inside the monthly price. Hands-on work beyond the stack is billed at the rates in your agreement, and your authorized contacts decide who can approve chargeable work. The monthly fee is based on the users, devices, and sites in your environment.
We develop written security policies, implement the controls those policies describe, and keep the records showing that the controls are operating. The documentation is aligned to whatever regulatory framework applies to your practice — HIPAA, GLBA, Ohio Rule 1.6, FTC Safeguards Rule, or a combination. When your insurer, regulator, or examiner requests documentation, it’s already current and formatted for their requirements. We also coordinate directly with your insurance broker during renewals if needed.
In most cases, yes. We assess what you have during the initial review and tell you honestly what can stay and what needs to be replaced or upgraded. We don’t push unnecessary hardware purchases — if your current equipment supports the security controls we need to deploy, we work with it. If something does need to be replaced, we’ll explain why and give you options at different price points.
Yes. Adding users or devices adjusts your monthly cost proportionally. If you open a second location, we extend the same monitoring, backups, security controls, and documentation to that site. The controls and the records behind them scale with your environment — you don’t need to negotiate a new contract or switch to a different service tier.
Capstone Technologies Group has been providing managed IT and cybersecurity services to Ohio practices since 2004. If you’re currently managing IT without dedicated staff — or paying hourly for reactive support and hoping for the best — we should talk about what a managed model would cost for your environment.
We provide managed IT to practices in Springfield, where we’re based, and in Dayton and Columbus.
Find Out Where Your Security Stands
15-minute call to review your current setup, identify the gaps, and walk through what the managed plan would cost for your practice.
Pick a 15-minute slot that works for you
Managed clients: we acknowledge every support request by phone, email or our portal by the end of the next business day.
Send us the details and we’ll follow up by the end of the next business day
