IT services in Somerville, NJ

Somerville is the Somerset County seat, a borough of under two and a half square miles with a walkable downtown along Main Street and Division Street and the county courthouse at the eastern end of Main. It also has a Raritan Valley Line station and RWJ University Hospital Somerset on Rehill Avenue.

Those two institutions shape a lot of the small-office work here: law, title and real estate offices that orbit the courthouse, and medical practices that orbit the hospital. Each faces a specific, well-documented risk.

Closings, wire instructions, and the email account that gets taken over

New Jersey real estate closings run through attorneys' offices and title agencies, and both are a well-known target for wire fraud. New Jersey's Department of Banking and Insurance issued a bulletin warning lenders, title companies and real estate licensees about it. The pattern it describes is consistent: someone gets into an email account involved in the transaction, or registers a nearly identical address, waits for the closing, and then sends a plausible message saying the wiring instructions have changed. The bulletin's own conclusion is that diverted funds are very difficult, if not impossible, to recover.

The technical part of the defense is mostly about the email account. Use multi-factor authentication on every mailbox, especially the ones that send wire instructions. Set up an alert when a mailbox quietly adds a forwarding rule, since that's how intruders watch a transaction without being noticed. Remove access for staff who have left. Consider a warning on mail that comes from outside the firm.

The procedural part matters just as much. Wire instructions shouldn't be sent or changed by email alone, and any change gets verified by phone using a number you already had, not one in the message. The bulletin notes that scammers have started hijacking phone numbers too, so a number in the suspicious email doesn't count.

The HIPAA risk analysis most small practices haven't done

The practices around RWJ University Hospital Somerset include hospital-affiliated faculty groups and independent offices. A small independent office often has a front-desk manager who also handles IT, and a binder of HIPAA forms that covers privacy notices but not computers.

The HIPAA Security Rule requires every covered practice, regardless of size, to carry out an accurate and thorough risk analysis: an inventory of where electronic patient information lives, what could go wrong with it, and what's being done about it. Since late 2024 the HHS Office for Civil Rights has run an enforcement initiative focused specifically on missing or inadequate risk analyses. It's also what any insurer or auditor asks for first after an incident.

For a small practice it's a manageable job. List the systems, including the EHR, the scanner at the front desk, email, and the laptop the office manager takes home. Check how each one is protected, write down the gaps and a plan to close them, and revisit it when something changes. We do these assessments and then fix the technical findings, so the document reflects what's actually in place.

What we most often help with in Somerville

• Multi-factor authentication and mailbox-rule alerting for law, title, and real estate offices
• Wire-instruction verification procedures to go with the technical controls
• HIPAA Security Rule risk analyses for small medical and dental practices
• Fixing the technical findings from a risk assessment: encryption, access, backup
• Downtown office networks in older buildings along Main Street
• Computer repair and support for offices and homes

Getting to you in Somerville

Somerville is half an hour or a bit more from North Brunswick, depending on traffic on Route 287 or 22. On-site work is scheduled rather than same-day, and we'll try to do more per visit instead of several short trips. For practices and law offices, we'd rather schedule around your appointments and court dates than show up in the middle of them. Remote support, which covers most email and account work, isn't affected by the distance.

Common questions from Somerville

• We handle real estate closings. What's the single most important thing to secure?

  Every mailbox involved in sending or receiving wire instructions. Turn on multi-factor authentication, alert on new forwarding rules, and remove anyone who no longer works there. Then back that up with a rule that wire instructions are never changed by email alone, and are always confirmed by phone using a number you already have. Most diverted wires start with a compromised or spoofed email, and once the money moves it's very hard to get back.

• How would we know if someone is already reading our email?

  The common signs are mail rules nobody remembers creating, especially ones that forward messages outside the firm or move them to an obscure folder, sign-ins from unfamiliar locations, and clients replying to messages you never sent. In Microsoft 365 and Google Workspace those can all be checked. If you have any suspicion, change the password, sign out all sessions, and then check, in that order.

• We're a small practice. Do we really need a formal HIPAA risk analysis?

  Yes. The Security Rule requires one regardless of practice size, and HHS has run an enforcement initiative focused on missing risk analyses since late 2024. It doesn't have to be a huge document. It has to be accurate: where patient data lives, what the risks are, and what you're doing about them, updated when things change. We can do the assessment and then fix what it finds.

• Our office is in an older building downtown. Is that a problem for the network?

  Sometimes. Older buildings along Main Street tend to have thick walls, wiring added over decades, and a network closet that's really a shelf. The usual fixes are a cable to the places that matter, properly placed access points instead of one router trying to cover everything, and making sure the gear isn't overheating in a closet. We'll look before suggesting anything.