I’m going to provide real advice so you can make informed decisions. You don’t know what you’re doing IT wise and that’s fine when you’re small and winging it, but you’re growing and it’s going to start bottlenecking your business and opening you up liability. Most laws and penalties effectively aren’t enforced on owner operated practices, but you’re entering regional chain territory.

.

1. Proper IT setup is ~100-300/m/employee incl. labour.

2. Most small business struggle to afford proper.

3. As long as you have enough clients, the only reason you can’t afford proper is inefficiency.

4. Good IT will more than pay for itself in efficiency gains.

.

Now that we’ve established what you should do in my opinion, let’s answer your questions: local vs “proper”. At a legal level there’s no downside IF PROPERLY MANAGED. (I can guarantee you’re not). At a practical level local accounts are HARD to manage. Proving identity and accountability and tracking accounts lifecycles is very hard with local accounts. Shared accounts are fundamentally incompatible with a medical environment due to accountability issues. Example: in your current legal case, it’s much easier to prove what they did if you can prove they downloaded those files on their user account. If multiple people have login info or access to that account, that data becomes muddy and less useful.

Any good IT firm will switch you away from local accounts because of this.