How we work, from the first walkthrough to the day you leave

So the way we work is built around explainability. You should know what we found, what we changed, what is still exposed, and who is responsible for each item.

The assessment

We start with a walkthrough of the practice and a set of questions. What we look at:

• Every workstation, server, and imaging device, with its age and role
• The network, including how guest Wi-Fi and clinical systems are separated
• Backup configuration, and the evidence of the last successful restore
• Security controls and the documentation behind them
• Software versions, licensing, and vendor support status
• The internet, phone, and remote access arrangements
• The list of vendors who touch patient data, and which agreements are in place

You get a written summary, a prioritized list of what would fail first, and our reasoning. There is no obligation to continue.

The first two weeks

Documentation comes before changes. We do not arrive with a replacement plan and a purchase order. The first work is inventory, network diagram, admin credentials into a vault you control, and the vendor list with contacts and account references.

Then we agree the order of work and schedule anything disruptive outside clinical hours. Most first-month work is quiet: closing gaps, fixing backups, removing accounts nobody uses, correcting the small things that were never finished.

What we need from you is access, a named contact, and a little time from the person who runs the front desk.

The monthly cadence

Managed work is a loop, not a project:

• Patching on a schedule, with imaging workstations handled separately
• Backup verification, and restore tests that open real data
• Review of alerts and the incidents they represent
• A written summary of what changed, what is outstanding, and what needs a decision from you
• A periodic review of hardware age, licensing, and risk, so next year’s failures are on a budget line

Communication and escalation

Requests go to one address. Urgent means a chair cannot work or patient data is at risk; everything else is handled in order. If a problem needs the owner rather than the office manager, we say so instead of routing it through three people.

We will tell you when we do not know something. That is faster than a confident answer that turns out to be wrong.

Documentation you keep

The inventory, the network diagram, the credential vault, the runbook, and the vendor list belong to the practice. You have them during the engagement and after it, in a form you can hand to another provider.

When something goes wrong

One person owns communication during an incident. You get what we know, what we do not know, and when we will update you again. Afterward, a written review: what happened, what changed, and what would have caught it earlier.

We do not disappear after a bad day. That is when the work is judged.

If you decide to leave

There is an agreed exit process. Credentials are returned or rotated, documentation is handed over, and we answer the incoming provider’s questions. Holding a practice’s data or access to keep the relationship is not something we do.

What we ask of you

A named contact who can make decisions. Access when we need it. A message before you buy software or change a vendor, so the change can be checked against the environment. And early warning when something looks wrong, even if it turns out to be nothing.