On a first engagement with a mid-sized practice (8–40 clinicians, shared admin), the brief is pointed at:
- 01Practice-management admin credentials — Genie, Best Practice, Medical Director, or your equivalent — stored in a script, a shared note, or an unencrypted file readable beyond the people approved to use them.
- 02Patient-portal accounts shared between clinicians or front-desk staff — so in an investigation the audit trail names someone who never took the action.
- 03Ad-hoc cloud services — personal Dropbox, Google Drive, messaging apps with patient-identifying content — operating outside the sanctioned tenancy, often unknown to the principal.
- 04Backup running on schedule with no documented restore test on file — the precise evidence underwriters ask for at renewal, and the same evidence accreditation auditors increasingly ask for in IT-lens reviews.
The deliverable is designed to be readable by clinical leadership and forwardable to the MSP without edit.