Example Engagement: Protecting Reproductive Health Data at an OB/GYN Practice

The practice is an OB/GYN practice in Redondo Beach, California, serving women across the South Bay. Three physicians and a certified nurse midwife manage a panel of 4,800 active patients. It employs 20 people — OB/GYNs, a midwife, nurses, medical assistants, an ultrasound tech, front desk staff, and a billing coordinator. They provide the full scope of women's health: prenatal care, labor and delivery, annual exams, family planning, menopause management, gynecologic surgery, and fertility consultations.

The founding partner built the practice around trust. Her patients share information they don't share with anyone else — reproductive histories, pregnancy complications, fertility struggles, contraceptive choices, and intimate health concerns. Protecting that information wasn't just a legal requirement. It was foundational to the patient relationship.

The problem was that none of it was actually protected.

Reproductive Health Data Required the Highest Sensitivity

OB/GYN records are among the most sensitive in all of healthcare. They contain reproductive histories, pregnancy test results, ultrasound images, contraceptive choices, STI screenings, fertility treatment details, genetic testing results, and mental health screenings during pregnancy. With reproductive healthcare decisions facing increased legal scrutiny in some jurisdictions, the security of this data carries implications beyond HIPAA — it's a matter of patient safety and trust.

The practice stored all of this on systems with no meaningful protection. The EHR ran on a local server from 2019. Ultrasound images were archived on a separate workstation with an external hard drive — accessible to anyone on the network. Prenatal records, including genetic testing results and high-risk pregnancy documentation, flowed between the practice, the hospital's labor and delivery unit, and external labs through regular, unencrypted email.

The ultrasound tech routinely saved fetal images to a personal USB drive to transfer between the imaging workstation and the EHR — a workaround for a broken network integration that nobody had fixed. That USB drive, containing hundreds of ultrasound images with patient names and dates, traveled in her purse between home and the office every day.

The IT Infrastructure Was Fragile

The practice ran on a single server with no redundancy and no cloud failover. The EHR, ultrasound archive, billing system, and lab interface all depended on one machine in a closet. A break-fix technician maintained it for $170 per hour when things broke.

Two months before our engagement, the server experienced a 6-hour outage during a firmware update that went wrong. The practice ran on paper — but an OB practice can't fully function on paper. Ultrasound images were inaccessible. Prenatal lab results couldn't be reviewed. Three patients in their third trimester had their appointments rescheduled because providers couldn't access their pregnancy records to confirm gestational age and risk factors.

Backups ran nightly to a NAS device in the same closet as the server. No offsite replication. No restore testing. If a fire, flood, or ransomware attack destroyed the server room, every record — 12 years of patient histories, ultrasound archives, prenatal records, and surgical documentation — would be permanently lost.

Monthly IT costs swung between $600 and $3,800. The average was $1,900 per month with no monitoring, no security, and no proactive maintenance included.

HIPAA Compliance Was Absent

The practice had never conducted a security risk assessment. It had a privacy notice posted in the waiting room and a template HIPAA acknowledgment form that patients signed at intake. That was the entire compliance program.

No written policies existed for data access, email communication, device management, or breach response. No Business Associate Agreements had been signed with any of the practice's 9 vendors who handle PHI — including the hospital's L&D unit, the ultrasound imaging vendor, the lab interface, the billing clearinghouse, and the genetic testing company. Staff had never completed HIPAA training.

For a practice handling reproductive health records, genetic testing results, and pregnancy data, the compliance gap was severe.

Expectant Mothers Called at All Hours — and Reached Voicemail

An OB/GYN practice has a phone problem that most other specialties don't: genuine urgency at unpredictable hours. Pregnant patients experience contractions, bleeding, reduced fetal movement, water breaking, and preeclampsia symptoms at midnight, on holidays, and during weekends. They need to know whether to go to the hospital, come to the office, or wait until morning.

The practice received 80 to 100 calls per day during business hours. The mix included prenatal appointment scheduling, lab result inquiries, prescription refills, insurance verification, ultrasound scheduling, postpartum check-in questions, and new patient consultations. Three front desk employees managed everything while checking patients in and processing payments.

Hold times averaged 3 minutes during peak morning hours. Voicemails stacked up — 15 to 20 per day. Callbacks took 12 to 24 hours.

After 5 PM and on weekends, calls went to an answering service staffed by operators with no medical training. The operators took a name, number, and a one-line message, then paged the on-call provider. The provider had no context — no patient history, no pregnancy status, no recent visit notes. She had to call the patient back, gather information from scratch, and make a clinical decision based on a phone conversation with no chart access.

The answering service cost $1,800 per month and generated consistent patient complaints. Three patients in the past year had gone to the ER for non-emergency symptoms because they couldn't reach anyone who could help them decide.

We assessed the practice over three days — every device, network path, server, ultrasound archive, lab interface, vendor relationship, compliance document, and phone workflow. The findings: reproductive health data flowing through unprotected systems, a fragile server with no failover, ultrasound images on a USB drive in an employee's purse, zero HIPAA compliance, and an answering service that frustrated patients and providers alike.

We designed a 60-day remediation plan covering HIPAA compliance, cybersecurity, managed IT, and patient communications.

HIPAA Compliance: Protecting the Most Sensitive Records in Healthcare

• Full security risk assessment per HIPAA §164.308(a)(1) — we documented every system that stores, processes, or transmits PHI. For an OB/GYN practice, this includes the EHR, ultrasound archive, genetic testing integrations, lab interfaces, L&D hospital communications, and every channel used to discuss patient care.
• 19 written policies and procedures — including OB/GYN-specific policies for reproductive health data handling, ultrasound image storage and access, genetic testing result communication, prenatal record sharing with hospitals, and enhanced data privacy provisions reflecting the heightened sensitivity of reproductive healthcare information.
• Business Associate Agreements — identified 9 vendors who handle PHI (EHR vendor, ultrasound imaging system, genetic testing company, lab interface, hospital L&D integration, billing clearinghouse, cloud backup, email provider, and IT suppliers) and executed signed BAAs with each.
• Staff HIPAA training — all 20 employees completed training with documented sign-off. Training covered the unique sensitivity of OB/GYN records, proper ultrasound image handling, secure communication of genetic testing results, and the implications of reproductive health data breaches.
• Breach response plan — step-by-step playbook with specific provisions for reproductive health data incidents, including heightened notification requirements and patient support protocols.

Cybersecurity: Locking Down Reproductive Health and Imaging Data

• Endpoint detection and response (EDR) on every workstation and server — active threat monitoring. Our cybersecurity stack protects the systems that store some of the most sensitive patient data in healthcare.
• Ultrasound archive security — migrated the imaging archive from the external hard drive to an encrypted, HIPAA-compliant cloud storage system with role-based access. Only authorized clinical staff can access ultrasound images. The personal USB drive was retired and securely wiped. A direct network integration between the ultrasound system and EHR eliminated the need for manual file transfers.
• Network segmentation — split the single network into four isolated segments: clinical (EHR, ultrasound, lab interface), billing, administrative, and patient Wi-Fi. The ultrasound workstation is on a dedicated clinical segment that can't be reached from the waiting room or administrative network.
• Email security gateway — blocks phishing and malicious attachments. Encrypted email deployed for all communications containing PHI, including prenatal records shared with the hospital and genetic testing results received from labs.
• Multi-factor authentication on every account. Every system access tracked to an individual employee.
• Quarterly security awareness training with OB/GYN-specific phishing simulations — fake lab result notifications, spoofed insurance pre-authorization requests, and counterfeit patient portal messages.

Managed IT: Reliable Infrastructure for Prenatal and Surgical Care

• Cloud migration — moved the EHR and billing systems to a HIPAA-compliant cloud environment with automatic failover. The single-point-of-failure server was retired. If local hardware fails, the practice stays online through cloud access. No more 6-hour outages during firmware updates.
• 24/7 remote monitoring and management across all workstations, the ultrasound system, lab interface, and network equipment. We detect problems before they affect patient care.
• Automated patch management — every device on a scheduled update cycle.
• Cloud backup with immutable storage — patient records, ultrasound archives, and billing data replicate hourly to a geographically separate data center. The NAS device in the server closet was retired. Ransomware cannot encrypt or delete the cloud backups. Monthly verified restore tests.
• Dedicated help desk — a technician on the line right away, not a $170-per-hour visit whenever the old tech could fit them in.

AI Receptionist: 24/7 Coverage That Replaces the Answering Service

We deployed an AI-powered phone receptionist designed for the unique urgency patterns of an OB/GYN practice. This replaced the $1,800/month answering service entirely.

• Pregnancy urgency triage — the AI identifies concerning symptoms (bleeding, contractions before 37 weeks, reduced fetal movement, severe headache with elevated blood pressure, fluid leaking) and routes those calls immediately to the on-call provider with symptom details and the patient's gestational age from the scheduling system. Non-urgent calls are handled or scheduled without waking the provider.
• After-hours and weekend coverage — expectant mothers calling at 11 PM or Sunday morning get immediate, appropriate responses. The AI provides guidance on common late-pregnancy concerns, explains when to go to L&D versus when to call in the morning, and books next-day appointments for non-urgent issues.
• Appointment scheduling — books prenatal visits, annual exams, ultrasound appointments, postpartum check-ups, and new patient consultations in real time. Sends confirmation texts with visit-specific preparation instructions (fasting for glucose testing, full bladder for ultrasound, etc.).
• Lab result and prescription inquiries — the AI checks result availability and provides normal results per provider-set protocols. Abnormal results are flagged for clinical staff callback. Prescription refill requests are routed directly to the clinical team's task queue.
• Smart call routing — billing questions go to billing. Referral requests go to the appropriate coordinator. Clinical questions go to nursing staff. Every routed call includes context.

The full deployment was completed in 60 days. Every plan we offer is published on our pricing page — no hidden quotes.

HIPAA: Reproductive Health Data Handled With the Care It Needs

Reproductive health records carry a sensitivity beyond the ordinary HIPAA baseline, and patients are increasingly conscious of it. Risk assessment, written policies, signed BAAs and documented training are built around that reality rather than a generic template.

The practice can answer precisely how this data is stored, who can reach it and what happens if it is requested.

Cybersecurity: The Imaging Archive Locked Down

Ultrasound studies are both clinically essential and deeply personal. The archive moves behind access control and audit logging, with endpoint protection, email filtering and MFA across the practice.

Managed IT: Outages Stop Interrupting Clinics

Monitoring, patching and backup run to a schedule, and IT cost becomes a flat predictable figure instead of whatever this quarter's failures happened to cost.

AI Receptionist: Expectant Patients Supported Around the Clock

Obstetric patients call at night, and an answering service that takes a message is not support. The AI receptionist answers, handles routine questions and scheduling, and escalates genuine urgency to the on-call clinician immediately — which replaces the answering service line entirely.

Running an OB/GYN practice with sensitive records on unprotected systems and expectant mothers reaching voicemail after hours? Book a free consultation and we'll assess your data security, compliance, IT infrastructure, and patient communication.