Example Engagement: Ending Imaging Downtime and Securing Surgical Records at an Orthopedic Practice

The practice runs two facilities in Burbank, California — a main clinic where surgeons see patients, read imaging, and plan procedures, and a physical therapy center three miles away where patients complete post-surgical rehabilitation. Between both sites, the practice employs 35 people: orthopedic surgeons, a sports medicine physician, physical therapists, athletic trainers, medical assistants, surgical schedulers, front desk staff, and a billing team.

It handles everything from ACL reconstructions and rotator cuff repairs to sports physicals and chronic joint pain. They perform 12 to 15 surgeries per week at a nearby ambulatory surgical center and manage 60 to 70 PT visits per day at the rehab facility. It's a high-volume, high-stakes operation where imaging and surgical scheduling are the backbone of revenue.

Imaging Infrastructure Was Failing

The practice's PACS (Picture Archiving and Communication System) — the system that stores and displays X-rays, MRIs, and CT scans — ran on a dedicated server at the main clinic that was six years old. The PACS server held over 180,000 imaging studies accumulated since the practice opened. It was the single most critical system in the building.

The server had started showing signs of strain. Image load times had increased from 2 seconds to 8 to 12 seconds over the past year. During peak hours — when three surgeons were reviewing pre-op imaging simultaneously — the system crawled. Twice in the past six months, the PACS had gone completely unresponsive for 45 to 60 minutes, forcing surgeons to delay surgical planning and sending three patients home to be rescheduled.

The PACS server had no redundancy. If the hardware failed, 180,000 imaging studies would be inaccessible until the server was repaired or replaced — a process that could take days. There was no cloud failover. The backup was a tape system that an IT consultant had set up years ago and that nobody had verified since.

Each surgical delay cost the practice an average of $3,800 in rescheduled procedures, wasted OR time, and insurance pre-authorization resets. The PT center couldn't access imaging from the main clinic without requesting a CD burn and sending a staff member to pick it up — a workflow from the 1990s that added 30 to 45 minutes to the first PT session for every post-surgical patient.

Surgical Scheduling Was a Manual Nightmare

Scheduling a surgery at the practice involved a chain of 8 to 10 manual steps: surgeon decides on procedure, scheduler calls the ASC to find OR availability, scheduler calls the patient to confirm the date, scheduler faxes the pre-authorization request to insurance, insurance responds (days later), scheduler calls the patient again to confirm, scheduler sends pre-op instructions, and then someone has to confirm the patient completed their pre-op physical and labs. Any break in the chain meant delays.

Three surgical schedulers managed this process for 12 to 15 surgeries per week. They spent most of their day on the phone — calling the ASC, calling insurance companies, calling patients, and following up on faxes. When a patient cancelled or insurance denied a pre-auth, the cascade of rescheduling calls started over. The schedulers estimated they lost 3 to 5 surgical slots per month to scheduling gaps — procedures that fell through the cracks during the manual coordination process.

At an average surgical revenue of $6,200 per procedure, 4 lost surgeries per month meant $24,800 per month — nearly $300,000 per year — in revenue that disappeared into scheduling chaos.

Two Facilities with No Security

Neither facility had meaningful cybersecurity. The main clinic ran Windows Defender on workstations and had a mid-range firewall from 2020. The PT center had a consumer router and no endpoint protection at all. Both facilities connected through a basic VPN that dropped regularly — usually during the image transfer attempts that required the most bandwidth.

Staff at the PT center shared a single login for the practice management system. Surgical records — operative reports, imaging, anesthesia notes — flowed between the main clinic, the ASC, and the PT center with minimal access controls. The pre-auth faxes sent to insurance companies contained patient SSNs, diagnosis codes, and detailed surgical plans on an unencrypted fax line.

Workers' compensation cases — roughly 30% of the practice's surgical volume — required detailed documentation and imaging that was frequently requested by employers, insurance adjusters, and attorneys. These requests came by email. Staff responded by attaching records to regular, unencrypted email messages.

HIPAA Compliance Didn't Exist

The practice had no security risk assessment. No written policies. No Business Associate Agreements with the ASC, the imaging vendor, the cloud PACS integration, the billing clearinghouse, the workers' comp case management platform, or any of their other vendors. No staff training. No breach response plan.

Surgical records carry some of the highest sensitivity in healthcare — operative reports, anesthesia records, pathology results, and pre-surgical medical clearances. Combined with the workers' comp documentation flowing through unencrypted channels, the practice's compliance exposure was severe.

The Phones Couldn't Handle the Complexity

The practice received 100 to 120 calls per day between both facilities. The call mix was unusually complex: surgical scheduling questions, pre-op and post-op instructions, PT appointment scheduling, workers' comp case inquiries, imaging requests, referral coordination, insurance pre-authorization status, and urgent post-surgical concerns.

Three front desk employees at the main clinic and two at the PT center managed all of it. Hold times averaged 3 minutes. Voicemails stacked up — 20+ per day. Callbacks took 24 to 48 hours. Post-surgical patients calling with urgent concerns about swelling, pain, or wound issues often couldn't get through to clinical staff quickly enough and ended up in the ER — an outcome that was bad for the patient, expensive for the system, and damaging to the practice's reputation.

After hours and on weekends, everything went to voicemail. Post-surgical patients — who have the highest urgency and anxiety — had no way to reach the practice outside business hours.

We assessed both facilities over five days — every server, workstation, imaging system, network path, surgical scheduling workflow, vendor relationship, and compliance document. The findings: a PACS server approaching failure with 180,000 irreplaceable studies, zero cybersecurity at the PT center, shared logins, surgical records flowing through unencrypted fax and email, no HIPAA documentation, and a phone system that couldn't handle the complexity of a surgical practice.

We designed a 75-day plan covering managed IT, cybersecurity, HIPAA compliance, and front office operations across both facilities.

Managed IT: Imaging Reliability and Cross-Site Connectivity

• Cloud-hybrid PACS migration — we migrated all 180,000 imaging studies to a HIPAA-compliant cloud PACS with local caching at the main clinic for speed. Surgeons load images in under 2 seconds regardless of how many providers are viewing simultaneously. The single-point-of-failure server was retired. If local hardware fails, imaging remains accessible through cloud access within seconds.
• Encrypted SD-WAN between facilities — replaced the unreliable VPN with a high-bandwidth secure connection. PT staff now access surgical imaging, operative reports, and treatment plans from the rehab center in real time. No more CD burns. No more 30-minute delays on first PT sessions.
• 24/7 remote monitoring and management across all devices at both facilities — workstations, servers, imaging equipment, and network infrastructure. Automated patch management on every device.
• Cloud backup with immutable storage — surgical records, imaging studies, and patient data replicate hourly to a geographically separate data center. The unverified tape backup was retired. Monthly verified restore tests with documentation.
• Dedicated help desk with guaranteed response under 60 seconds. Both facilities get immediate support without scheduling a tech visit.

Cybersecurity: Protecting Surgical Records and Imaging

• Endpoint detection and response (EDR) on every workstation and server across both facilities — active threat monitoring from a single cybersecurity dashboard.
• Business-grade firewalls with intrusion prevention at both sites. Network segmentation isolating clinical operations, imaging systems, billing, and guest access.
• Email security gateway — blocks phishing and malicious attachments. Encrypted email deployed for all patient communications, referrals, and workers' comp documentation. The unencrypted fax workflow was replaced with a HIPAA-compliant electronic document exchange.
• Shared login elimination — every employee received a unique account with multi-factor authentication. Surgical records access is now tracked to individuals with timestamps.
• Quarterly security awareness training with orthopedic-specific phishing simulations — fake surgical supply order confirmations, spoofed insurance pre-authorization emails, and counterfeit workers' comp case management notifications.

HIPAA Compliance: Surgical Practice Documentation

• Full security risk assessment covering both facilities — every system, every imaging workflow, every surgical record data flow, every workers' comp documentation channel, and every vendor relationship documented with remediation tracking.
• 18 written policies and procedures — including surgical-practice-specific policies for operative report handling, imaging storage and sharing, workers' comp documentation, ASC data exchange, and cross-facility record access.
• Business Associate Agreements — identified 11 vendors who handle PHI (EHR vendor, PACS/imaging vendor, ASC, billing clearinghouse, workers' comp platform, lab integration, e-prescribing, cloud backup, email provider, shredding service, and IT suppliers) and executed signed BAAs with each.
• Staff HIPAA training — all 35 employees completed training with documented sign-off. Role-specific modules covered surgical record handling, imaging access protocols, workers' comp documentation requirements, and cross-facility communication.
• Breach response plan — comprehensive playbook with specific procedures for imaging data incidents and workers' comp record breaches.

AI Receptionist: Surgical Scheduling and Post-Op Support

We deployed an AI-powered phone receptionist across both facilities, configured for the unique complexity of an orthopedic and PT practice.

• PT appointment scheduling — the AI books initial evaluations, follow-up sessions, and recurring therapy visits. It checks therapist availability, matches patients with the right provider based on injury type and insurance, and sends confirmation texts with preparation instructions.
• Pre-op and post-op call handling — the AI answers common questions about surgical preparation (fasting, medication holds, arrival times, what to bring) and post-op recovery (activity restrictions, wound care basics, medication schedules, when to call the surgeon). This reduces clinical staff callback volume by handling the pre/post-op questions that follow standard protocols.
• Post-surgical urgency routing — patients calling with concerning symptoms (excessive swelling, fever, wound drainage, severe pain) are immediately routed to the clinical team with symptom details. The AI distinguishes between routine recovery questions and genuinely urgent concerns.
• Workers' comp and insurance inquiries — the AI provides status updates on pre-authorization requests and routes complex workers' comp questions to the appropriate coordinator.
• After-hours coverage — post-surgical patients calling at 9 PM about pain management or Saturday morning about a PT scheduling question get immediate responses. Urgent surgical concerns are escalated to the on-call surgeon with full context.
• Cross-facility booking — when the main clinic is fully booked for a follow-up, the AI checks availability at the PT center for post-surgical evaluations and vice versa.

The full deployment was completed in 75 days across both facilities. The numbers behind an engagement like this live on our pricing page.

Managed IT: Imaging That Is There When the Surgeon Is

PACS reliability is the whole engagement for an orthopaedic practice. Storage, network and monitoring work removes the failures that used to delay surgical decisions, and studies load quickly enough to review in front of a patient rather than after them.

Imaging downtime stops cascading into rescheduled procedures and idle theatre time.

Cybersecurity: Surgical Records Protected

Operative notes, imaging and implant records are attractive and slow to be noticed when taken. Endpoint protection, email filtering, MFA and encrypted backup are in place across the clinic and the PT site.

HIPAA: Surgical Documentation That Survives Review

Policies, BAAs, risk assessment and training records cover the imaging archive and the surgical documentation specifically, not just the EHR — which is where practices with a PACS tend to be exposed.

AI Receptionist: Post-Op Patients Reach Someone

Post-operative patients call with real anxiety and often outside office hours. The AI receptionist handles routine scheduling and information volume, and routes genuine clinical concern to a person with the context already attached — so nobody sits on hold while the front desk finds their chart.

Running an orthopedic or surgical practice with aging imaging systems and post-op patients reaching voicemail? Book a free consultation and we'll assess your imaging infrastructure, security, compliance, and patient communication.