Example Engagement: Ransomware Containment and Phone Automation at an Urgent Care Clinic

The clinic operates a single high-volume clinic in Torrance, California. They see 80 to 100 patients per day — walk-ins with fractures, lacerations, fevers, chest pain, and everything in between. It employs 28 people: physicians, physician assistants, nurses, medical assistants, X-ray techs, front desk staff, and a small billing team.

Urgent care isn't like a scheduled practice. Patients don't make appointments weeks in advance. They show up when something is wrong, and they need answers fast. That makes every system in the building — EHR, imaging, labs, billing — mission-critical every minute the doors are open. When a system goes down in an urgent care clinic, it's not an inconvenience. It's a patient safety issue.

A Network That Hadn't Been Touched in Three Years

The clinic's IT infrastructure was built when the clinic opened and never updated. The EHR, digital X-ray system, and billing platform all ran on a single on-premise server in a utility closet. The server was five years old, had no redundancy, and hadn't been patched in 14 months. Every workstation connected through a consumer-grade router — the same model sold at electronics stores for home Wi-Fi.

There was no remote monitoring. No one knew when a hard drive was failing, when a backup didn't complete, or when a workstation stopped receiving security updates. The clinic manager handled IT problems herself by calling a local technician who charged $175 per hour and usually couldn't come until the next day.

The server had crashed twice in the past 18 months. Each time, the clinic ran on paper charts and manual billing until the tech restored things. The first crash cost 6 hours of downtime. The second cost a full day. The clinic manager estimated each hour of downtime cost the clinic $1,100 in lost revenue — patients who left, procedures that couldn't be billed, and staff standing around without access to records.

Cybersecurity Was a Ticking Time Bomb

The security picture was worse than the IT picture — and the clinic manager knew it. A neighboring urgent care two miles away had been hit by ransomware six months earlier. That clinic paid $120,000 to recover their data and was offline for nine days. Patients were diverted to the clinic during the shutdown, which gave the clinic manager a front-row view of what a breach looks like from the outside.

The clinic's own defenses amounted to basic Windows Defender on workstations and the consumer router's built-in firewall. No endpoint detection. No email security gateway. No intrusion prevention. Three workstations in the front office shared a single login — "harbor1 / welcome123" — so any employee could log in without credentials being tied to an individual. Two X-ray techs used personal Gmail accounts to send images to the reading radiologist because the clinic's email didn't support large attachments.

No one at the clinic had completed security awareness training. No one had run a phishing simulation. Staff clicked on emails from unknown senders regularly because no one had told them not to — or shown them what a phishing email looks like.

HIPAA Compliance Was Invisible

The clinic manager had a vague understanding that HIPAA applied to the clinic, but compliance had never been a priority. There was no written security risk assessment — the most commonly cited deficiency in OCR enforcement actions. There were no signed Business Associate Agreements with their EHR vendor, cloud backup provider, billing clearinghouse, or the third-party radiologist who received patient images via Gmail.

The clinic had no breach response plan. No documented policies for data access, device management, or workforce training. No evidence of any HIPAA training for the 28 employees.

If the clinic had been breached — or if a patient had filed a complaint — the lack of documentation alone could have triggered fines starting at $50,000 per violation category. With the number of gaps we later identified, the total fine exposure ran past $300,000.

The Front Desk Was a Bottleneck

The clinic received 120 to 150 phone calls per day. Patients called about wait times, walk-in hours, insurance questions, directions, prescription refills, and follow-up scheduling. Two front desk employees answered phones while simultaneously checking patients in, verifying insurance, collecting copays, and managing the waiting room.

The result was predictable. Calls went unanswered. Patients who couldn't get through either drove to the clinic hoping for the best, went to a competitor, or went to the emergency room. The clinic manager tracked abandoned calls for one week and counted 35 to 40 per day — calls that rang through to voicemail or were hung up after 60+ seconds on hold.

After 6 PM and on weekends, every call went to a generic voicemail. The clinic stays open until 8 PM on weekdays and 5 PM on weekends, but the phone system had never been updated to match the extended hours. Patients calling at 6:30 PM heard "We're currently closed" and hung up — even though the clinic was open and seeing patients.

We started with a full infrastructure and compliance assessment. Our team spent three days on-site auditing every device, network path, software license, user account, backup system, vendor relationship, and compliance document. The assessment uncovered 27 critical vulnerabilities, zero HIPAA-compliant documentation, and a front desk operation that was losing patients every hour.

We designed a 60-day remediation plan covering cybersecurity, managed IT, HIPAA compliance, and front office operations. Nothing was optional — the problems were too interconnected. A firewall upgrade without proper IT monitoring would still leave them exposed. HIPAA documentation without security controls would be paperwork with no substance. We addressed everything together.

Cybersecurity: Layered Defense from Endpoint to Email

• Endpoint detection and response (EDR) deployed on every workstation and server — active threat hunting that catches attacks Windows Defender misses. Our cybersecurity stack monitors behavior patterns, not just known virus signatures.
• Business-grade firewall with intrusion prevention — replaced the consumer router with a next-generation firewall. VPN configured for the radiologist's remote access, eliminating the Gmail workaround.
• Email security gateway — blocks phishing, spoofing, malicious attachments, and suspicious links before they reach inboxes. In the first 30 days, the system intercepted 340 malicious emails that would have landed in staff inboxes.
• Shared login elimination — every employee received a unique account with multi-factor authentication. "harbor1 / welcome123" was permanently retired. Access is now tracked to the individual for every login, file access, and system change.
• Immutable backup system — ransomware cannot encrypt, modify, or delete these backups. Even if an attacker gains full access to the network, the backup data is untouchable. Restores tested monthly.
• 24/7 security operations center (SOC) monitoring — human analysts review alerts around the clock. When the EDR flags something suspicious at 2 AM, a real person investigates — not an automated script.
• Quarterly security awareness training with simulated phishing campaigns — staff learn to recognize suspicious emails through real-world scenarios specific to healthcare (fake appointment confirmations, insurance notices, lab result alerts).
• Penetration test — we found 14 exploitable vulnerabilities, including three workstations with default administrator passwords and an open RDP port that was accessible from the internet.

Managed IT: Reliability That Urgent Care Demands

• 24/7 remote monitoring and management (RMM) — every server, workstation, printer, and network device reports health metrics to our operations center. We catch failing hardware, full disks, and stalled services before they cause downtime.
• Automated patch management — every machine receives security patches and software updates on a scheduled cycle. No more workstations running 14-month-old Windows versions with known vulnerabilities.
• Cloud-hybrid EHR architecture — we migrated the clinic's on-premise server data to a HIPAA-compliant cloud environment while keeping local caching for speed. The single point of failure is gone. If the local hardware fails, the clinic stays online through cloud access within minutes.
• Hourly cloud backups with verified restores — data replicates to a geographically separate data center. We run restore tests monthly and provide the documentation.
• Dedicated help desk with guaranteed response under 60 seconds. Staff call, email, or click a desktop shortcut. No more waiting for the $175/hour tech to call back tomorrow.

HIPAA Compliance: From Zero Documentation to Audit-Ready

• Full security risk assessment per HIPAA §164.308(a)(1) — we documented every system that stores, processes, or transmits protected health information, every data flow between systems, and every vulnerability with a remediation plan.
• 16 written policies and procedures covering data access controls, breach notification, device management, workforce training, email and messaging, remote access, and business associate relationships.
• Business Associate Agreements — we identified 8 vendors who handle PHI (EHR vendor, cloud backup, billing clearinghouse, lab integration, radiology group, shredding service, IT suppliers) and executed signed BAAs with each one.
• Staff HIPAA training — all 28 employees completed training with documented sign-off. New hires must complete training before receiving any system access.
• Breach response plan — a step-by-step playbook so every employee knows what to do, who to call, and how to document an incident. Includes OCR notification timelines and patient communication templates.

AI Receptionist: Every Call Answered, Every Patient Helped

We deployed an AI-powered phone receptionist that answers every inbound call — during business hours, after hours, weekends, and holidays. For a high-volume urgent care clinic, this was transformational.

• Wait time and walk-in availability — the AI provides real-time wait estimates based on current patient volume. Callers hear "Current wait time is about 25 minutes" instead of hold music or voicemail. This alone reduced unnecessary ER visits from patients who assumed the clinic was too busy.
• After-hours and weekend coverage — patients calling at 7 PM or Saturday morning get the same experience as a Tuesday at 10 AM. The AI answers questions about hours, services, insurance accepted, directions, and when to go to the ER instead. It books follow-up appointments in real time.
• Smart call routing — clinical questions, prescription refill requests, and billing disputes get routed to the right staff member with context. The AI tells the employee who's calling, why they're calling, and what information they've already provided. No more blind transfers.
• Follow-up appointment scheduling — after a visit, patients who need follow-up can call and book directly through the AI. It checks availability in the scheduling system and sends a confirmation text. No human involvement needed for routine bookings.
• Voicemail elimination — the clinic turned off voicemail completely. Every call is either handled by the AI or routed live to a staff member. No more piled-up messages. No more missed patients.

The full deployment — cybersecurity, managed IT, HIPAA compliance, and AI receptionist — was completed in 60 days. Our pricing page shows what a package like this costs for a single-location clinic.

Cybersecurity: Ransomware Contained in Minutes

Endpoint detection catches the encryption behaviour as it starts, isolates the affected machine from the network automatically, and pages the security operations centre. Containment happens in minutes, not hours — before the payload can move laterally toward the EHR or the imaging archive.

No patient record is encrypted. No ransom decision has to be made. The clinic keeps seeing patients while the machine is rebuilt from a clean image.

Managed IT: Uptime the Clinic Can Plan Around

Monitoring catches failing hardware before it fails. Patching runs on a schedule instead of whenever someone remembers. Emergency call-outs stop being a line item, because the failures that used to cause them are caught while they are still warnings.

HIPAA: The Review Becomes Paperwork

Risk assessment, BAAs, policies, training records and incident response documentation are current and retrievable. A compliance review turns into a document request rather than a scramble.

AI Receptionist: Calls Answered While Clinicians Work

Most inbound calls — hours, wait times, insurance questions, directions, appointment booking — resolve without a human. The ones that need a person arrive with context, so nobody is put on hold while somebody finds out who they are.

Phone wait times drop, front desk staff stop triaging the queue, and after-hours callers reach something that can actually help instead of a voicemail box nobody clears until morning.

Running an urgent care clinic with consumer-grade security and overwhelmed staff? Book a free consultation and we'll assess your full operation — cybersecurity, IT infrastructure, compliance, and front office workflows.