Selected engagements

The situation

A family medicine and physical therapy practice was moving into a newly constructed two-story clinic building and had no in-house IT staff. The general contractor's plans covered electrical only, the practice's existing network was a single consumer-grade router and unmanaged switches, and the EHR vendor required a documented, HIPAA-compliant network before go-live.

What we did

We designed the building's IT infrastructure from the ground up: a dedicated MDF and IDF with Cat6A structured cabling to every exam room, office, and treatment bay, Cisco Catalyst 9200L PoE switches with separate VLANs for clinical, business, guest, VoIP, and building systems, and a Meraki wireless deployment with a predictive site survey validated after drywall. A FortiGate 60F firewall pair provided edge security, IPsec connectivity to the EHR hosting provider, and content filtering, with UPS protection and environmental monitoring in the network rooms. We coordinated with the electrical and low-voltage contractors, the EHR vendor, and the phone provider so that cutover happened over one weekend.

The result

The clinic opened on schedule with a fully documented network, passed the EHR vendor's connectivity and security checklist on the first review, and the practice adopted the same design standard for a second location the following year.

The situation

A multi-specialty physician group with six clinic locations had grown through acquisition, leaving each site behind a different firewall or ISP-supplied router, several with default settings and no logging. Clinics reached the central EHR and imaging systems over unencrypted ISP links or ad-hoc VPNs, and a HIPAA security risk assessment flagged the lack of consistent perimeter controls and audit logging as high-risk findings.

What we did

We standardized every site on Fortinet FortiGate 60F and 100F firewalls managed centrally through FortiManager, with logging and 12-month retention in FortiAnalyzer. We built a hub-and-spoke IPsec design with SD-WAN failover between primary broadband and LTE backup at each clinic, enabled IPS and SSL inspection profiles tuned for the EHR and imaging traffic, and locked down inbound access to a single hardened path for the practice's remote radiology partner. Each site was cut over during a scheduled evening window with a pre-staged configuration and a tested rollback.

The result

All six clinics were migrated over three months with no lost clinical hours, the two high-risk findings were closed in the follow-up HIPAA risk assessment, and the practice gained a single console for policy, logging, and change control across every location.

The situation

A family-owned stamping and assembly supplier with a single plant and a small office staff had PLCs, HMIs, and its production scheduling server on the same network as email, accounting, and guest Wi-Fi. Machine vendors connected through shared TeamViewer logins whenever they liked, and the supplier's largest OEM customer had flagged the flat network and uncontrolled remote access in its annual supplier security questionnaire.

What we did

We walked the plant floor with the maintenance lead to inventory every networked controller and workstation, then designed a simple Purdue-style separation with an industrial DMZ between the plant and office networks. A FortiGate 100F was deployed at the plant edge with a FortiSwitch rugged layer for the production cells, OT-aware policies were built around what each cell actually needed to talk to, and shared vendor logins were replaced with named accounts, MFA, and time-limited remote sessions through FortiClient. All enforcement was staged during weekend maintenance windows with the plant manager on site.

The result

The plant network was separated from corporate IT with zero unplanned production downtime, vendor access dropped to a handful of named, logged accounts, and the supplier cleared the OEM security questionnaire without conditions at its next review.