Restoring A Multi-Site Medical Practice After Their MSP Failed During A Ransomware Attack
Multi-location women’s health practice, 100+ users, seven clinical sites. Took over mid-crisis from a failing prior MSP. Rebuilt the security stack and infrastructure. The model that defines Hi-Tek’s healthcare practice today.
Client Overview
A multi-location women’s health practice with seven clinical sites and over 100 users. EMR, PACS, and Microsoft Exchange all on premise. HIPAA-regulated. Required clinical-grade uptime and continuity to deliver patient care.
The Situation
The practice had used a competing managed services provider for over ten years. In early 2021, the systems that the prior MSP had deployed and maintained were completely compromised by ransomware. The problem was compounded by the prior MSP’s delayed response and the absence of appropriate backups.
The practice did not have access to their EMR or PACS systems for over a month. Patient care continued through workarounds that were neither sustainable nor safe. The medical director sought alternatives and was referred to Hi-Tek by an existing client who had been through their own transition.
Hi-Tek took over as the practice group’s MSP later in 2021.
What Hi-Tek Did
Initial Stabilization (First 90 Days)
- Immediate helpdesk responsiveness with a 15-minute first-response standard
- Weekly admin visits to clinical sites (doctors and critical users appreciated the in-person presence after a year of remote-only support)
- A dedicated proactive team focused on prevention rather than reaction
- Account management with C-level conversations directly with practice leadership
Security Stack Rebuild
- Identified and remediated remaining traces of the ransomware infection
- Performed a full vulnerability assessment to find and remediate exposures
- Implemented managed detection and response across all endpoints
- Deployed multi-factor authentication on every desktop login
Infrastructure Rebuild
- Replaced the entire server infrastructure with hyperconverged Dell hardware
- Replaced terminal servers with virtual desktop infrastructure
- Migrated 100+ users from physical workstations to thin clients and virtual desktops
- Upgraded servers to current Windows Server platforms
Microsoft 365 And Identity
- Configured Microsoft 365 environment for HIPAA, including business associate agreement, conditional access, and Microsoft Purview sensitivity labels for protected health information
- Standardized identity controls across all clinical and administrative users
Backup And Disaster Recovery
- Image-based backup with off-site replication
- Documented restoration procedures tested on a defined cadence
- Recovery designed for ransomware-grade scenarios, not just incidental file loss
The Outcome
The practice has continued to expand the engagement as additional service lines and locations have come online over the years that followed. Logo retention has been continuous. The practice continues to expand and Hi-Tek continues to run their environment.
The clinical-grade uptime the practice required has been the operational standard since the rebuild. The HIPAA documentation, the security stack, and the cyber insurance posture are all maintained as part of the engagement, not as separate projects.
Why This Case Matters
Healthcare practices that experience a ransomware event survive or fail based on the quality of the response and the rebuild that follows. The technical work matters, but so does the operational discipline of standing up a security stack that prevents the next event, rebuilding identity and access for the long term, and documenting the posture for the regulatory and insurance scrutiny that follows.
This is what concierge-level managed IT looks like when the stakes are real.
Related Capabilities
Healthcare IT And HIPAA Compliance
Multi-site medical, dental, ambulatory care, healthcare manufacturing.
Cyber Security And MDR
EDR everywhere, 24/7 SOC, MFA, conditional access, the carrier-aligned stack.
IT Support
Named senior helpdesk pod, dedicated TAM, vCIO. Sub-30-minute first response.
HIPAA Compliance Tool Hub
Resources for healthcare practices managing HIPAA Security Rule compliance.
Get A Free Assessment
A 30-minute conversation is usually enough to know whether we are the right fit.
Founder-led since 1982. Headquartered in Syosset, NY.