What changes after the switch.

There was a “computer guy” on speed dial and a fill counter that crawled at exactly the wrong hour — the after-work rush, with people waiting at the window. Nobody could say why it happened, and nobody could say for certain the backups would restore if the dispensing system ever went down. The owner had mostly stopped asking, because asking cost money and rarely changed anything.

• Stabilized the network and put the dispensing system on its own segment, away from guest and back-office traffic.
• Deployed EDR with 24/7 SOC monitoring, and rebuilt the backups as immutable and restore-tested — tested, not assumed.
• Took the PrimeRx vendor calls onto our queue and signed a BAA on day one.
• Pulled the HIPAA evidence into one current folder, so an audit is a conversation rather than a three-week project.

The counter slowdowns stopped. The HIPAA evidence lives in one folder the owner can hand to an auditor. And the invoice is the same number every month — which, on a pharmacy’s margins, turned out to matter almost as much as the fix.

A growing church has the hardest deadline in small business: 9 a.m. Sunday, every Sunday, whether or not the network feels like cooperating. Streaming, the sound booth, and the donor portal all shared one flat network kept alive by volunteers who were generous with their Saturdays and out of their depth by design. The operations pastor spent those Saturdays hoping.

• Segmented streaming and AV onto their own network, away from staff and guest Wi-Fi.
• Put donor-data access behind MFA-enforced identity, so a shared password stops being the only control.
• Gave staff one number that a real engineer answers, instead of a volunteer phone tree.
• Applied the Kingdom Partner Discount — a church’s budget is somebody’s offering, and we price it that way.

Services run on schedule. Donor data sits behind real identity controls. And the operations pastor got hours back every week — the part nobody puts in a proposal, and the first part he mentions.

The office manager was, by default, the IT department. She fielded the EHR vendor’s calls, chased imaging storage that filled faster than anyone had planned for, and quietly hoped the one imaging server would keep going. None of that was in her job description and all of it was on her desk — which is how it goes in a practice that grew faster than its infrastructure.

• Built a dedicated imaging VLAN and put the imaging server on image-level backup.
• Became the EHR vendor liaison — the support ticket is ours to open, chase, and close.
• Assembled the HIPAA evidence binder an auditor actually asks for, and kept it current between audits.

Hours back every week for the front office, and a clinic that is audit-ready by default instead of by scramble. The office manager went back to running the office.

The previous provider kept things running, which is not nothing. But when the NCUA examiner asked for evidence, there wasn’t any to hand over — the controls mostly existed, the proof of them didn’t. Meanwhile the operations VP personally carried the core-banking relationship, so every vendor escalation ran through one person’s calendar.

• Mapped the GLBA Safeguards Rule controls to dated, organized evidence files a reviewer can read.
• Took core-banking vendor coordination onto our queue and off the operations VP’s desk.
• Added monitored, redundant branch connectivity with failover we actually validate.

Exam prep stopped being a fire drill and became a checklist conversation. The last exam took half the time of the one before it, for the plain reason that the evidence was already sitting there.

The firm’s workhorse server was perfectly well behaved in October and came apart every March. Lacerte and UltraTax under full deadline load kept finding a ceiling nobody had ever measured. The managing partner had become the 9 p.m. IT department on the weekends that mattered most, which is an expensive way to bill an hour.

• Right-sized and monitored the tax-software server for peak-season load, not for a quiet October.
• Mapped the IRS WISP controls and put the workpaper data on immutable backup.
• Rolled out the wire-verification playbook to AP and bookkeeping staff, because that is where the money actually leaves.

Two tax seasons, zero server freezes, and a documented WISP behind it. The managing partner went back to being a managing partner in March.

The schedule froze twice a day. The front desk blamed the software, the software vendor blamed the network, and the network was nobody’s job — so the freeze simply became part of the day, worked around by people who had better things to do. Years of imaging records sat on a PC that had never once been backed up, and nobody had noticed.

• Stabilized the practice-management workstations and the imaging server — and got that imaging PC into backup.
• Put boarding cameras and client Wi-Fi on their own segmented networks, off the clinical side.
• Took the Cornerstone and Avimark vendor calls onto our queue.

The freezes stopped inside 30 days. The front desk noticed before the books did — which is usually how you know a fix was real.