A default Microsoft 365 tenant is not a hardened one.
Most practices are running a tenant that was configured once, during a migration, by somebody who is no longer involved. Legacy authentication is still enabled, conditional access is unconfigured, the global admin count is higher than anyone would guess, and nobody has looked at the licensing since. All four are findable in an afternoon and fixable in a week.
Included in: Included in every tier.
Six things, described plainly.
No capability matrix and no maturity model. This is what we do, why it matters in a clinical environment, and where the number comes from.
MFA on every path, not just on email
MFA on Microsoft 365 but not on the VPN, the RMM, the practice management system, the imaging portal, or the clearinghouse is the Change Healthcare failure mode exactly: a Citrix remote access portal with stolen credentials and no second factor, 192.7 million individuals affected.
Conditional access built for clinical reality
Device compliance, location, and risk-based policies that survive a nurse on a cellular connection in a driveway. A policy staff route around is a policy that does not exist.
Legacy on-premise systems that Entra cannot reach
Citrix, RDS, VPN, and on-premise EHR need a second factor too. We put Duo in front of them, because the systems that hold the most ePHI are frequently the ones cloud identity cannot see.
Email security after Microsoft
Defender for Office 365 plus an API-layer inspection tier that catches the business email compromise that gets through. No MX change, so no cutover risk.
Licensing you are actually using
Business Premium versus E3 plus add-ons is a real decision with a real number attached. We show the math, including where you are paying for a capability you already own.
Migration without an information-blocking problem
Information blocking enforcement went live February 11, 2026. A practice that cannot produce EHI because of a botched migration or an unrestorable backup has an information-blocking exposure on top of a HIPAA one.
Which tier includes this.
Our rates are published. If a service you need is only in a higher tier, this page says so rather than making you find out in a proposal.
The rest of what we run.
Managed IT and help desk
The day-to-day. Tickets answered by a named pod, not a rotating queue.
Cybersecurity and 24/7 detection and response
24/7 monitored detection with contractual authority to contain, not just to alert.
HIPAA compliance program
The risk analysis, the risk management plan, and the evidence file. The flagship.