This article outlines our approach to the audit, our findings, and the actionable results that helped the client strengthen data protection, improve system resilience, and prepare for future digital transformation.
Healthcare organizations are custodians of some of the most sensitive personal data — protected health information (PHI). Ensuring the security, reliability, and compliance of IT systems is a regulatory obligation and a vital trust factor for patients and partners.
Mediasapiens was approached by a midsize healthcare provider operating across several regions to conduct a full-scale IT and security audit. The goal was to assess their technical landscape, identify vulnerabilities, and ensure compliance with applicable healthcare regulations such as GDPR, ISO/IEC 27001, and local data protection frameworks.
Table of contents
- Project Background
- Objectives of the Audit
- Scope of Work
- Key Findings
- Deliverables
- Client Results
- Why Mediasapiens
Project Background
The client was managing a distributed network of outpatient clinics and diagnostic centers. Their digital operations included electronic health records (EHR), telemedicine platforms, and third-party lab integrations. The complexity of these systems, combined with legacy infrastructure and manual data handling practices, prompted a proactive security and IT audit.
Mediasapiens was chosen based on our dual expertise in healthcare IT systems and data protection compliance.
Objectives of the Audit
-
Evaluate infrastructure security across all clinics and data centers.
-
Review software architecture, licensing, and data access policies.
-
Assess disaster recovery and backup processes for PHI.
-
Analyze access control mechanisms and role-based permissions.
-
Identify compliance gaps against GDPR, ISO/IEC 27001, and national standards.
-
Provide a strategic plan for improving reliability, data governance, and cybersecurity.
Scope of Work
1. Physical and Infrastructure Security
-
Data Center Assessment: We reviewed power, cooling, and physical access systems. Although some infrastructure met modern standards, outdated HVAC and security camera blind spots were noted.
-
Endpoint Management: A mix of managed and unmanaged devices across clinics posed risks. Several workstations had outdated antivirus software.
-
Environmental Monitoring: Lack of real-time alerting for environmental changes was a critical finding.
2. Network and Connectivity Audit
-
Architecture Review: We mapped the network topology and reviewed segmentation between administrative and clinical systems.
-
Perimeter Defense: Firewall rules, VPN access logs, and external exposure points were evaluated. We found over-permissive outbound traffic rules and inconsistent VPN access policies.
-
Wireless Networks: Public and private Wi-Fi networks were improperly segmented in some clinics.
3. Software Stack and EHR Systems
-
Application Inventory: The core systems included an EHR platform, billing software, and third-party lab integrations. Several integrations were using outdated APIs with weak encryption.
-
Data Transmission: PHI was being transferred between locations and labs via email attachments in some cases — a major compliance risk.
-
Version Control and Licensing: Some locally-developed tools lacked proper documentation and licensing verification.
4. Access Control and User Management
-
Role-Based Access: We reviewed access control lists and permissions, discovering several accounts with excessive rights, including dormant administrator accounts.
-
Authentication Protocols: Multi-factor authentication (MFA) was only enforced in a few systems. Password rotation policies were not enforced.
-
Audit Trails: Log retention policies were inconsistent. In some cases, log files were overwritten within a week.
5. Backup and Disaster Recovery
-
Backup Strategy Review: We assessed data backup routines, storage media, and offsite replication. Daily backups existed but lacked integrity validation.
-
Restore Testing: No regular recovery tests had been performed within the past year.
-
Disaster Recovery Plan (DRP): The DRP was outdated, lacked assigned roles, and missed key procedures for communications and prioritization.
6. Compliance and Policy Review
-
GDPR and ISO/IEC 27001 Alignment: Policies for data collection, retention, and user consent were reviewed. Several gaps in consent tracking and breach notification protocols were noted.
-
Data Subject Rights: The mechanism for patients to access or delete data was not automated, requiring manual intervention.
-
Policy Documentation: Security policies were not centrally maintained or versioned.
Key Findings
Strengths:
-
Committed leadership team with strong focus on digital transformation.
-
Secure core EHR system with encryption at rest and in transit.
-
High backup frequency.
Weaknesses & Risks:
-
Weak endpoint and VPN access management.
-
Inconsistent application security and excessive user rights.
-
Manual data exchange practices risking PHI exposure.
-
Poor auditability due to short log retention windows.
-
Lack of MFA and standard password hygiene.
Deliverables
We delivered a comprehensive audit package including:
-
Full infrastructure and application security report (90+ pages).
-
Network and system architecture diagrams.
-
Data flow and PHI lifecycle maps.
-
A prioritized list of security improvements:
-
Urgent remediations (0–2 months)
-
Policy reforms and technology upgrades (3–6 months)
-
Long-term governance recommendations (6–18 months)
-
-
Updated DRP template with defined RTO/RPO values.
Client Results
After implementing the Mediasapiens recommendations, the healthcare provider achieved:
-
Zero audit violations during subsequent regulatory inspections.
-
40% decrease in open administrator-level accounts.
-
Introduction of MFA across all critical systems.
-
Standardized PHI exchange procedures and encryption protocols.
-
Improved data governance through new consent management workflows.
Why Mediasapiens
-
Healthcare data is different — more sensitive, more regulated, and more targeted by cyberattacks. At Mediasapiens, we bring:
-
Domain-specific knowledge of healthcare IT and medical data workflows.
-
Cross-functional teams with certifications in cybersecurity, ITIL, ISO/IEC 27001.
-
Field-tested audit methodology tailored for regulatory alignment.
-
Practical recommendations based on real-world implementation experience.
The trust of patients, regulators, and partners hinges on how well a healthcare organization protects its data. Through our comprehensive IT and security audit, we helped this client move from reactive to proactive, from vulnerable to resilient.
Whether you manage a single clinic or a multi-location healthcare network, Mediasapiens can help you close security gaps, streamline compliance, and prepare for a digital-first future.
Healthcare deserves secure systems. Let’s build them together.