A behavioral health practice
This behavioral health practice ran a partly remote team. Virtual assistants and contractors, several of them offshore, signed into email, files, and sensitive client records every day. They were good at their jobs. The problem was where they worked. Every one of them signed in from a personal laptop the practice had never seen. There was no device management, no data loss prevention, and no clean way to remove access when someone moved on. The owner knew this quietly, the way most owners do. Client data sat on machines nobody controlled. An offboarding meant hoping a former assistant would simply stop opening files. With protected health information in the mix, that was a risk the practice could no longer carry. They wanted it fixed the week before a scare, not the week after. The risk was not a hacker. It was protected health information living on personal laptops the practice could neither see nor switch off.