Securing a medical clinic network and achieving compliance

This network brings together some twenty clinics and several hundred professionals who access electronic medical records every day. Health care organizations are among the favourite targets of ransomware.

The network had no overall view of its risks: shared accounts, unpatched workstations, no centralized monitoring and no incident procedures.

Management also had to demonstrate compliance with the obligations of Law 25, particularly regarding the handling of confidentiality incidents.

KaySolutions carried out a NIST CSF maturity assessment, followed by targeted penetration tests. On that basis, our teams deployed multi-factor authentication, an endpoint detection and response solution and centralized log monitoring.

The program was completed with an incident response plan, a confidentiality incident register, personal information governance policies and a staff awareness campaign.