Five providers, three kinds of work: firewall and intrusion-prevention upgrades run against an active vendor security advisory, a multi-site data center fabric carried on a standing retainer, and segmentation alongside virtual desktop.
An active advisory sets the schedule from outside. The disclosure timeline is somebody else’s, the exposure window is real while it is open, and the change window is whatever a hospital can survive — which is not much, and never during the hours anyone would prefer. Most of the engineering in that situation is sequencing rather than configuration.
The retainer is the part worth noting about the second one. Architecture that arrives, hands over a design and leaves is a document; the estates that stay healthy are the ones where somebody who knows the design is still reachable a year later. That is the same argument as nineteen years inside one estate, made at consultancy scale.
Under HIPAA, segmentation is not a preference about traffic. It is where the obligation to protect patient information becomes something an auditor can inspect.
Outcome
Segmented estates under HIPAA obligation, and a retained relationship rather than a sequence of unrelated engagements.