100%

of admin logins now tied to a named person

14

clinic sites moved onto one isolated estate

0

hosting findings at the annual review

21

days from scoping call to cutover

The problem

Coldbrook runs fourteen outpatient clinics and a patient portal for bookings and test results. Each clinic site had been built by a different agency and lived on whichever host that agency preferred, so nobody could say with confidence who had admin access to what. Two sites still ran plugins that had not been updated in three years.

Their compliance team needed one answer before the annual review: where does patient-facing data live, and who can touch it?

What we did

1

Inventoried every site, account and plugin across the fourteen clinics, and flagged anything with a known vulnerability or no clear owner.

2

Moved the patient portal onto its own isolated server in Frankfurt, with no shared database and no shared admin accounts.

3

Consolidated the clinic sites onto a separate cluster with single sign-on, per-site roles and a log of every admin login.

4

Turned on the managed WAF, nightly encrypted backups with a 30-day history, and a written restore test every quarter.

Where it landed

The review closed with no hosting findings. The portal now answers in under 200ms, every admin action is logged against a named person, and the clinic sites are patched in one pass instead of fourteen.

Coldbrook is on Enterprise with a named reliability engineer, and the quarterly restore test is now part of their compliance calendar.

At a glance

Sector

Healthcare

Scale

14 clinic sites and a patient portal

Regions

Frankfurt, London

Plan

Enterprise, isolated servers

Timeline

Three weeks, overnight cutovers