Managing IT security across multiple clinic locations — each with staff, devices, and patient data — requires a consistent security framework that works without a dedicated IT person at each site. Here's how Optimyze built that framework for Skin Institute.
A multi-site healthcare organisation presents a specific set of security challenges: patient health information distributed across multiple locations and systems, staff using devices at different clinics on different days, no dedicated IT security resource at any individual location, and the compliance obligations that come with handling health data under the NZ Privacy Act 2020.
When Optimyze took over management of Skin Institute's IT environment, the security posture across five Auckland clinics was inconsistent — different patch levels on different sites, no centralised MFA enforcement, and no unified visibility into what was happening across the environment as a whole.
Centralised Identity and MFA
The first priority was consistent identity security. Optimyze enrolled all staff in Microsoft Entra ID, deployed MFA via Microsoft Authenticator across every account, and configured Conditional Access policies to block sign-ins from outside New Zealand and from devices not enrolled in Intune. This meant that a clinic staff member using a personal device to access patient systems was blocked — they needed to use a clinic-managed device.
Endpoint Management Across All Sites
With five locations and no IT staff on-site at any clinic, remote device management was essential. All clinic computers were enrolled in Microsoft Intune. This allowed Optimyze to: deploy security patches centrally without visiting each site, enforce BitLocker encryption on all clinic computers, push SentinelOne EDR to every endpoint, and receive automated alerts if any device fell out of compliance (a computer with outstanding patches, disabled security software, or a non-compliant configuration).
The practical outcome: a clinic computer that had been missed in a previous patch cycle was flagged automatically, patched remotely, and brought into compliance without anyone driving to the clinic.
Network Segmentation at Each Clinic
Each clinic location has a segmented network: a dedicated VLAN for clinical systems (the practice management system, patient booking, and clinical devices), a separate VLAN for general staff internet access, and a guest Wi-Fi SSID with no access to internal systems. This means a patient using the clinic Wi-Fi, or a compromised personal device brought by a staff member, cannot reach clinical systems. The clinical VLAN has outbound internet access only to the required cloud services — everything else is blocked by firewall policy.
Security Awareness for Clinical Staff
Clinical staff receive regular simulated phishing campaigns via the Optimyze security awareness platform. The simulations are tailored to healthcare contexts — fake "PHO notification" emails, fake "health system update" notices, and fake "patient portal verification" messages. When staff click, they receive immediate feedback explaining what they should have looked for. Click rates across Skin Institute's clinical staff have dropped consistently over the program's first year.
Multi-site security doesn't require a security person at every location — it requires centralised management that gives you consistent visibility and control across all locations simultaneously. Intune, Entra ID Conditional Access, and EDR provide exactly that.
