Meeting Summary
SBR Meeting completed · June 18, 2026 · Northview Health Partners
The 2026 Strategic Business Review was held on June 18, 2026 with the Northview Health Partners leadership team. The meeting covered the full IT environment, compliance posture, and a strategic technology roadmap. The following is a summary of key takeaways and agreed action items.
Key Takeaways
🔒 Security Gaps
MFA is not enforced for all users and Conditional Access policies are not configured. One legacy server running an end-of-life OS is overdue for decommission, creating HIPAA exposure.
💰 Cost Savings
Decommissioning the legacy server and rightsizing M365 licenses ahead of the December renewal will reduce monthly spend. A multi-year agreement will lock in preferred pricing.
🚀 Strategic Initiatives
Key priorities include completing the Azure AD / Intune migration, deploying guest Wi-Fi across all locations, enforcing MFA, and initiating a hardware refresh for 6 aging workstations.
⚙️ Process Improvements
Northview will consolidate shared device accounts, remove stale user licenses, and introduce a recurring quarterly asset review to maintain accurate lifecycle tracking.
Action Items by Owner
ErikaVicinity
→Provide multi-year agreement renewal options (3 & 5 year)
→Quote hardware refresh for 6 aging workstations
→Lead M365 license review ahead of December renewal
VicinityIT Team
→Configure Conditional Access & enforce MFA for all users
→Decommission NHP-ANCSRV4 (legacy server)
→Deploy guest Wi-Fi across all 5 locations
Sarah ChenNHP Operations
→Confirm list of workstations for recycling
→Review and approve Q3 hardware refresh quote
NHP StaffAll Locations
→Call help desk for disk cleanup ahead of Windows 11 upgrades
→Transition shared devices to consolidated account model
1
Technology Landscape
Northview Health Partners operates five clinic and consulting locations across Alaska (Anchorage, Mat-Su, Kenai, Fairbanks, and Juneau), supporting a mix of healthcare delivery and medical consulting services. The environment relies on Microsoft 365, a hybrid Active Directory setup, and a range of clinical and business applications. As a healthcare organization, HIPAA compliance is a primary driver of IT decisions — particularly around access controls, legacy infrastructure retirement, and device management.
1
Cloud Identity Migration (Hybrid AD → Azure AD / Intune)
The Trend
Healthcare organizations are accelerating the move away from on-premise Active Directory toward Azure AD and Intune. This reduces reliance on aging domain controllers, simplifies remote management, and strengthens compliance posture.
Where Northview Stands
Northview is mid-migration. New computers are Azure AD joined on deployment, but roughly one-third of workstations remain on local AD with user profiles still to be migrated. The plan is to complete this transition by 2027, allowing on-premise AD to be fully retired.
2
HIPAA-Driven Security Hardening
The Trend
Regulators and cyber insurers are increasingly requiring multi-factor authentication, conditional access, and demonstrable endpoint management for organizations that handle protected health information (PHI).
Where Northview Stands
MFA is partially deployed — not all users are covered and no Conditional Access policies are in place. Closing this gap is a top priority this quarter and will also support Northview's cyber insurance renewal.
3
Device Lifecycle & Windows 11 Compliance
The Trend
Windows 10 reached end of life in October 2025. Organizations running Win10 devices — especially those handling PHI — face growing security and compliance exposure without an active upgrade path.
Where Northview Stands
6 workstations remain on Windows 10 and are flagged for replacement. The broader fleet is on a 5-year refresh cycle with the majority of devices well within lifecycle. Full fleet detail is in the Hardware Refresh Plan.
2
Business Alignment
| Business Priority | IT Dependency | Current Status | Notes |
|---|---|---|---|
| Patient Care & Documentation | Athena Health EHR (cloud) | Healthy | Primary clinical system — critical for patient care across all locations. |
| Medical Billing & Coding | AdvancedMD Practice Management | Healthy | Cloud-hosted. Billing team relies on this daily across Anchorage and Mat-Su. |
| Secure Messaging & Communication | Microsoft Teams + Weave | Healthy | Weave on 28 workstations for patient communications. Teams for internal use. |
| Compliance & Access Control | Microsoft Entra ID / MFA | At Risk | MFA not fully enforced. Conditional Access not configured. HIPAA gap. |
| Consulting Operations | Microsoft 365 Suite | Healthy | Full M365 deployment. License rightsizing opportunity identified. |
| Building Automation (Anchorage) | NHP-ANCSRV-BMS | Attention | Building management server — third-party vendor managed. Access via TeamViewer. |
3
IT Health Snapshot
Environment Overview
Total Workstations
88
Active assets across 5 locations
Servers
6
2 physical · 4 virtual + 2 ESXi hosts
Locations
5
ANC · MAT · KEN · FBK · JNU
Active Printers
9
Across all 5 locations
Health Indicators
| Area | Status | Details |
|---|---|---|
| Patch Management | Current | Managed via RMM. All Windows 11 computers are covered. |
| Endpoint Protection (EDR) | Active | SentinelOne EDR deployed across the managed fleet. |
| Backup / BCDR | Healthy | Datto BCDR covers servers; Datto SaaS Protection covers M365. |
| Identity / Directory | In Transition | Hybrid M365 / on-premise AD. ~2/3 of computers Azure AD joined. |
| Network | Healthy | Fortinet FortiGate firewalls at all 5 locations — current firmware, supported. |
| Wireless Network | Review | No dedicated guest Wi-Fi at any location. Recommended for all sites. |
| MFA / Conditional Access | At Risk | Not all users have MFA. No Conditional Access policies configured in Entra ID. |
4
Application Inventory
| Application | Purpose | Platform | Notes |
|---|---|---|---|
| Athena Health | Electronic Health Record (EHR) | Cloud-hosted | Primary clinical system. Accessed via browser — critical for patient care. |
| AdvancedMD | Practice management / billing | Cloud-hosted | Billing and scheduling for all clinic locations. |
| Microsoft 365 | Email, collaboration, productivity | Microsoft (cloud) | Full M365 Business Premium suite. Backed up via Datto SaaS Protection. |
| Weave | VoIP & patient communication | Weave Communications | Installed on 28 workstations. Call history stored locally — migration needed before server decom. |
| Dragon Medical One | Clinical speech recognition | Nuance (cloud) | Used by 6 physicians across Anchorage and Fairbanks locations. |
| Scan-ID | ID / insurance card scanning | CardReader, Inc | Front-office patient intake at 3 locations. |
| Adobe Acrobat Pro / Standard | Document management | Adobe | See Adobe License Report for full breakdown. |
| Building Management System | Building automation (Anchorage) | Third-party / TeamViewer | Hosted on NHP-ANCSRV-BMS. Vendor-supported remotely. |
5
Security Posture
Security Stack
| Control | Solution | Status |
|---|---|---|
| Endpoint Detection & Response | SentinelOne EDR | Active |
| Email Security | Microsoft 365 Defender (Business Premium) | Active |
| Backup / BCDR (Servers) | Datto BCDR | Active |
| Backup (M365) | Datto SaaS Protection | Active |
| Firewall / Network Security | Fortinet FortiGate (all locations) | Current & Supported |
| Multi-Factor Authentication | Microsoft Entra ID | Incomplete |
| Conditional Access | Microsoft Entra ID | Not Configured |
| Identity Management | Microsoft 365 / Hybrid AD | In Transition |
| Patch Management | RMM-managed patching | Active |
| Microsoft Secure Score | Microsoft 365 Defender | 58.4 / 100 |
Microsoft Secure Score
Current Score
58.4 / 100
686 of 1,175 points achieved
NHP Score58.4
Similar-size organizations44.63
Score by Category
Apps88.1%
Identity61.2%
Device49.8%
Data12%
Above Industry Benchmark
NHP's score of 58.4 is above the average of 44.63 for similar organizations — a positive sign. The biggest opportunities are in the Identity (61.2%) and Data (12%) categories, with 98 recommended actions to review.
A Note on Secure Score
Secure Score is based on Microsoft's native tooling only. Security controls such as SentinelOne EDR, Datto BCDR, Fortinet firewalls, and other third-party platforms are not reflected — meaning NHP's overall security posture is stronger than the number alone suggests.
Key Findings
- MFA is not enforced for all users and Conditional Access has no conditions configured in Entra ID — the highest-priority security gap for a HIPAA-regulated organization.
- NHP-ANCSRV4 runs Windows Server 2012 R2 (end of life since October 2023) — a known compliance risk that should be decommissioned this quarter.
- Fortinet firewalls are current and supported at all five locations — a meaningful security advantage over many comparable organizations.
Open Security Gaps
- MFA not fully enforced — Closing this gap is a top priority for HIPAA compliance and cyber insurance eligibility.
- Conditional Access not configured — No device state, location, or risk-based controls are in place in Entra ID.
- NHP-ANCSRV4 — EOL OS — Running Windows Server 2012 R2 with Weave call history and a legacy database. Must be migrated before decommission.
- No guest Wi-Fi at any location — Personal devices share the production network, creating both security and bandwidth concerns.
6
Recommended Initiatives
| Initiative | Priority | Timeline | Rationale |
|---|---|---|---|
| Enable MFA & configure Conditional Access | High | Q3 2026 | Not all users have MFA. No Conditional Access policies set — critical gap in a HIPAA-regulated environment. |
| Decommission NHP-ANCSRV4 | High | Q3 2026 | Running EOL Windows Server 2012 R2. Weave call history and legacy database must be migrated first. |
| Hardware refresh — 6 aging workstations | Medium | Q3 2026 | 6 machines past 5-year lifecycle, still on Windows 10 EOL. Replacement will close the compliance gap. |
| Deploy guest Wi-Fi across all 5 locations | Medium | Q3 2026 | No guest network at any location. Production and visitor traffic on same network — security and bandwidth risk. |
| Complete Azure AD / Intune migration | Medium | 2026–2027 | ~1/3 of workstations remain on local AD. Completing the migration enables full on-premise AD retirement by 2027. |
| M365 license rightsizing | Medium | November 2026 | License audit ahead of December renewal will reduce monthly spend and ensure accurate user counts. |
| Multi-year MSP agreement renewal | Low | Q4 2026 | Current agreement up for renewal. 3 and 5-year options will provide discounted pricing and planning stability. |
7
Budget & Value
Monthly Managed Services
$9,840.00 / mo
Vicinity Agreement
Microsoft Licensing
$2,714.50 / mo
Microsoft 365 & related licenses
Upcoming: Agreement Renewal
Q4 2026
Multi-year pricing options available
Value Delivered
- Maintained 99.8% uptime across all 5 locations with proactive monitoring via RMM and SentinelOne EDR.
- Completed Fortinet firewall refresh at all locations last cycle — Northview now has fully supported, modern network security at every site.
- Deployed Datto BCDR and SaaS backup coverage across all servers and M365 data, ensuring HIPAA-compliant recovery capability.
- Identified MFA and Conditional Access gaps proactively — flagging these before a potential audit or incident.
Upcoming Budget Considerations
- Q3 hardware refresh — replacement of 6 aging Windows 10 workstations.
- NHP-ANCSRV4 decommission and data migration.
- Guest Wi-Fi deployment across all 5 locations.
- MFA and Conditional Access configuration.
- M365 license review and renewal — November/December 2026.
- MSP agreement renewal with multi-year pricing — Q4 2026.
8
Goals & Priorities
Active IT Goals
Goal
Target
Progress
Enable MFA for all users & configure Conditional Access
Q3 2026
Action Required
Decommission NHP-ANCSRV4 (EOL server)
Q3 2026
Action Required
Replace 6 aging Windows 10 workstations
Q3 2026
In Progress
Deploy guest Wi-Fi across all locations
Q3 2026
Not Started
Complete Azure AD / Intune migration
2027
In Progress
Retire on-premise Active Directory
2027
Not Started
Renew MSP agreement (multi-year)
Q4 2026
Not Started
Where We're Headed
- Closing the MFA and Conditional Access gaps to establish a strong identity security baseline — critical for HIPAA compliance and cyber insurance.
- Moving to a fully cloud-managed environment with Azure AD and Intune, eliminating dependency on aging on-premise infrastructure.
- Maintaining a modern, supported network and hardware fleet across all 5 Alaska locations.
- Optimizing licensing spend ahead of the Microsoft December renewal to ensure Northview only pays for what it uses.
9
Next Steps & Meeting Takeaways
The following decisions and action items were agreed upon during the June 18, 2026 SBR meeting.
Meeting Decisions & Takeaways
Enforce MFA & Configure Conditional Access
Vicinity will configure Conditional Access policies in Entra ID to enforce MFA for all users, closing the highest-priority security gap. This will also support Northview's cyber insurance renewal requirements.
VicinityQ3 2026
Decommission NHP-ANCSRV4
The legacy server running Windows Server 2012 R2 will be decommissioned this quarter. Weave call history and the legacy database will be migrated first. This removes a key HIPAA risk from the environment.
Vicinity · NHPQ3 2026
Hardware Refresh — Q3 Quote & Approval
Erika will provide a quote for 6 replacement workstations. Sarah Chen will review and approve before end of Q3 so new hardware can be deployed before the end of the year.
Erika · Sarah ChenQ3 2026
Deploy Guest Wi-Fi Across All Locations
Vicinity will deploy a throttled guest Wi-Fi network at all 5 locations, isolating visitor traffic from the production network and enabling bandwidth controls.
VicinityQ3 2026
M365 License Review & December Renewal
Vicinity and NHP will conduct a full user license review in November to remove stale and shared-device accounts, locking in a lower user count for the Microsoft annual renewal in December.
Vicinity · NHPNovember 2026
Multi-Year MSP Agreement Renewal
Vicinity will provide a new Managed Service agreement with 3-year and 5-year discounted pricing options for Northview to review ahead of the Q4 renewal.
Vicinity to ProvideQ4 2026
Thank you, Northview Health Partners.
We appreciate the trust you place in Vicinity to support your business. Our commitment is to keep your IT reliable, your data secure, and your team focused on delivering exceptional patient care.
Questions? Reach us anytime at support@vicinity.team · (866) 520-6414