By ProTelesis Corporation | ProTelesis Blog
In healthcare, an IT outage is a patient-safety event — not just an inconvenience. Davis County, Utah’s hospitals, outpatient clinics, and behavioral health providers run on electronic health records, connected medical devices, and telehealth links that have to stay up, stay private, and stay compliant. When ransomware locks an EHR or a misconfigured network exposes protected health information, the consequences land on patients first and the balance sheet second — which is why healthcare IT carries a higher bar than almost any other industry.
ProTelesis serves Davis County healthcare organizations across Layton, Bountiful, Farmington, Clearfield, Syracuse, and Kaysville with a portfolio purpose-built for environments governed by HIPAA, the HITECH Breach Notification Rule, and the realities of keeping clinical systems online 24×7. Below is a regional view of how the work breaks down — and how to harden a healthcare network against the threats reshaping the sector.
Why Davis County Healthcare IT Carries a Higher Bar
Davis County is one of the fastest-growing counties along Utah’s I-15 Wasatch Front, and its healthcare base has grown with it. The county is served by community hospitals including Davis Hospital & Medical Center in Layton — a 221-bed acute-care facility with a Level III trauma center — and Lakeview Hospital in Bountiful, which carries roughly 128 licensed beds and runs behavioral health, cardiovascular, emergency, and women’s services. Intermountain Health anchors a large outpatient and hospital footprint in the county, including Layton Hospital, alongside a dense web of independent clinics, urgent care, imaging centers, dental and specialty practices, and behavioral health providers.
That ecosystem also serves a population that includes thousands of Hill Air Force Base military families, retirees, and the suburban growth spilling across Syracuse, West Layton, and Farmington. The result is a healthcare market with hospital-grade compliance obligations sitting right next to small independent practices that may have one part-time IT contact — and the same threat actors targeting both.
For a typical small business, “good IT” means uptime, decent backups, and a help desk. For a Davis County healthcare provider, “good IT” includes:
• Demonstrable compliance with the HIPAA Security Rule, HIPAA Privacy Rule, and the HITECH Breach Notification Rule
• A current, documented security risk analysis — still the single most-frequently-cited deficiency in federal HIPAA enforcement
• Ransomware resilience built around immutable, tested backups and network segmentation that stops lateral movement before it reaches the EHR
• High-availability EHR uptime for platforms like Epic, Oracle Health, and MEDITECH, plus reliable telehealth connectivity
• Visibility into and control over connected medical devices (IoMT) that often can’t be patched on a normal cadence
• A managed-services partner that won’t disappear when a breach-notification clock starts ticking
The Compliance Frameworks Driving Local Healthcare IT
If you deliver care — or handle protected health information on behalf of someone who does — a handful of frameworks now drive the majority of IT budget conversations across Davis County.
The HIPAA Security Rule and Privacy Rule
The HIPAA Security Rule is the federal standard that requires covered entities and their business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. It is built on a foundation of risk analysis and risk management: you must identify where ePHI lives, assess the threats to it, and implement reasonable and appropriate controls — access control, audit logging, integrity protection, transmission security, and more. The companion HIPAA Privacy Rule governs how protected health information may be used and disclosed. The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces both, and risk analysis remains the most-cited deficiency in its investigations. You can review the official requirements on the HHS Security Rule page.
The Proposed 2025 HIPAA Security Rule Update — Direction of Travel, Not Yet Law
In January 2025, OCR published a Notice of Proposed Rulemaking (NPRM) to modernize the HIPAA Security Rule for the first time in over a decade — proposing measures such as mandatory multi-factor authentication, encryption of ePHI at rest and in transit, network segmentation, and annual compliance audits. Important: this remains a proposed rule, not enforceable law. The NPRM’s comment period closed in early 2025, the rulemaking was paused under the early-2025 federal regulatory freeze, and no final rule has been issued. The currently enforceable standard is still the 2013 Security Rule. ProTelesis builds environments that satisfy today’s rule while moving clients toward the direction the NPRM signals — MFA, encryption, and segmentation are good security regardless of when (or whether) they become mandatory.
HITECH Breach Notification
The HITECH Act’s Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in larger breaches the media, when unsecured protected health information is compromised. Breaches affecting 500 or more individuals must be reported to HHS without unreasonable delay and within 60 days. That obligation is precisely why incident detection, response, and forensics readiness — not just prevention — belong in every healthcare IT plan.
HHS 405(d) HICP and the HPH Cybersecurity Performance Goals
Beyond the legal floor, HHS publishes voluntary best-practice guidance through its 405(d) Program. The Health Industry Cybersecurity Practices (HICP) publication maps the top threats facing the sector — ransomware, phishing, insider risk, connected-device attacks, and data loss — to practical mitigations scaled for small, medium, and large organizations. The companion Healthcare and Public Health (HPH) Cybersecurity Performance Goals (CPGs) distill those into a prioritized set of high-impact, voluntary practices. Together they have become the de facto benchmark auditors, cyber insurers, and hospital boards reach for. ProTelesis aligns engagements to HICP and the HPH CPGs so clients have a recognized yardstick, not a homegrown checklist.
Healthcare Is the Most-Targeted Sector — and the Stakes Are Patient Safety
Healthcare is now the most-attacked industry for ransomware, and the trend is getting worse rather than better. Sophos research found that roughly two-thirds of healthcare organizations were hit by ransomware in the past year — a four-year high for the sector (Sophos, 2024). The reason healthcare is singled out is simple: attackers know that when a hospital’s EHR goes dark, ambulances divert, surgeries postpone, and the pressure to pay is enormous because lives are on the line.
That changes the entire posture of healthcare IT. Prevention alone is not a strategy — resilience is. The organizations that weather an attack are the ones with segmented networks that contain the blast radius, immutable backups that ransomware can’t encrypt, tested recovery runbooks, and a 24×7 monitoring capability that catches intrusion before it becomes detonation. For Davis County’s hospitals and clinics, that’s the difference between a contained incident and a regional patient-safety event.
How ProTelesis Maps Services to Clinical Operations
ProTelesis is a managed services provider, systems integrator, and carrier-class voice + network specialist. For healthcare organizations in Davis County, our portfolio aligns to the threats, the HIPAA controls, and the uptime obligations that come with delivering care.
Managed Cybersecurity (24×7 SOC, MDR, SIEM)
The mandate: The HIPAA Security Rule’s access control, audit control, integrity, and security-incident-procedure requirements — plus the HPH CPGs’ emphasis on detection and response. In a sector where two-thirds of organizations are hit annually, continuous monitoring is table stakes.
What we deliver:
• 24×7 Managed Detection & Response (MDR) with EDR coverage across endpoints, servers, and clinical workstations
• SIEM ingestion and log retention to satisfy HIPAA audit-control evidence and support breach forensics
• Incident-response playbooks tuned to the HITECH 60-day breach-notification window and OCR reporting
• Vulnerability management and 24×7 SOC monitoring aligned to HICP threat mitigations
• Security-awareness training and phishing simulations for clinical and administrative staff — the number-one ransomware entry point
Network Engineering for Clinical Environments
The mandate: Logical separation between clinical systems, connected medical devices, and guest traffic, with boundary protection and transmission security wherever ePHI moves. Segmentation is the single most effective control for containing ransomware in a hospital.
What we deliver:
• Segmented LAN/VLAN architectures isolating EHR systems, IoMT medical devices, clinical workstations, and guest Wi-Fi from one another
• Next-generation firewalls with deep packet inspection, IDS/IPS, and DNS-layer filtering at every facility
• SD-WAN connecting hospital campuses, satellite clinics, imaging centers, and behavioral health sites with resilient, encrypted links
• IoMT discovery and micro-segmentation for infusion pumps, monitors, and imaging devices that can’t be patched on a standard cadence
• Patient and visitor guest Wi-Fi that is fully isolated from any system touching ePHI
HIPAA-Ready Managed IT & EHR Reliability
The mandate: A documented security risk analysis, enforced safeguards, and the high-availability infrastructure that keeps Epic, Oracle Health, MEDITECH, or a cloud EHR online during clinical hours.
What we deliver:
• HIPAA security risk analyses and risk-management plans — addressing the deficiency OCR cites most often
• MFA enforcement, encryption at rest and in transit, and least-privilege access governance across clinical identities
• High-availability server, virtualization, and connectivity design for EHR uptime, plus performance monitoring of clinical applications
• Immutable, tested, off-network backups with documented recovery-time objectives so ransomware can’t destroy your last good copy
• Patch management, asset inventory, and configuration management mapped to HIPAA technical safeguards
Secure Communications, Telehealth & Unified Communications
The mandate: Voice, video, and messaging that carry clinical conversations and telehealth visits without leaking PHI through consumer apps — backed by Business Associate Agreements where required.
What we deliver:
• Microsoft Teams and Cisco Webex deployments configured for healthcare, with Business Associate Agreements (BAAs) in place
• Hosted UC and SIP trunking with carrier diversity and survivability for mission-critical clinical voice
• Reliable, low-latency telehealth connectivity and quality-of-service design so virtual visits don’t drop
• E911 and emergency notification compliant with Kari’s Law and RAY BAUM’S Act, with location accuracy across multi-floor hospitals and multi-site clinic groups
Structured Cabling & Infrastructure
The mandate: The physical layer that’s still the most common single point of failure in a hospital or clinic build-out — and a frequent source of downtime in fast-growing facilities.
What we deliver:
• BICSI-aligned Cat 6A and fiber backbone design, installation, and certification for clinical environments
• Redundant cabling and pathway design supporting high-availability EHR and imaging traffic
• Pre-construction consulting and IT scoping for new clinics, urgent care, and outpatient build-outs across the I-15 corridor
• Wireless surveys and in-building coverage design for medical devices, clinician mobility, and patient Wi-Fi
Physical Security & Access Control
The mandate: The HIPAA Security Rule’s physical safeguards — facility access controls and workstation security — plus the practical need to protect pharmacies, behavioral health units, records rooms, and data closets.
What we deliver:
• IP video surveillance and access control for clinical facilities, behavioral health units, and pharmacy areas
• Badge-based access governance for records rooms, server closets, and restricted clinical zones
• Security systems engineered to ride safely on a segmented network — never compromising the clinical data network they sit beside
• Integration with visitor-management and emergency-notification workflows for multi-building campuses
What “Ransomware-Resilient” Looks Like Six Months In
Use-case spotlight — a representative Davis County engagement.
The challenge: A multi-site outpatient and behavioral health group headquartered in Layton, with satellite clinics in Bountiful and Clearfield, runs a cloud EHR and a mix of imaging and connected devices. Current state: a flat network where guest Wi-Fi, clinical workstations, and medical devices share the same broadcast domain; backups that run nightly but have never been test-restored; no 24×7 monitoring; and a HIPAA security risk analysis that is three years stale and was never tied to the actual environment.
The first 90 days: A fresh HIPAA security risk analysis and ePHI data-flow mapping. Network re-architecture into segmented enclaves — EHR, IoMT devices, clinical workstations, and guest Wi-Fi each isolated behind a next-generation firewall with IDS/IPS. MFA enforced on every clinical identity, with conditional access blocking legacy authentication. Immutable, off-network backups stood up and verified with a documented test restore.
By month six: 24×7 MDR live with SIEM log retention sufficient for HIPAA audit evidence and breach forensics. Risk-management plan tracking remediation of every finding from the risk analysis. A tabletop incident-response exercise completed and documented, mapped to the HITECH 60-day breach-notification window. IoMT devices discovered, inventoried, and micro-segmented so an unpatched infusion pump can’t become a pivot point.
The outcome: When a phishing email later lands a single credential, the intrusion is detected and contained in the workstation enclave — it never reaches the EHR, the medical devices, or the backups. Care continues uninterrupted, and there is no reportable breach.
Built Around Davis County’s Healthcare Communities
Healthcare in Davis County isn’t monolithic. Each city carries a different concentration of providers, and our delivery teams plan engagements accordingly.
Layton — The County’s Largest Hospital Hub
Layton hosts the highest concentration of acute and outpatient care in the county, anchored by Davis Hospital & Medical Center and Intermountain’s Layton Hospital, surrounded by specialty practices, imaging, and urgent care. Most Layton engagements involve EHR-reliability and uptime engineering, hospital-grade network segmentation, IoMT security, and 24×7 managed cybersecurity across multi-floor facilities.
Bountiful — Lakeview Hospital & Behavioral Health
Bountiful is anchored by Lakeview Hospital and carries a strong behavioral health and women’s-services presence. Our Bountiful work tends toward behavioral health data protection (where confidentiality requirements are especially sensitive), HIPAA risk analysis, secure communications with BAAs, and physical security for restricted clinical units.
Farmington — County Seat & Outpatient Growth
As the Davis County seat, Farmington combines county and public-health adjacencies with rapidly growing outpatient and specialty clinics near Station Park. Engagements here span multi-site clinic networking, structured cabling for new build-outs, telehealth connectivity, and audit-ready managed IT.
Clearfield — Community Clinics & Hill AFB Adjacency
Clearfield’s healthcare base skews toward community clinics, dental and specialty practices, and providers serving Hill Air Force Base families. Our Clearfield engagements often start with a HIPAA security risk analysis and ransomware-resilience review and grow into managed cybersecurity and segmented networking as practices scale.
Syracuse — Fast-Growing Suburban Care
Syracuse is one of the fastest-growing cities in the county, with new clinics and urgent care following the residential boom along the west I-15 corridor. ProTelesis is frequently engaged at the pre-construction phase — scoping cabling, wireless, and HIPAA-ready network design before slabs are poured — so security and segmentation are baked in rather than retrofitted.
Kaysville — Independent & Family Practices
Kaysville hosts a deep bench of independent family practices, dental offices, and small specialty clinics — many with limited in-house IT. Engagements here typically begin with HIPAA-ready managed IT, MFA and encryption rollout, and tested backups, then expand into managed cybersecurity as the threat environment tightens.
Why Local Matters for Healthcare IT
Clinical operations run on response time. When an EHR slows, a device drops off the network, or a phishing alert fires at 2 a.m., a healthcare provider can’t wait for next-business-day. ProTelesis maintains regional engineering and field-services presence covering Davis, Weber, and Salt Lake counties, with response windows measured in hours — not days. Our teams understand the rhythm of a clinical environment: that you can’t take an imaging suite offline mid-day, that a nursing floor can’t tolerate a flaky access point, and that change windows have to fit around patient care.
For the parts of the work that need to be off-site — 24×7 SOC monitoring, after-hours patching, weekend cutovers — our engineers administer the monitoring and management platforms directly, so the team that answers an alert already knows your environment. In a sector where a 60-day breach-notification clock and patient safety are both on the line, that ownership matters.
Schedule a HIPAA & Ransomware Readiness Conversation
If you run a hospital, clinic, or behavioral health practice in Layton, Bountiful, Farmington, Clearfield, Syracuse, or Kaysville — and your last security risk analysis is gathering dust while ransomware targets your sector — this is exactly the conversation we have every week.
ProTelesis is a managed services provider, systems integrator, and carrier-class communications partner serving organizations across California, Arizona, Utah, and the broader western United States. Our Utah team supports the hospitals, clinics, and behavioral health providers of Davis County with HIPAA-ready managed IT, managed cybersecurity, clinical network engineering, structured cabling, unified communications, telehealth connectivity, and physical security.
Frequently Asked Questions: Healthcare IT & Cybersecurity in Davis County
What is the HIPAA Security Rule and who must comply with it?
The HIPAA Security Rule is the U.S. Department of Health and Human Services standard that requires covered entities — hospitals, clinics, and health plans — and their business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. Its foundation is a documented security risk analysis and risk-management process, and risk analysis remains the most-frequently-cited deficiency in OCR enforcement actions. Any Davis County healthcare provider that creates, receives, maintains, or transmits ePHI must comply. ProTelesis begins most healthcare engagements with a current HIPAA risk analysis mapped to the organization’s actual environment.
Is the 2025 HIPAA Security Rule update in effect yet?
No. The 2025 HIPAA Security Rule update is a Notice of Proposed Rulemaking (NPRM) that OCR published in January 2025 — it is a proposed rule, not enforceable law. It would add measures such as mandatory multi-factor authentication, encryption of ePHI, network segmentation, and annual compliance audits, but the rulemaking was paused under the early-2025 federal regulatory freeze and no final rule has been issued. The currently enforceable standard remains the 2013 HIPAA Security Rule. ProTelesis builds environments that satisfy today’s rule while moving clients toward the MFA, encryption, and segmentation the proposal signals — because those are sound practices regardless of the rulemaking timeline.
Why is healthcare the most-targeted sector for ransomware?
Healthcare is the most-targeted sector for ransomware because attackers know that when a hospital’s electronic health record goes dark, care is disrupted, ambulances divert, and the pressure to pay quickly is enormous. Sophos research found that roughly two-thirds of healthcare organizations were hit by ransomware in the past year, a four-year high for the sector. The defense is resilience as much as prevention: network segmentation to contain the blast radius, immutable and tested backups, 24×7 monitoring, and a documented recovery plan. ProTelesis builds ransomware-resilient architectures for Davis County hospitals and clinics around exactly these controls.
What is the HITECH Breach Notification Rule and what does it require?
The HITECH Breach Notification Rule is the federal requirement that obligates covered entities to notify affected individuals, the U.S. Department of Health and Human Services, and in larger breaches the media, when unsecured protected health information is compromised. Breaches affecting 500 or more individuals must be reported to HHS without unreasonable delay and no later than 60 days after discovery. This is why detection, incident response, and forensics readiness — not prevention alone — belong in every healthcare IT plan. ProTelesis delivers SIEM log retention and incident-response playbooks tuned to that 60-day window.
What are the HHS 405(d) HICP and HPH Cybersecurity Performance Goals?
HHS 405(d) is a federal program that publishes voluntary cybersecurity best practices for the healthcare sector. Its Health Industry Cybersecurity Practices (HICP) publication maps the top threats — ransomware, phishing, insider risk, connected-device attacks, and data loss — to practical mitigations scaled for small, medium, and large organizations. The companion Healthcare and Public Health (HPH) Cybersecurity Performance Goals distill those into a prioritized set of high-impact, voluntary practices that auditors, cyber insurers, and hospital boards increasingly treat as a benchmark. ProTelesis aligns Davis County healthcare engagements to HICP and the HPH CPGs.
Why does network segmentation matter so much in a hospital or clinic?
Network segmentation is the practice of dividing a network into isolated zones so that traffic — and any attacker — cannot move freely between them. In a hospital or clinic it is the single most effective control for containing ransomware, because it keeps the electronic health record, connected medical devices (IoMT), clinical workstations, and guest Wi-Fi separated from one another. When one zone is compromised, segmentation stops lateral movement before it reaches patient-critical systems or backups. ProTelesis designs segmented LAN, VLAN, and firewall architectures for Davis County healthcare facilities, including micro-segmentation for unpatched medical devices.
How do you secure connected medical devices (IoMT)?
Internet of Medical Things (IoMT) security is the discipline of discovering, inventorying, and protecting connected clinical devices — infusion pumps, patient monitors, imaging systems — that frequently cannot be patched on a normal cadence because they run vendor-locked or legacy software. Because these devices can’t always be hardened directly, the primary defense is micro-segmentation and continuous monitoring: isolating each device class behind tight network controls so a vulnerable device can never become a pivot point into the EHR. ProTelesis delivers IoMT discovery, segmentation, and monitoring as part of clinical network engineering across Davis County, Utah.
Can ProTelesis support HIPAA-compliant telehealth and unified communications?
Yes. ProTelesis deploys HIPAA-aware unified communications and telehealth using platforms such as Microsoft Teams and Cisco Webex, configured for healthcare and backed by Business Associate Agreements (BAAs) where protected health information is in scope. We engineer reliable, low-latency telehealth connectivity with quality-of-service design so virtual visits don’t drop, provide hosted UC and SIP trunking with carrier diversity for clinical voice, and ensure E911 compliance with Kari’s Law and RAY BAUM’S Act across multi-floor hospitals and multi-site clinic groups. Learn more at ProTelesis.
Does ProTelesis serve healthcare providers in Layton, Bountiful, Farmington, Clearfield, Syracuse, and Kaysville?
Yes. ProTelesis serves healthcare organizations across all six Davis County, Utah cities — Layton, Bountiful, Farmington, Clearfield, Syracuse, and Kaysville — with HIPAA-ready managed IT, managed cybersecurity, clinical network engineering, structured cabling, unified communications, telehealth connectivity, and physical security. Engagements span community hospitals, outpatient and specialty clinics, urgent care, behavioral health providers, and the independent family and dental practices serving the I-15 Wasatch Front. Regional engineering and field-services teams maintain response windows measured in hours. Get started at ProTelesis.
How does ProTelesis protect EHR uptime against outages and attacks?
EHR uptime protection is the combination of high-availability infrastructure, proactive monitoring, and ransomware-resilient recovery that keeps electronic health record platforms such as Epic, Oracle Health, and MEDITECH online during clinical hours. ProTelesis delivers redundant server, virtualization, and connectivity design; continuous performance monitoring of clinical applications; immutable, off-network, test-restored backups with documented recovery-time objectives; and 24×7 managed detection and response so threats are caught before they reach the EHR. The goal is simple: an outage or attack on one system never becomes a patient-safety event. Learn more at ProTelesis.