Reading Write Alaska operates clinical and academic support services across three physical locations — Anchorage, Eagle River, and Wasilla — plus statewide teletherapy. Clinicians rely on Practice Perfect for scheduling, charting, and billing, and on Microsoft 365 for day-to-day collaboration. Client and student records carry sensitivity similar to a healthcare environment, even though the practice isn't a covered medical entity. Key technology risks in this sector include phishing/business email compromise targeting billing staff, weak identity controls given the number of remote/teletherapy sign-ins, and aging on-site hardware supporting a distributed, multi-site staff.
Phishing and impersonation attacks remain the top entry point for attackers targeting small clinical and administrative teams, especially those handling billing and scheduling for families.
MFA is enforced tenant-wide via Conditional Access, with one temporary exemption under review. Vicinity is recommending Safe Links, Safe Attachments, and impersonation protection be enabled to close the largest gaps in Microsoft Secure Score.
A majority of workstations and the primary physical server host are past their manufacturer warranty window, increasing the risk of unplanned downtime and extending repair timelines when hardware fails.
Vicinity is compiling a phased refresh plan prioritizing the oldest workstations and the DB5LCCS2 physical server host, to be reviewed alongside the new MSP agreement.
With three physical sites and teletherapy staff working remotely, a formal remote access solution (VPN/RDS) is increasingly a best practice rather than a nice-to-have, and unmanaged personal devices (Apple computers/tablets) introduce visibility gaps.
No RDS or VPN solution is currently deployed. Vicinity recommends scoping a secure remote access solution and extending RMM/endpoint coverage to Apple devices currently outside management.
How your IT environment supports Reading Write Alaska's business goals and operations.
| Business Priority | IT Dependency | Current Status | Notes |
|---|---|---|---|
| Clinical scheduling, charting & billing | Practice Perfect EMR (hosted on internal server) | Healthy | Critical LOB app; runs on the PracticePerfect VM |
| Teletherapy delivery to remote families | Microsoft Teams, internet connectivity per site | Attention | No formal remote access (VPN/RDS) in place |
| Protecting client & family data | M365 security controls, Conditional Access, EDR | At Risk | Secure Score 31.52/100; one active MFA exemption |
| Multi-site staff productivity | M365 Apps, shared drives, VoIP (Vonage/RingCentral) | Attention | Two VoIP platforms in use; consolidation opportunity |
| Area | Status | Details |
|---|---|---|
| Patch Management | Current | Managed via RMM across all servers and workstations |
| Endpoint Protection | Active | SentinelOne EDR deployed fleet-wide on managed Windows devices |
| Backup / BCDR | Healthy | Datto 1000 (Eagle River) + Datto NAS (Anchorage); DTS-BAK cloud/local backup billed |
| Identity / MFA | At Risk | MFA enforced tenant-wide, but 1 user (Christina Panasci) is temporarily exempted; most users default to SMS rather than app-based MFA |
| Network | Review | Mixed-vendor gear (SonicWall, Fortinet, Ubiquiti/Uplevel) across 3 sites; no VPN/RDS for remote access |
| Hardware Warranty | At Risk | Majority of workstations and the primary physical server show expired manufacturer warranty |
Core business applications in use at Reading Write Alaska, identified from the installed software inventory across managed devices.
| Application | Purpose | Vendor / Platform | Notes |
|---|---|---|---|
| Practice Perfect EMR & Management Software | Scheduling, charting, billing (LOB / Critical) | Practice Perfect | Installed on 36 devices; hosted on internal server |
| Microsoft 365 Apps for Business | Email, documents, spreadsheets | Microsoft | Primary productivity suite |
| Microsoft Teams | Primary remote meetings & teletherapy platform | Microsoft | Installed on 42 devices |
| Various remote meeting tools | Secondary video conferencing (Zoom, GoToMeeting, Webex) | Zoom / LogMeIn / Cisco | Recommend consolidating onto Teams where possible |
| QuickBooks | Accounting & bookkeeping | Intuit | Limited footprint (3 devices) — confirm system of record |
| Vonage Business / RingCentral | Business phone / VoIP | Vonage, RingCentral | Two platforms present — confirm active system |
| Adobe Acrobat / Acrobat Reader | PDF creation & document handling | Adobe | Widely deployed |
| Google Workspace apps (Gmail, Docs, Sheets) | Ad hoc document collaboration | Likely shadow IT — limited footprint, worth reviewing with staff |
| Control | Solution | Status |
|---|---|---|
| Endpoint Detection & Response | SentinelOne | Active |
| Email Security | Mailprotector Cloud Filter | Active |
| Multi-Factor Authentication | Microsoft Entra Conditional Access | 1 Exemption |
| Backup / BCDR | Datto (Eagle River & Anchorage) + DTS-BAK cloud/local | Active |
| Firewall / Network Security | SonicWall / Fortinet (per site) | Active |
| Patch Management | RMM-managed patching | Active |
| Microsoft Secure Score | Microsoft 365 Defender | 31.52 / 100 |
- Microsoft Secure Score sits at 31.52/100, below the 45.45 average for organizations of similar size — the largest opportunity is in the Apps category (23.22%), driven mostly by email/anti-phishing configuration.
- Conditional Access correctly requires MFA for all users and all resources, but a "Temp Exempt" policy currently excludes one user (Christina Panasci) from that requirement.
- Of 50 users registered for MFA, the majority (27) default to SMS/mobile phone verification rather than the stronger Microsoft Authenticator push (16) — SMS is more susceptible to interception and SIM-swap attacks.
- No remote access solution (VPN or RDS) is in place, and RMM/EDR coverage currently appears limited to Windows devices, leaving Apple computers and tablets in the environment outside centralized management.
- Anti-phishing hardening — Safe Links, Safe Attachments (block mode), and impersonation protection are not yet enabled; these represent the highest-impact, lowest-effort Secure Score gains available (49 actions "to address").
- MFA exemption — the "Temp Exempt" Conditional Access policy should be time-boxed or removed once its underlying need is resolved.
- Endpoint visibility gap — Apple devices in the environment are not confirmed to be under RMM/EDR management.
Strategic IT projects and improvements recommended for Reading Write Alaska in the coming period.
| Initiative | Priority | Timeline | Rationale |
|---|---|---|---|
| Transition from legacy DanTech agreement to new Vicinity agreement | High | TBD — soon | Aligns pricing, service levels, and tooling with Vicinity's current standard offering following the 2025 acquisition |
| Close top Secure Score gaps (Safe Links, Safe Attachments, impersonation protection) | High | Next 30–60 days | Highest-impact, lowest-effort improvement to email/phishing defenses |
| Workstation & server hardware refresh plan | Medium | FY2026–2027 | Majority of devices and the primary physical server host are past warranty |
| Extend endpoint management to Apple devices | Medium | Next quarter | Closes a visibility/security gap for devices outside current RMM/EDR coverage |
| Scope a secure remote access solution (VPN/RDS) | Low | To be scheduled | Supports teletherapy and multi-site staff with a formal, secured access path |
| Consolidate VoIP & conferencing tools | Low | To be scheduled | Vonage/RingCentral and Zoom/GoTo/Webex overlap with Teams — consolidation may reduce cost and complexity |
- Continuous management of servers, workstations, backup, and endpoint protection across all three locations
- Fleet-wide EDR coverage (SentinelOne) and patch management via RMM
- Cloud and local backup coverage for critical systems (Datto appliances, DTS-BAK)
- New Vicinity MSP agreement — pricing and scope to be presented and reviewed with the client
- Hardware refresh budget for workstations and the primary physical server host
- Potential Secure Score / email security add-ons (Safe Links, Safe Attachments)
- Fully aligned on a single, current Vicinity MSP agreement replacing the legacy DanTech terms
- A hardened Microsoft 365 tenant with no standing MFA exemptions and a materially improved Secure Score
- A refreshed hardware baseline and clear visibility into every device in the environment, including Apple devices currently outside RMM
Thank you, Reading Write Alaska.
We appreciate the trust you place in Vicinity to support your business. Our commitment is to keep your IT reliable, your data secure, and your team focused on what matters most.
Questions? Reach us anytime at support@vicinity.team · (866) 520-6414