Multi-Site IT Strategy for a Regional Healthcare Provider

A regional healthcare company with six sites across the UK and 320 users had no centralised IT strategy. Each site managed its own devices independently, using different configurations, different security settings, and different support arrangements. Patching was manual and inconsistent — some sites were months behind on critical security updates, while others had applied patches that broke clinical applications. There was no visibility into the overall IT estate, no standardised security policies, and no way to ensure compliance with the NHS Data Security and Protection Toolkit.

The company's IT manager, who was based at the head office, was overwhelmed. He was responsible for 320 devices across six sites, but had no tools to manage them centrally. When a critical security patch was released, he would email each site's local IT contact and ask them to apply it — and then spend weeks following up to verify compliance. The NHS DSP Toolkit assessment was approaching, and the company's leadership knew they would fail without a fundamental change in approach.

They engaged us to design a centralised management framework, define security policies, and guide them through NHS compliance. The engagement had three objectives: centralise device management across all six sites, achieve NHS DSP Toolkit compliance, and reduce the IT manager's maintenance burden so he could focus on strategic initiatives rather than firefighting.

We designed a centralised management strategy with Microsoft SCCM (System Center Configuration Manager) as the foundation. SCCM would provide a single console for managing all 320 devices across all six sites, with automated patch deployment, software distribution, compliance policy enforcement, and remote control. The architecture was designed to work across the company's wide-area network, with distribution points at each site to minimise bandwidth usage during software deployments.

The SCCM architecture had three tiers: a central administration site at head office, a primary site server also at head office, and distribution points at each of the six remote sites. The distribution points were critical — they cached software packages and updates locally, meaning that when a patch was deployed to 50 devices at a remote site, the package was downloaded once from head office and then distributed locally, rather than downloading 50 times across the WAN. This reduced WAN bandwidth usage by 90% during deployments and enabled software distribution at scale.

We also designed automated patch deployment rings. Ring 1 (pilot) consisted of 10 non-critical devices at head office, which received patches 7 days after release. Ring 2 (early adoption) consisted of 50 devices across all sites, which received patches 14 days after release. Ring 3 (broad deployment) consisted of all remaining devices, which received patches 21 days after release. This staged approach ensured that patches were tested on a small group before being deployed broadly, preventing the patch-related application breakages that had plagued the previous manual approach.

The NHS Data Security and Protection Toolkit requires healthcare organisations to demonstrate specific security controls, including patch management, access control, malware protection, and data encryption. We wrote SCCM compliance policies that aligned to these requirements, automatically assessing every device against the DSP Toolkit standards and reporting non-compliance to the IT manager.

The compliance policies checked for: BitLocker disk encryption on all devices, up-to-date anti-malware (Windows Defender or equivalent), current security patches (no critical or important patches more than 30 days overdue), screen lock after 15 minutes of inactivity, and restricted local admin rights (only IT staff could be local administrators). Any device that failed a compliance check was flagged in the SCCM console, and the IT manager could remediate the issue remotely — applying the missing patch, enabling encryption, or removing local admin rights — without visiting the site.

We also configured SCCM's endpoint protection to deploy and manage Windows Defender across all devices, replacing the inconsistent mix of anti-malware products that different sites had been using. This standardised malware protection, reduced licensing costs (Defender was included with Windows), and provided centralised alerting when malware was detected on any device. The IT manager could see, from a single dashboard, the security status of all 320 devices across all six sites.

The implementation was completed over 8 weeks, with each site migrated independently to ensure zero disruption to clinical operations. We began with the head office site, installing the SCCM infrastructure, enrolling devices, and verifying that all policies and deployments worked correctly. This took 2 weeks and served as the pilot for the remaining sites.

For each remote site, the rollout followed the same pattern: we installed a distribution point server at the site, enrolled devices in SCCM via client push installation, and verified that software distribution and patch deployment worked correctly. Each site took 1 week, and we rolled out two sites in parallel to accelerate the timeline. The entire 6-site rollout was completed in 6 weeks, with zero disruption to clinical operations — all work was performed outside clinic hours, and the SCCM client installation was transparent to users.

We also provided detailed runbooks for the IT manager, covering common SCCM tasks: creating software deployment packages, configuring patch deployment rings, running compliance reports, and remediating non-compliant devices. The runbooks were designed to make the IT manager self-sufficient, reducing his dependence on external support. We also provided a 2-day training session on SCCM administration, tailored to the healthcare company's specific configuration and policies.

The results were transformative. 100% of devices were enrolled under central management, giving the IT manager complete visibility and control over the entire estate for the first time. Patch compliance improved from 45% to 98% within 3 months — the automated deployment rings ensured that every device received patches on schedule, and the compliance policies flagged any device that fell behind. Software deployment time was reduced from 2 weeks (manual installation at each site) to 2 hours (SCCM distribution to all sites simultaneously).

The NHS DSP Toolkit compliance assessment, conducted 2 months after the rollout, was passed — the first time the company had achieved full compliance. The assessor specifically noted the centralised device management, automated patching, and standardised security policies as significant improvements. The company's leadership was delighted, and the IT manager described the change as 'the difference between constantly firefighting and actually managing IT.'

IT support tickets were reduced by 40% in the 6 months following the rollout, as proactive management prevented the issues that had previously generated support calls. The IT manager, who had been spending 60% of his time on manual patching and device management, now spent 15% — freeing him to focus on strategic projects like electronic patient record implementation and clinical system integration. The SCCM deployment didn't just achieve compliance — it transformed the IT department's capacity and capability.