The situation
Meet Tom, an illustrative example: he runs a small physiotherapy clinic with two practitioners, each with their own laptop, sharing patient notes over personal Gmail accounts and shared passwords because that's what's always been done. Nobody is quite sure who can see what, backups happen if someone remembers to copy a folder onto a USB stick, and passwords are the kind that get written on a sticky note because there are simply too many to remember.
"We use personal Gmail accounts and shared passwords and I'm worried our patient data isn't handled properly," says Tom. "I want secure email, backups and a clear setup we can trust."
It isn't negligence. It's that the clinic grew from one practitioner working alone into a small team, and the IT setup never caught up. Patient information deserves proper handling under UK GDPR, but "proper" can't mean locked down so tightly that practitioners can't do their jobs between appointments. Add in a team that's curious about using tools like Copilot or ChatGPT to speed up notes and letters, but unsure what's safe to type into them, and the gap between what should be in place and what actually is gets wider.
What we'd set up
- Microsoft 365 set up or migrated properly, with shared calendars, a proper filing structure, and permissions so each practitioner sees what they need and nothing more.
- A security and backup check, covering multi-factor authentication, device security and automatic backups, aimed at the practical basics behind Cyber Essentials rather than box-ticking.
- A safe AI usage policy, setting out plainly which tools the team can use, what data should never go into them, and a few simple rules everyone can actually follow.
- Ongoing IT support, so there's a friendly expert on call for the inevitable laptop issue or access question, for a fixed monthly cost.
How the project would run
Week 1: a free call to understand the current setup, followed by the Microsoft 365 migration or configuration beginning, including shared calendars and a sensible filing structure for patient and admin documents.
Week 2: the security and backup check, covering multi-factor authentication, device checks and automatic backups, with any gaps fixed as they're found rather than just listed.
Week 3: the safe AI usage policy is drafted with the team, covering what's fine to use AI for (drafting a letter, summarising notes for internal use) and what isn't (pasting patient details into a public chatbot).
Week 4: a short training session for the whole team on the new setup and the AI policy, with a written guide to keep, and the ongoing support arrangement starting from this point if Tom wants it.
What changes day to day
Patient notes live in a properly permissioned system instead of email threads, so only the people who should see something can see it. Backups happen automatically rather than depending on someone remembering a USB stick. A practitioner wanting to use AI to help draft a letter has a clear, short answer about what's fine and what isn't, rather than guessing. And when a laptop won't connect to the printer on a Tuesday morning, there's someone to call who already knows the setup, rather than losing an hour to it.
What you get back
Working out who can see which patient's notes stops being a daily guess, because proper permissions settle it once. Backups stop depending on someone remembering a USB stick, because they run on their own in the background. And when a practitioner wonders whether it's fine to use AI to speed up a letter, there's a clear, short answer to check rather than time lost deciding, or worse, guessing.
If this sounds familiar, start my project like this.
Tools involved
A project like this is built around Microsoft 365 (SharePoint, OneDrive, Teams and Outlook), with clinical or booking software such as Cliniko often sitting alongside it rather than being replaced. The AI policy typically covers tools like Microsoft Copilot or ChatGPT, since those are what most teams are already curious about or quietly already using.
Related
If this sounds familiar, see IT problems keep stopping work and We know we should use AI but don't know where to start. Further reading: Microsoft 365 vs Google Workspace for small businesses and A cyber security checklist for small businesses. For the wider picture on this sector, see booking systems for clinics, salons and therapists.