Clinics and dental offices in this region run on a handful of PCs, an EHR or practice app, and a waiting room full of phones. The failure mode is mixing those networks and sharing one Microsoft login on a sticky note.
We separate guest Wi-Fi, turn on MFA, prove a backup, and write down who owns the tenant. That is HIPAA-aware work, not a vCISO retainer. If you need a formal risk assessment, we will say so instead of pretending.