HBF Health

Sentara Health is a not-for-profit integrated healthcare system that's been serving communities for more than 125 years. What started in 1888 as a small hospital in Norfolk has grown into a network of over 300 sites of care across Virginia, North Carolina, and Florida. We operate 12 hospitals, and our team includes more than 1,600 physicians and advanced practice providers who complete over 2.8 million patient visits each year. Our mission is straightforward: we improve health every day. We're proud to be recognized as one of the nation's top health systems - IBM Watson Health named us among the "Top 15 Healthcare Systems," and we've consistently ranked at the top of U.S. News & World Report's best hospitals for over 18 years running. Eight of our hospitals have achieved Magnet Recognition Program® designation, the highest quality credential for nursing, awarded to fewer than 8% of hospitals nationwide. We combine state-of-the-art technology with expert multidisciplinary care teams to deliver quality outcomes, while constantly innovating to create new methods of care and measure our effectiveness.

Avalere Health is a global strategic partner, perfectly formed to solve the biggest challenges in health - at pace and at scale. Formerly known as Fishawack Health, the company was founded in 2001 and has grown to employ 750 professionals across 14 offices in the US, UK, and India. Guided by a single mission to make EVERY PATIENT POSSIBLE, Avalere Health unites its Advisory, Medical, and Marketing teams to ensure every patient is identified, supported, treated, and cared for - equally. Powered by a proprietary strategic model called SenseMaking, Avalere Health uncovers insights where science, society, and systems intersect. The company builds unconventional solutions that connect across the product lifecycle, bridging the gap between access and innovation. Their clients span life sciences, health plans, healthcare providers, and private equity firms, all working together toward a world where healthcare is not a barrier and no patient is left behind.

Northwell Health operates as New York State's largest healthcare provider and private employer, running 28 hospitals and more than 1,000 outpatient facilities across the state. Founded in 1997 through the merger of North Shore Health System and Long Island Jewish Medical Center, the organization now employs over 104,000 team members and treats more than 2 million patients annually. The scale of operations spans clinical care, hospital operations, outpatient services, oncology, cardiovascular medicine, medical education, and research - creating a substantial digital attack surface that requires protecting patient data, medical devices, hospital networks, and research systems across a geographically distributed footprint. The organization's technical infrastructure supports both acute-care hospital operations and a vast ambulatory network delivering non-inpatient clinical services. This dual environment presents distinct security challenges: real-time clinical systems where availability is critical, electronic health records systems handling sensitive patient information at scale, medical IoT devices integrated across facilities, and research data requiring protection while enabling collaboration. The threat model includes ransomware targeting hospital operations, patient data exfiltration, medical device vulnerabilities, insider threats across a workforce exceeding 100,000, and supply chain risks inherent in healthcare technology ecosystems. As a nonprofit integrated healthcare network with explicit commitments to community health access and medical innovation, Northwell's security posture must balance robust protection with operational realities of healthcare delivery. The organization's focus on advancing medical education and research adds complexity around academic partnerships, data sharing protocols, and protecting intellectual property. Security teams operate within regulatory frameworks including HIPAA and state privacy laws while supporting clinical workflows that cannot tolerate the downtime or friction common in other industries.

In 1999, Lifepoint Health began with a simple but powerful vision: to bring quality healthcare closer to home in communities that needed it most. Founded with 23 locations across nine states, the company recognized a critical gap in non-urban healthcare access and set out to fill it. What started as a network of community hospitals has evolved into a diversified healthcare delivery network spanning the entire care continuum - from acute care hospitals to rehabilitation and behavioral health facilities serving patients coast to coast. Today, Lifepoint Health stands as a national healthcare leader with 60 community hospital campuses, more than 70 rehabilitation and behavioral health hospitals, and over 300 additional sites of service across 33 states. The company's mission of 'making communities healthier'® drives every decision, from the cutting-edge technologies implemented through Lifepoint Forward to the rigorous quality standards upheld by the National Quality Program. With a culture built on core values like Champion Patient Care, Do the Right Thing, and Make a Difference Together, Lifepoint has created places where patients choose to come for care, physicians want to practice, and employees are proud to work.

OU Health operates Oklahoma's only comprehensive academic health system, serving patients across all 77 counties through a distributed network of hospitals, clinics, and specialized treatment centers. With more than 10,000 team members - including 1,300 physicians and 4,000 nurses - the organization functions as the flagship academic health system of The University of Oklahoma, integrating direct patient care with medical education and clinical research. The infrastructure includes Oklahoma Children's Hospital, the Stephenson Cancer Center (one of only 73 NCI-Designated Cancer Centers nationally), the Harold Hamm Diabetes Center, and a Level I trauma center that has anchored emergency care in the state for three decades. The organization's operational footprint extends from Oklahoma City and Edmond to Tulsa and points beyond, delivering complex, life-saving treatments that range from pediatric heart transplants to advanced oncology protocols. The clinical environment combines acute trauma response, specialized pediatric services, diabetes management, and cancer treatment under a single institutional umbrella. This structure creates a threat surface that spans emergency department systems, research data repositories, pediatric patient records, transplant coordination networks, and the interconnected clinical systems that support continuous care across multiple counties. For security practitioners, OU Health represents the operational complexity of a large-scale academic medical center: protecting high-value research data, maintaining uptime for life-critical systems, ensuring HIPAA compliance across geographically distributed care sites, and securing the digital infrastructure that supports both routine outpatient visits and emergency trauma operations. The scale - measured in thousands of clinical staff, tens of thousands of patients, and statewide geographic reach - translates to challenging identity management, network segmentation, medical device security, and incident response coordination across entities that include teaching hospitals, research facilities, and community clinics operating under unified governance.

Emory Healthcare operates 11 hospitals and a clinically integrated network serving 26,000 employees across Georgia - which means the attack surface is sprawling. The threat model here is healthcare-standard: HIPAA compliance, ransomware targeting clinical systems, and the operational risk of downtime in environments where EHR access, imaging systems, and connected medical devices directly impact patient outcomes. With 3,800 physicians and over 50 specialty areas generating protected health information at scale, data segmentation and access control aren't theoretical - they're daily operational requirements. The security function supports both clinical operations and the research side of an academic health system tied to Emory University. That dual mandate means protecting patient data while enabling collaboration across research networks, which introduces federation and data-sharing complexity. The infrastructure spans legacy hospital IT, modern cloud services for analytics, and operational technology in clinical settings - ventilators, infusion pumps, imaging equipment - all of which require different threat modeling than standard enterprise environments. Established in 1997 and expanded through the Emory Healthcare Network since 2011, the organization has been consolidating what were once independent hospitals into a unified system. That history suggests ongoing integration work: harmonizing security policies, centralizing identity management, and standardizing tooling across acquisitions. The scale and regulatory environment demand mature incident response, vulnerability management across heterogeneous systems, and the ability to operate under the assumption that you're a target.