In 2021 a security review by Pellerath Health Software, a prospective client seeking second-line support for its clinic software, found two weaknesses at our Bathurst centre. Screen recordings from four programmes sat in one repository, divided only by application permissions, and agents who moved between an insurer's and a utility's programmes could copy text from one session into the other. Nothing had been misused, but the arrangement was not what Pellerath expected, nor probably what several existing clients assumed. The Pellerath contract was worth about C$10.6 million a year.
I proposed separating every programme: its own virtual-desktop pool, recording store, encryption keys, identity groups and network segment. The chief operating officer disagreed strongly. Blended agents let our schedulers cover peaks across clients, and he estimated that ending the practice would cost three points of occupancy. Our chief financial officer accepted the design but wanted every client to pay for it. The chief executive approved the full programme at C$5.8 million of capital over twenty months, with about C$1.4 million of additional annual running cost.
We kept blending only where both clients agreed in writing, which left three pairs. Two programmes moved centres to simplify the network design. My team built the new environments one programme at a time and tested isolation by attempting cross-programme access from ordinary agent accounts, sharing the results with each client.
By June 2023 all 36 programmes then running were separated. Occupancy at the three most blended centres fell from 83 to 80 per cent, then recovered to 82 per cent after the workforce team rebuilt its forecasts programme by programme. Pellerath signed in March 2023. Only two existing clients accepted a segregation charge; the others regarded separation as something they had assumed already, and we absorbed most of the running cost.
Separation is now the starting point of every new programme design. I would put its cost into renewal pricing before building, rather than asking clients afterwards to pay for a protection they believed they already had.