The Clinic That Outgrew Its Booking System
A regional physiotherapy group runs 6 clinics on a single booking system hosted on one on-premises server in its head office. The server is 7 years old and the group has no formal backup beyond a nightly copy to a USB drive kept in the same room as the server. Last month a power failure at head office shut the server down mid-morning; all 6 clinics lost booking, patient notes and invoicing for 5 hours. Reception staff at two clinics resorted to paper, and 14 appointments were double-booked the next day when records were reconciled by hand. The practice manager proposes moving everything to a cloud SaaS booking platform. The finance director is worried about the monthly subscription and about patient privacy obligations. The IT contractor, who visits fortnightly, says the current server "has another two years in it" and suggests just adding a second server.
1. Assess the risks of the current arrangement and recommend a course of action. Justify your recommendation against the practice manager's and the IT contractor's positions.
Read the worked answer
The current setup concentrates several risks in one place. The single server is a single point of failure: one power event took out booking, notes and billing across all 6 clinics for 5 hours, which is a business continuity failure, not just an IT inconvenience. The backup is inadequate because the USB drive sits in the same room as the server, so any event that destroys the server (fire, flood, theft, power surge) likely destroys the backup too, and there is no tested restore process. The manual reconciliation produced 14 double-bookings, showing that paper fallback does not preserve data integrity.
The IT contractor's "two more years" claim addresses hardware age but not the actual failure mode, which was availability and recovery, not component wear. Adding a second server on the same site would not fix the single-site power dependency; it would double the cost of an architecture that still fails when head office loses power.
The cloud SaaS option addresses the identified risks directly: geographic redundancy removes the single-site dependency, managed backups remove the USB drive problem, and per-seat subscription converts a capital cost into a predictable operating cost. The finance director's privacy concern is legitimate and must be resolved, not dismissed: patient health records require the provider to meet privacy obligations, so the decision should be conditional on a provider that offers a suitable data location, encryption, access controls and a written agreement covering how patient data is handled. A reasonable recommendation is to move to SaaS, but only after confirming the provider's privacy and data-handling terms, and to keep a documented, tested export of patient data so the group is not locked in.
2. The finance director asks how the subscription cost should be evaluated. Describe what should be compared and what could make the recommendation change.
Read the worked answer
The subscription should be compared against the full cost of the current arrangement, not just the server's purchase price. Total cost of ownership of the on-premises option includes the server replacement, the fortnightly contractor visits, staff time lost to outages (5 hours across 6 clinics plus the reconciliation effort that produced 14 double-bookings), the cost of a proper off-site backup, and the cost of a second site or generator if the power dependency is to be fixed. The SaaS option's cost includes the subscription plus any data migration, training and exit/export effort.
The recommendation could change if the subscription over the expected period exceeds the fully loaded on-premises cost by a margin the group cannot absorb, or if no provider can meet the patient privacy obligations on acceptable terms. In that case a hybrid could be justified: keep records on-premises but move booking to a hosted service, provided off-site backup and a tested restore are added first. The key point is that the comparison must be like-for-like on availability and privacy, because a cheaper option that repeats the 5-hour outage is not actually cheaper.