Unified NW › Assessments › Voice security
Annual phone system security audit for healthcare
An independent, fixed-scope assessment of your enterprise Avaya Aura or Lucent DEFINITY phone system. We follow your calls from the call-control core to every place they end, and hand back a remediation plan your IT team can fund.
- $5,500 core PBX
- $650 each remote site on the same PBX/ACD network
Delivered remotely in about five to six weeks. Written rules of engagement, evidence for every finding, and a HIPAA Security Rule crosswalk for your compliance file. Unified NW is a Kaseya International Premier Security Partner.
Follow one call
Select a stopEvery place a patient call touches is part of the audit.
-
- Trunk authentication and trunk-group restrictions
- External scan of exposed SIP and media ports
- Toll-fraud paths on inbound routing
-
- SIP trunk and remote-worker rules, topology hiding, flood protection
- Administrative access to the SBC
- Whether signaling ports are open to the internet
-
- Registration controls, including a rogue station registration test
- TLS and SRTP by network region
- Logins, patch level and end-of-support components
-
- Vector and IVR routes that can reach outside trunks
- CMS or IQ accounts and patch level
- Reports that hold patient callback numbers, and where they go
-
- Where the call ends, on what device and network
- Managed or unmanaged, and its patch level
- Unsanctioned voice apps on the same network
-
- Who can service observe, silently monitor or barge in
- Warning tones and listen-only settings
- Rights still held by former staff or vendors
-
- Recording access, encryption and retention
- Voicemail PINs and voicemail-to-email
- AES service accounts and CTI into the EHR
Why the phone system needs its own audit
Your phone system carries patient information every day, and it is usually the one platform left out of the annual security review.
Voice carries patient information
Voicemail, call recordings, contact-center reports and IVR inputs routinely hold protected health information. VoIP traffic crosses the same networks as everything else.
The real threat is listening
Toll fraud still gets checked, but the bigger risk today is an unauthorized SIP phone registering through an exposed edge, then using service observing or recording access to listen to clinical calls.
Voice falls between teams
IT security assessments treat the phone system as an add-on. Telecom teams are busy with moves, adds and changes. Nobody owns the annual review.
Calls end in places you don't manage
Clinicians check voicemail from home computers. Agents log in to ACD queues on unpatched machines. Each one is an endpoint of your phone system.
The HIPAA Security Rule requires an accurate and thorough risk analysis and periodic technical evaluation of systems that create, receive, store or transmit electronic protected health information. This audit gives you that record for the voice platform.
One platform, assessed the way the big firms assess an enterprise
An independent, fixed-scope security assessment of one enterprise Avaya Aura or Lucent DEFINITY phone system and its remote sites, repeated every year.
- Who it's for
- Hospitals, health systems, clinic networks and behavioral health organizations running enterprise Avaya or Lucent voice, usually with ACD and contact-center operations.
- What it covers
- The call-control core, contact-center and reporting adjuncts, every integration the phone system touches, and every endpoint where calls end.
- What it is not
- A hospital-wide penetration test. The scope stops at the voice platform and the systems it connects to, which keeps the price fixed and the findings specific.
- How long
- About five to six weeks from kickoff to readout, delivered remotely, with testing scheduled around patient care.
- What it costs
- $5,500 for the core PBX, plus $650 for each remote site on the same PBX/ACD network.
| Enterprise-wide assessment | Unified NW voice audit | |
|---|---|---|
| Scope | The whole IT estate | The voice platform and everything it touches |
| Voice depth | Usually a sampled line item | Fourteen domains, from configuration to endpoints |
| Method | Rules of engagement, evidence, ratings | The same discipline, applied to one platform |
| Price | Scoped and priced as a large engagement | Fixed: $5,500 core, $650 per site |
| Outcome | Enterprise risk report | A voice remediation roadmap your telecom and IT teams can act on |
Unified NW is a Kaseya International Premier Security Partner.
Fourteen domains, core to endpoint
From the call-control servers to the soft phone on a clinician's home computer. The full scope of work lists every check.
- 01
Call-control platform
Release and patch level, end-of-support components, hardening, backups and logging.
- 02
Administrative and vendor access
Every login and its last use, stale and shared accounts, remote maintenance paths.
- 03
Signaling and media encryption
TLS and SRTP by region, registration controls and a rogue station registration test.
- 04
Eavesdropping and monitoring
Service observing, silent monitoring, barge-in and call recording access.
- 05
Session border and perimeter
SBC rules, exposed SIP and web ports, voice firewall rules and VPN paths.
- 06
Toll fraud and routing abuse
Remote access, trunk-to-trunk transfer, off-net forwarding and premium-rate routes.
- 07
Contact center and reporting
CMS and IQ, wallboards, workforce management, IVR and agent desktops.
- 08
Integrations and APIs
AES service accounts, CTI to the EHR such as Epic, CRM, nurse call and paging.
- 09
Messaging and voicemail
PIN policy, default PINs, outcalling and voicemail-to-email.
- 10
Endpoints and remote users
Phone firmware, soft phones on unmanaged devices and calls ending off-network.
- 11
Rogue and shadow voice
Consumer calling apps, phone mirroring and unapproved SIP clients on your network.
- 12
License reconciliation
Licensed against registered and used stations, agents and trunks.
- 13
Resilience and emergency calling
Survivability, recovery records, and Kari's Law and RAY BAUM'S Act settings.
- 14
People and process
Change control, administrator training and a controlled call-handling test.
What lands on your desk
Illustrative views from the reports you receive. The data is invented; the structure is the one you get.
Illustrative examples only. They do not describe any client environment.
Nine deliverables
Written so leadership can decide and your telecom and IT teams can act.
Executive summary
Posture, the top risks in business terms and the decisions to make.
Technical findings report
Every finding with evidence, affected assets, severity and a specific fix.
Voice security baseline
The recorded configuration of the core and each site, for next year's comparison.
Endpoint and license reconciliation
Licensed against registered and used endpoints, plus off-network terminations.
Privileged and vendor access register
Every administrative, vendor and service login and its last use.
HIPAA Security Rule crosswalk
Findings mapped to 45 CFR 164.308 and 164.312 for the compliance file.
Prioritized remediation roadmap
30, 60 and 90-day actions, including server, workstation, remote-user and small-site upgrades.
Executive readout
A 60-minute session with leadership, then a technical walkthrough.
Letter of assessment
A one-page letter confirming dates and scope, for auditors and insurers.
Six phases, about five to six weeks
Remote delivery, non-destructive testing, and nothing listened to or recorded. Critical findings reach your sponsor within one business day.
- 1
Kickoff
Week 1Authorization to test, site list, windows and contacts.
- 2
Discovery
Weeks 1–2Read-only access, configuration exports, appliance in place.
- 3
Testing
Weeks 2–3Scans, registration and encryption tests, rogue voice sampling.
- 4
Review
Weeks 2–4Line-by-line review of the core, adjuncts and every login.
- 5
Reporting
Weeks 4–5Rated findings, HIPAA crosswalk and the roadmap.
- 6
Readout
Weeks 5–6Executive readout, technical walkthrough and final reports.
A fixed scope keeps it focused
The voice platform, everything it connects to, and nothing else. That boundary is what keeps the price fixed and the findings yours to act on.
In scope
- The core PBX and its adjuncts: Session Manager, System Manager, SBC, AES, CMS or IQ, messaging, recording, workforce management, IVR
- Each remote site on the same PBX/ACD network
- Integrations, such as Epic CTI, at the point they connect to voice
- Every endpoint where calls end, including home users and small sites
Not in scope
- Hospital-wide or enterprise penetration testing
- Servers and workstations that don't host, carry or connect to voice
- EHR, payment card and medical device testing
- Physical security, social engineering beyond the call-handling test, and remediation work
Fixed fees, per annual assessment
- Core PBX annual assessmentOne Avaya Aura or Lucent DEFINITY call-control system and its adjuncts$5,500
- Remote siteEach site on the same PBX/ACD network$650
Fees include remote delivery and all nine deliverables. Each additional independent call-control system is priced as another core. Payment terms, start date and the final site list are confirmed on the signed proposal. Remediation, ongoing monitoring, training and penetration testing are quoted separately, so the assessment stays independent.
Estimate your annual fee
1 core × $5,500 + 8 sites × $650
Request a call with this estimateTake the details to your team
Two documents, prepared for your organization when you download them: the brochure and the standard scope of work.
Unified NWTalk it through with us
A short scoping call confirms your platform, your sites and the right assessment window.
- We confirm the core and remote site count for pricing
- We agree testing windows that avoid your peak call periods
- You get a proposal with the final site list and start date
Prefer the phone? Call +1 (215) 267-1155 or +1 (208) 944-9200.
Common questions
Is this a penetration test?
It includes active, non-destructive vulnerability and exposure testing of the voice platform. Where a weakness could allow access, we prove it to the minimum extent needed and stop. Deeper exploitation testing is a separate, independent engagement we can scope with you.
Do you listen to our calls?
No. We check who can observe, record and retrieve calls, and how recordings and voicemail are protected. We never listen to, record or keep call content.
Does this replace our IT security assessment?
No. It covers the voice platform that enterprise assessments tend to skim, and hands your IT team specific findings to fold into their program.
Will testing affect patient calls?
Tests that could affect service run in agreed windows with your telecom contact and maintenance provider informed. We don't run denial-of-service, load or failover tests on production systems, and either side can pause testing at any time.
Will you fix what you find?
Remediation is quoted separately so the assessment stays independent. Many findings land with your existing integrator or IT team; we can deliver the rest, including the server, workstation, remote-user and small-site upgrades the roadmap calls for.
We run a different platform. Can you help?
This offer is built for enterprise Avaya Aura and Lucent DEFINITY systems. If you run another platform, schedule a call and we'll tell you plainly whether we can help.
What do you need from us?
Read-only access or configuration exports, network diagrams, a site list, license entitlements and a telecom contact, mostly in the first week. The scope of work lists every item.