Do you know where non-public personal information lives in our environment?

No provider can answer this honestly before looking. What we can tell you is that the answer is almost always broader than the owner expects.

NPI accumulates in places nobody designed: mailboxes going back years, local Downloads folders on individual workstations, spreadsheets exported for a one-off report and never deleted, scanner destination folders, personal cloud storage that someone set up when the VPN was slow, and old file shares from an office you acquired.

During onboarding we map where it actually sits, reduce the footprint, get retention and disposal applied so data does not live forever by default, and lock down the paths that should not exist. That work supports Pillar 3 directly and it is also the difference between a contained incident and a notification event affecting every transaction you have ever handled.

The uncomfortable truth for most agencies is that the mailboxes are the real archive, not the document management system.