01Executive Recommendation

Recommended architecture: Master-of-record lives in the existing Content Engine (WS2) asset registry on AWS S3 under SGA's existing AWS BAA — not in SharePoint, not in a new DAM. Public delivery splits by content class: Cloudflare Stream for de-identified marketing content (doctor bios, B-roll, service explainers, culture, sponsorship), and Vimeo Enterprise with a signed BAA SKU for the narrow set of patient-featured testimonial video where identifiable patients or procedure details are present.

YouTube collapses to a single SGA brand channel plus optional regional SGA channels — no per-practice channels in year one. GBP video (30-sec vertical cutdown) becomes the tier-1 local-SEO surface, refreshed quarterly on all ~248 profiles, produced as a mandatory deliverable of every video project and propagated through Yext for the entities we already manage there.

02Architecture Diagram

Master library and publishing destinations are physically separated. The Content Engine (WS2) is the metadata + release plane; storage is a physical layer under it; each publishing destination is a downstream provider adapter mirroring the same Canva/Zernio stub pattern already in the codebase.

                                 ┌────────────────────────────────────────────────┐
                                 │      CAPTURE (Intune-enrolled devices only)    │
                                 │  Studio cameras | Growth Manager PWA capture   │
                                 └───────────────────────┬────────────────────────┘
                                                         │  raw upload
                                                         ▼
┌───────────────────────────────────────────────────────────────────────────────────────────┐
│                    MASTER LIBRARY  (system of record, BAA-covered)                        │
│                                                                                           │
│   AWS S3 (originals) ── under existing AWS BAA ── keyed by asset_id                       │
│        ▲                                                                                  │
│        │ presigned URLs                                                                   │
│        │                                                                                  │
│   Content Engine (WS2) asset-registry ── Postgres (RDS)                                   │
│     • assets, brands, consent_registry, distribution_posts, audit_log                     │
│     • Sharp/FFmpeg processing → thumbnails, ABR renditions, WebVTT captions               │
│     • Editorial queue → Brand Review → Compliance Approver → Publish                      │
│                                                                                           │
│   SharePoint MIRROR (read-only, working-copy)                                             │
│     • Syncs from S3 by scheduled job — Growth Manager desktop browse only                 │
│     • Never system of record. Never public embed source.                                  │
└──────────────────┬──────────────────────────────┬─────────────────────────────────────────┘
                   │ metadata + releases          │ authenticated API calls
                   ▼                              ▼
┌──────────────────────────────────────┐   ┌───────────────────────────────────────────────┐
│   METADATA & RELEASES  (WS2 tables)  │   │   PROVIDER ADAPTERS (WS2, mirrors Canva/      │
│  • authorization (164.508 HIPAA)     │   │    Zernio stub pattern)                       │
│  • model_release / staff_release     │   │   StreamProvider | VimeoProvider |            │
│  • guardian_authorization + assent   │   │   YouTubeProvider | YextProvider | GBP        │
│  • release_expiration → Temporal     │   └──────────────┬────────────────────────────────┘
│  • state_of_recording (state rules)  │                  │
│  • brand_valid_through (rebrand)     │                  │
│  • contains_identified_patient flag  │                  │
│  • paid_media_permission per network │                  │
│  • language / caption human-reviewed │                  │
│  • biometric_state_flag (BIPA/CUBI)  │                  │
└──────────────────────────────────────┘                  ▼
┌─────────────────────────────────────────────────────────────────────────────────────────────┐
│                                    PUBLISHING DESTINATIONS                                  │
│                                                                                             │
│  ┌──────────────────────────────┐   ┌────────────────────────────┐   ┌─────────────────┐   │
│  │  Practice websites           │   │  YouTube (single SGA       │   │  Social via     │   │
│  │   • Cloudflare Stream        │   │    brand channel)          │   │  Zernio (WS2)   │   │
│  │     (de-identified only)     │   │   • no per-practice ch     │   │   • 9:16 Reels/ │   │
│  │   • Vimeo Enterprise + BAA   │   │   • per-location playlists │   │     TikTok      │   │
│  │     (patient testimonials)   │   │   • unlisted testimonials  │   │     cutdowns    │   │
│  │   • Direct MP4 from R2       │   │     ONLY if 164.508 auth   │   └─────────────────┘   │
│  │     (hero autoplay, LCP)     │   │     names YouTube          │                         │
│  │   • VideoObject schema.org   │   └────────────────────────────┘   ┌─────────────────┐   │
│  └──────────────────────────────┘                                    │  Paid media     │   │
│  ┌──────────────────────────────┐   ┌────────────────────────────┐   │  Google Ads /   │   │
│  │  GBP video (tier 1 local-SEO)│   │  Yext (SGA entities)       │   │  Meta / TikTok  │   │
│  │  30s / ≤75MB / ≤1080p / 9:16 │   │   • pushes to GBP where    │   │   • separate    │   │
│  │  Quarterly refresh, 248 GBPs │   │     enabled                │   │     paid-media  │   │
│  └──────────────────────────────┘   └────────────────────────────┘   │     consent     │   │
│                                                                      └─────────────────┘   │
└─────────────────────────────────────────────────────────────────────────────────────────────┘
                          ▲
                          │  release expiration | revocation | rebrand | doctor departure
                          │  fires Temporal workflow → auto-unpublish fan-out
                          │  → audit_log immutable record → notify Compliance
                          │
┌─────────────────────────────────────────────────────────────────────────────────────────────┐
│  PERMISSIONS PLANE                                                                          │
│   • Entra ID = identity of record for humans                                                │
│   • Google Cloud Identity/Workspace = identity plane for YouTube brand accounts             │
│   • SSO from Entra ID → Google → YouTube via SAML                                           │
│   • FIDO2 hardware keys required for Primary Owners; Advanced Protection Program enrolled   │
│   • Break-glass Workspace account in physical safe                                          │
│                                                                                             │
│  ANALYTICS PLANE                                                                            │
│   • GA4 (per-practice site) → BigQuery export → Power BI                                    │
│   • YouTube Analytics API per-channel OAuth cron → Power BI                                 │
│   • Cloudflare Stream GraphQL API → Power BI                                                │
│   • Aggregated at brand / region / service-line — NOT per-video CPA (statistical floor)     │
│                                                                                             │
│  RELEASES/COMPLIANCE PLANE                                                                  │
│   • WS2 consent_registry = system of record for signed PDFs + expiration + revocation       │
│   • Temporal workflow = enforcement                                                         │
│   • Unified Audit Log (M365) + AWS CloudTrail + Cloudflare audit logs = investigation trail │
└─────────────────────────────────────────────────────────────────────────────────────────────┘

03Options Scorecard

Scores are 1–5 (higher is better) with citation anchors. Verified = pulled from current official docs during review. Assumption = review-team inference. Final row = recommended role in the architecture.

04YouTube Decision Framework

Default posture: no dedicated practice channel. Video ships to the SGA brand channel with practice branding baked into the video itself. All thresholds are gates that must be sustained, not one-time hurdles.

Override rule

The only case that overrides Tiers 0–3 is a provider-personal-brand doctor whose contract with SGA explicitly reserves them a personal channel for continuing-education content. That channel is NOT an SGA asset, owned by the doctor's Workspace identity, and any patient-facing content on it triggers the 164.508 authorization workflow the same as any SGA channel. Not more than 3 exceptions network-wide.

Explicitly excluded

• No individual practice channel for 1–2 videos. Ever.
• No Google-account-per-office model. All channels attached to a corporate Google Workspace or Cloud Identity Free tenant.
• No parallel consumer channels for legacy sub-brands. Single SGA brand channel is the only corporate presence on YouTube.

05Risk Register

06Governance Model

RACI convention: Responsible · Accountable (exactly one) · Consulted · Informed.

What the Growth Manager will and will not do

This is deliberate. GMs are already at 60–80 practices each. AI-first posture requires the fractional Video Ops Lead + WS2 tooling to absorb the load, not push it downhill.

07Pilot Plan

Pilot locations (5 practices, deliberately mixed)

Belfast is deliberately excluded — crosswalk-blocked per current project record; not a stable enough substrate for a 90-day pilot.

Asset types (each pilot practice ships ≥1 of each)

• Doctor bio (60-90s, non-PHI) — de-identified, staff release only
• Service explainer (60-120s, non-PHI) — general procedure walk-through, no patient
• Practice tour / B-roll (30-60s, non-PHI) — incidental-capture cleared
• Community sponsorship (60s, non-PHI, minors under school-district permission) — tests the missing sponsorship-release track
• Patient testimonial (60s, PHI-adjacent) — only after signed 164.508 authorization AND Compliance Approver sign-off; Vimeo Enterprise + BAA (not Stream, not YouTube unless auth explicitly names YouTube)

Platforms to test

• Master: WS2 asset registry + S3 (existing) — no new platform
• Website embed (de-identified): Cloudflare Stream via new StreamProvider adapter
• Website embed (patient testimonial): Vimeo Enterprise + BAA
• YouTube: Single SGA brand channel; per-location playlists
• GBP: Yext-driven where enabled; direct upload for the rest; verify propagation
• Social: Zernio existing distribution path; validate 9:16 cutdowns
• Paid boost: NOT in scope for pilot (defer to post-pilot)

Success metrics (12 weeks)

Timeline (12 weeks)

• Weeks 1–2: Legal template set finalized (4 releases). Vimeo Enterprise BAA SKU signed. Cloudflare BAA scope confirmed. Video Ops Lead onboarded. StreamProvider + VimeoProvider scaffolding.
• Weeks 3–4: WS2 schema PR (10 new fields). Temporal expiration workflow written + drilled on test asset.
• Weeks 5–8: Capture + ingest at all 5 pilots. Editorial + Brand Review + Compliance Approver run for real.
• Weeks 9–10: GBP + Yext + Zernio propagation validated. Power BI dashboards at brand / region.
• Weeks 11–12: Metrics review. Go/no-go decision.

Required resources

• Video Ops Lead contractor: $60–90K/yr, prorated to 3 months ≈ $15–22K
• Vimeo Enterprise + BAA quote — ~$25K/yr, prorated
• Cloudflare Stream at pilot volumes — <$500 (usage-priced)
• Google Cloud Identity Free OR Workspace — $70–112/mo
• Studio time — 40–60 hrs across 12 weeks (absorbed, no new hire)
• WS2 engineering — 3–4 dev weeks
• Legal template drafting — $8–12K one-time
• Corporate VoIP DIDs for YouTube phone verification — 3–5 numbers from existing Twilio HIPAA stack, ~$50/mo total

Explicit go/no-go criteria

08Open Questions

Each is framed as a specific question a specific person can answer. These are the inputs the Video Ops Lead and the pilot depend on.

09Final Verdict & Next Actions

The plan's instincts are sound — no individual practice Gmails, a central master library, a tiered YouTube model with corporate ownership, phased rollout — and every one of the six domain reviews plus the red team landed at "approve with modifications" independently. But the plan as written mixes together two jobs (master library and public video host) that need different platforms, treats SharePoint as a plausible DAM when the existing Content Engine (WS2) already IS the DAM, understates the compliance gates that must ship before the pilot rather than after, and misses the highest-conversion short-form surfaces (Reels, TikTok) entirely.

The recommended modifications preserve the plan's structure while closing the compliance, cost, and operational gaps — and reject the two most consequential misfits (SharePoint-as-DAM and Wistia-as-embed-host) in favor of the architecture SGA already partially owns (WS2 + S3 + Cloudflare + a narrow Vimeo Enterprise carve-out for patient content).

The five most important next actions