The wire went to an account registered to the name of the Cascade County clinic’s administrative director.
I sit back in my chair.
The amount isn’t large. That’s the detail that lands hardest, actually. It isn’t a number that suggests desperation or extravagance. It’s a number that suggests a man who has done this before and knows exactly what institutional access costs in a mid-sized regional medical system. Not too much, not too little. Enough to make the administrator’s calculation simple without making the transaction look irregular from the outside.
I open the transfer paperwork for Monday’s appointment.
The ambulance is pre-authorized. Private medical transport, a company called Patient Transfer Solutions, registered in Oregon, no flags on any database I have access to. The authorization paperwork is dated last Tuesday, which is three days before the appointment was added to Mira’s schedule.
I read that twice.
The transport was authorized before the appointment existed. Someone built the legal infrastructure for this transfer, the ambulance, the authorization, and the medical necessity documentation before they scheduled the transfer itself. The appointment in Mira’s file is the last piece of a structure that was fully assembled before she knew the structure existed.
Monday morning, a legitimate ambulance from a licensed medical transport company was planning to arrive at the regional hospital with pre-authorized transfer paperwork signed by a doctor whose credentials would check out and countersigned by an administrator who had accepted a wire transfer from a shell company connected to Viktor Sokolov’s financial network.
The ambulance would take her to a facility two counties over.
She would not arrive at that facility.
I pick up my phone and call the regional hospital’s administrative line. It’s early enough that I get a duty administrator rather than the main office, which is better. I identify myself as the medical coordinator for a private patient, use the language I’ve learned from watching Doc operate within the system for two weeks, and request the immediate cancellation of a Monday appointment for a patient currently under the full-time care of a private physician. Club doctor handles all care. All external referrals require prior authorization from the primary physician. The appointment was scheduled without that authorization and needs to be removed.
The duty administrator is compliant and efficient, and the appointment is canceled in four minutes.
I hang up, open a separate browser, and navigate to the state medical board’s anonymous complaint portal. I file a detailed report about the Cascade County administrator’s unauthorized access to a patient’s medical records and the privacy violations associated with scheduling procedures without physician authorization. I include the IP access timestamp, the appointment addition timeline, and enough specific detail that the complaint will require a formal investigation to close.
I don’t include the wire transfer. That goes somewhere else, later, through a channel that won’t connect back to this compound.
I send the complaint and close the browser.
Fourteen minutes, start to finish, from finding the IP access to canceling the appointment and filing the complaint. I pick up my phone and call Cade.
He picks up on the second ring. “Yeah.”
“Security office,” I say. “Now.”
He doesn’t ask questions. Eight minutes later, he’s at the door.
I walk him through it sequentially. The IP access, the appointment, the facility, the administrator, the wire transfer, and the transport authorization dated three days before the appointment was authorized. I put the documents on the screen as I go, and I let him read each one in full before I move to the next, because Cade reads the way I read, completely and without rushing, and he makes better decisions when he’s had the full picture rather than a summary of it.
When I finish, he sits in the second chair and looks at the screen.
The silence runs for almost a minute.
“Monday morning,” he says.
“If I had run the check an hour later. If I’d skipped it because it’s Saturday. If I’d flagged the IP access and left the appointment for later.” I look at the screen. “She would have been in that ambulance before anyone on this compound knew the appointment existed.”
Cade looks at the transfer authorization. The date in the top right corner, last Tuesday, three days before the appointment was added.
“He built it while we were running the counterstrike,” he says.
“Yes. The wire transfer went out Thursday afternoon, which is the same day our counterstrike executed. He was absorbing the counterstrike’s impact and building this simultaneously.” I pause. “He didn’t react to the counterstrike. He had this already running. The counterstrike hit him, and he didn’t adjust his timeline. He just kept going.”
Cade is quiet.
“He doesn’t need to come through the gate,” I say. “That’s the thing I need you to understand fully. The physical perimeter we’ve built is real, and it’s effective against direct approaches. But Viktor isn’t making direct approaches. He needs one person inside a system that Mira has a legitimate reason to interact with. A medical administrator. A doctor outside Doc’s network. A social worker, an insurance case manager, a hospital intake coordinator. Any institutional contact point is a potential purchase.”
“Then she doesn’t have institutional contact points,” Cade says.