Blog
EMS Cybersecurity Insights & Resources
Crew Phones and Social Media at the Scene: A HIPAA Framework Built for Reality
A practical HIPAA framework for EMS agencies managing crew phone photos, social media posts, and scene documentation on personal devices. No blanket bans, just real workflows.
Public Records Security: What To Never Release
A public safety security review: what records adversaries request, the statutory exemptions, and a review process every agency needs.
Cyber Insurance for Small EMS and Volunteer Fire Services — The Clauses That Matter
What the policy clauses, MFA warranties, ransomware sublimits, and IR panel restrictions actually mean for small EMS and volunteer fire departments.
The Offboarding Gap That Leaves ePCR Access Open for Days
The gap between HR termination and ePCR access revocation in EMS agencies. How ImageTrend, ESO, and Zoll sessions stay alive and the same-day checklist that kills them.
BEC Against EMS Billing: The ACH Form That Costs Six Figures
EMS agencies lose six figures to BEC attacks on billing staff. Here is how the ACH change form scam works and the dual-approval workflow that stops it.
Social Engineering the Dispatch Center: Attack Scenarios and Verification Protocols
Three realistic social engineering attacks targeting public safety dispatch centers and the verification protocols that stop them.
Retiring MDTs: NIST 800-88, True Wipes vs. Factory Reset, and HIPAA Audit Proof
How NIST 800-88 applies to retiring EMS tablets, why factory resets leave PHI exposed, and the documentation needed for a HIPAA audit.
Pre-Plan Security: The PHI-Adjacent Data Most Fire Departments Leave Unlocked
Alarm codes, Knox box combinations, occupant medical conditions, and hazmat locations live in your pre-plan system with weaker access controls than your ePCR. Here is the fix.
The Texting Problem: When SMS Between Crews Becomes a HIPAA Issue
When does SMS between EMS crews cross from operational chatter into a HIPAA violation? Direct guidance on OCR rules, secure messaging policy, and what a defensible mobile policy looks like.
NEMSIS Data Submission and PHI Exposure — What Your Vendor Sends and Why You Should Verify It
Your ePCR vendor transmits full PHI through the NEMSIS V3 pipeline. The narrative field is an unguarded re-identification risk most agencies never audit. Here is how to validate the payload.
The HIPAA Risk Analysis That Holds Up Under OCR Review
OCR expects a risk analysis that maps threats to vulnerabilities, not a generic compliance checklist. Here is what 45 CFR 164.308(a)(1)(ii)(A) actually requires and how to build it for your EMS agency.
Building an Incident Response Plan That Survives Contact With a Real EMS Cyber Incident
Generic IT incident response plans fail in EMS. Build a plan that accounts for clinical continuity, dispatch, NEMSIS, and the 2 a.m. runbook.
Beyond the Password: Moving EMS to Identity-Based Security
Shared passwords fail HIPAA requirements for unique user identification. WPA2-Enterprise and certificate-based authentication close the gap.
MFA for the Ambulance: Why Just Use a YubiKey Isnt the Answer
YubiKeys, SMS codes, and authenticator apps fail in the field. Here is a layered MFA approach designed for the back of an ambulance.
PHI in Training Videos: The HIPAA Exposure Most Agencies Miss
Body-cam footage, QA clips, and training videos contain invisible PHI. Most agencies fail Safe Harbor. Here is a defensible workflow.
Vendor Risk Management for Small EMS Agencies Without a CISO
How to manage vendor risk for a small EMS agency without a CISO. A lean 80-20 approach focusing on the vendors that handle PHI and keep the trucks running.
When the Ambulance Is the Endpoint: Zero Trust for the Rig
An ambulance is a mobile data center. Here is how to apply zero trust principles to secure the modem, tablet, monitor, and camera without breaking clinical workflow.
Scaling 100 Trucks: Automation Strategies for Fire and EMS IT
How to deploy and manage 100 connected EMS vehicles using cloud management consoles, variable-driven templates, and MDM without manual per-truck setup.
The cPanel Bug That Compromised Thousands of Sites and Why Your Agency Should Care
CVE-2026-41940 in cPanel has compromised thousands of servers. Here is why your fire or EMS agency needs to check its hosting provider and what to ask.
Ransomware Hit the Hospital: The EMS Dependency Map Nobody Draws
When ransomware hits a hospital, EMS operations take a direct hit too. Here is the dependency map most agencies have not drawn and what to do about it.