Blog
EMS Cybersecurity Insights & Resources
Wearables on Duty — Smartwatch PHI Risks and Agency Policy
Smartwatches and smart rings on first responders collect data in patient care zones. Agencies need a policy for BYOD wearables, whether issued or personal.
QR-Code Quishing at the Station — Attack Patterns and Practical Defenses
Quishing attacks target fire and EMS stations through fake QR codes on posters and stickers. Here is how they work and what to do about it.
Drone Footage at Fire Scenes: Chain of Custody, HIPAA, and the Cloud Security Default You Did Not Configure
Every fire department I work with has a drone now, maybe two. They bought it for thermal imaging on structure fires and scene overviews on MVCs, plus searc
42 CFR Part 2 in the Field: Substance-Use Disorder Confidentiality That HIPAA Doesn’t Cover
Most EMS agencies know HIPAA cold. They train on it at orientation, build their ePCR workflows around it, audit for it. And then 42 CFR Part 2 walks in thr
Crew Phones and Social Media at the Scene: A HIPAA Framework Built for Reality
A practical HIPAA framework for EMS agencies managing crew phone photos, social media posts, and scene documentation on personal devices. No blanket bans, just real workflows.
Building an Incident Response Plan That Survives Contact With a Real EMS Cyber Incident
Generic IT incident response plans fail in EMS. Build a plan that accounts for clinical continuity, dispatch, NEMSIS, and the 2 a.m. runbook.
Beyond the Password: Moving EMS to Identity-Based Security
Shared passwords fail HIPAA requirements for unique user identification. WPA2-Enterprise and certificate-based authentication close the gap.
MFA for the Ambulance: Why Just Use a YubiKey Isnt the Answer
YubiKeys, SMS codes, and authenticator apps fail in the field. Here is a layered MFA approach designed for the back of an ambulance.
PHI in Training Videos: The HIPAA Exposure Most Agencies Miss
Body-cam footage, QA clips, and training videos contain invisible PHI. Most agencies fail Safe Harbor. Here is a defensible workflow.
Vendor Risk Management for Small EMS Agencies Without a CISO
How to manage vendor risk for a small EMS agency without a CISO. A lean 80-20 approach focusing on the vendors that handle PHI and keep the trucks running.