Blog
EMS Cybersecurity Insights & Resources
The Year-One Cybersecurity Plan for a New EMS Director
A 12-month roadmap for an EMS director inheriting an unknown security posture: what to assess, fix, budget for, and leave alone.
Fire/EMS Agency Merger: The Cybersecurity Questions Nobody Asks
Data classification, license portability, vendor timelines, and identity management questions you need to answer before merging two public-safety networks.
Mutual Aid and the Data-Sharing Agreement You Don't Have
When units cross jurisdictional lines on a mutual aid call, patient data crosses too. Most agencies lack DUAs and unified IR plans across multiple MSPs.
EMS Telemedicine Integration: BAA Chain and Security Architecture
How to secure the provider-on-the-truck telehealth workflow for community paramedicine and ET3, with the BAA chain and link-drop failure modes.
State Breach Notification Laws and the EMS Multi-Jurisdictional Problem
Somewhere right now, an EMS director is trying to figure out how many states they need to report a breach to. The ePCR vendor called at 4 PM on a Frid
Retiring MDTs: NIST 800-88, True Wipes vs. Factory Reset, and HIPAA Audit Proof
How NIST 800-88 applies to retiring EMS tablets, why factory resets leave PHI exposed, and the documentation needed for a HIPAA audit.
NEMSIS Data Submission and PHI Exposure — What Your Vendor Sends and Why You Should Verify It
Your ePCR vendor transmits full PHI through the NEMSIS V3 pipeline. The narrative field is an unguarded re-identification risk most agencies never audit. Here is how to validate the payload.