IRON RODSecurity

EMS Cybersecurity Insights & Resources

Social Engineering the Dispatch Center: Attack Scenarios and Verification Protocols

Three realistic social engineering attacks targeting public safety dispatch centers and the verification protocols that stop them.

Dispatch center securitySocial engineeringVishingPsapPublic safety

Retiring MDTs: NIST 800-88, True Wipes vs. Factory Reset, and HIPAA Audit Proof

How NIST 800-88 applies to retiring EMS tablets, why factory resets leave PHI exposed, and the documentation needed for a HIPAA audit.

Mdt sanitizationNist 800 88Hipaa complianceEpcr data securityChain of custody

Pre-Plan Security: The PHI-Adjacent Data Most Fire Departments Leave Unlocked

Alarm codes, Knox box combinations, occupant medical conditions, and hazmat locations live in your pre-plan system with weaker access controls than your ePCR. Here is the fix.

Pre plan securityKnox boxPHIFire departmentAccess control

The Texting Problem: When SMS Between Crews Becomes a HIPAA Issue

When does SMS between EMS crews cross from operational chatter into a HIPAA violation? Direct guidance on OCR rules, secure messaging policy, and what a defensible mobile policy looks like.

Sms hipaa violationHipaa compliant messaging emsMobile messaging policy fire departmentOcr sms guidanceOperational chatter phi

NEMSIS Data Submission and PHI Exposure — What Your Vendor Sends and Why You Should Verify It

Your ePCR vendor transmits full PHI through the NEMSIS V3 pipeline. The narrative field is an unguarded re-identification risk most agencies never audit. Here is how to validate the payload.

NEMSISPhi exposureEpcr securityEms dataHipaa compliance

The HIPAA Risk Analysis That Holds Up Under OCR Review

OCR expects a risk analysis that maps threats to vulnerabilities, not a generic compliance checklist. Here is what 45 CFR 164.308(a)(1)(ii)(A) actually requires and how to build it for your EMS agency.

Hipaa risk analysisOcr review45 cfr 164 308Ems securityEphi

Building an Incident Response Plan That Survives Contact With a Real EMS Cyber Incident

Generic IT incident response plans fail in EMS. Build a plan that accounts for clinical continuity, dispatch, NEMSIS, and the 2 a.m. runbook.

Incident responseRansomwareEMSClinical continuityNEMSIS

Beyond the Password: Moving EMS to Identity-Based Security

Shared passwords fail HIPAA requirements for unique user identification. WPA2-Enterprise and certificate-based authentication close the gap.

Wpa2 enterpriseCertificate based authenticationEMSHIPAAShared passwords

MFA for the Ambulance: Why Just Use a YubiKey Isnt the Answer

YubiKeys, SMS codes, and authenticator apps fail in the field. Here is a layered MFA approach designed for the back of an ambulance.

MFAAuthenticationEMSHIPAAYubikey

PHI in Training Videos: The HIPAA Exposure Most Agencies Miss

Body-cam footage, QA clips, and training videos contain invisible PHI. Most agencies fail Safe Harbor. Here is a defensible workflow.

HIPAAPHIBody cameraTraining videosDe identification
EMS Cybersecurity Blog and Resources | Iron Rod Security