Blog
EMS Cybersecurity Insights & Resources
Social Engineering the Dispatch Center: Attack Scenarios and Verification Protocols
Three realistic social engineering attacks targeting public safety dispatch centers and the verification protocols that stop them.
Retiring MDTs: NIST 800-88, True Wipes vs. Factory Reset, and HIPAA Audit Proof
How NIST 800-88 applies to retiring EMS tablets, why factory resets leave PHI exposed, and the documentation needed for a HIPAA audit.
Pre-Plan Security: The PHI-Adjacent Data Most Fire Departments Leave Unlocked
Alarm codes, Knox box combinations, occupant medical conditions, and hazmat locations live in your pre-plan system with weaker access controls than your ePCR. Here is the fix.
The Texting Problem: When SMS Between Crews Becomes a HIPAA Issue
When does SMS between EMS crews cross from operational chatter into a HIPAA violation? Direct guidance on OCR rules, secure messaging policy, and what a defensible mobile policy looks like.
NEMSIS Data Submission and PHI Exposure — What Your Vendor Sends and Why You Should Verify It
Your ePCR vendor transmits full PHI through the NEMSIS V3 pipeline. The narrative field is an unguarded re-identification risk most agencies never audit. Here is how to validate the payload.
The HIPAA Risk Analysis That Holds Up Under OCR Review
OCR expects a risk analysis that maps threats to vulnerabilities, not a generic compliance checklist. Here is what 45 CFR 164.308(a)(1)(ii)(A) actually requires and how to build it for your EMS agency.
Building an Incident Response Plan That Survives Contact With a Real EMS Cyber Incident
Generic IT incident response plans fail in EMS. Build a plan that accounts for clinical continuity, dispatch, NEMSIS, and the 2 a.m. runbook.
Beyond the Password: Moving EMS to Identity-Based Security
Shared passwords fail HIPAA requirements for unique user identification. WPA2-Enterprise and certificate-based authentication close the gap.
MFA for the Ambulance: Why Just Use a YubiKey Isnt the Answer
YubiKeys, SMS codes, and authenticator apps fail in the field. Here is a layered MFA approach designed for the back of an ambulance.
PHI in Training Videos: The HIPAA Exposure Most Agencies Miss
Body-cam footage, QA clips, and training videos contain invisible PHI. Most agencies fail Safe Harbor. Here is a defensible workflow.