Start your inquiry
You're considering: Practice — CA$849 / year
A few quick details and we'll reply within one business day with next steps, a BAA, and (if you'd like) three call times.
A few quick details and we'll reply within one business day with next steps, a BAA, and (if you'd like) three call times.
25+ years in incident response. 580+ engagements. Founder of AtlSecCon, one of Canada's longest-running security conferences. No SDR, no junior associate — you talk to the person who has run this incident before.
Illustrative composites drawn from practitioner conversations. No patient or practice identifiers.
Walked the office manager of an 8-provider primary-care clinic through the first three hours — who to call, what not to touch, and what the 60-day HIPAA clock meant.
A 3-provider dermatology clinic pulled the playbooks, customized two pages, and the underwriter accepted the plan — instead of a $9,000 consulting engagement.
A 5-provider OB/GYN group had read the Front-Desk Email Compromise playbook the week before. Their dual-approval rule caught the wire and prevented the loss.
The HIPAA self-check produced a one-page gap list an MSP could hand to a physician-owner — no jargon translation required.
Training gets your people ready and advisory is there when something breaks. When you need someone to own the program — the HIPAA Security Rule, your annual SRA, and 405(d) “reasonable security” — and be the name your OCR, cyber insurer, EHR/clearinghouse business associates, and (in Canada) your provincial health privacy commissioner can point to, that’s the HackFirstAid vCISO: a security leader on retainer. Built for the EHR/vendor ransomware event mid-clinic-day, where the breach clock starts before the schedule clears.
Strategy, risk register, roadmap, governance, cadenced reviews, and the OCR, cyber-insurer, EHR/clearinghouse BA, and provincial privacy commissioner conversations.
DFIR, SOC, pen-testing, tooling, legal, brokerage — coordinated by your vCISO, never sold by us.
Billed annually. Every tier includes a named vCISO, a 90-day on-ramp, and household coverage.