Skip to main content
HackFirstAidMedical
Scope of use

What this site is — and isn't.

Not legal advice. The playbooks, regulatory grid, and self-check on this site are general guidance for small clinical practices. Nothing here is legal advice and nothing here substitutes for guidance from counsel, your privacy officer, your cyber insurer, or your medical-board licensing authority.

No Business Associate relationship is created by reading this site. A Business Associate Agreement (BAA) between HackFirstAid Medical and a covered entity is only formed in writing, signed by both parties, as part of a paid engagement. Reading playbooks, taking the self-check, or browsing the regulatory grid does not create a BAA.

We do not store customer PHI. Our work is advisory, training, and incident response. All patient data stays on the practice's systems. The self-check on this site runs entirely in your browser — answers are not transmitted to us.

If you have an active breach, call your privacy officer, your cyber insurer, and your counsel first. Then talk to us — but the legal and insurer relationships are the gating ones.

Jurisdiction. Specific state, provincial, and country laws may impose stricter requirements than the federal baselines referenced on this site. Always confirm the applicable timeline and threshold with counsel familiar with your jurisdiction.

Built by

Travis R. Barlow.

25+ years in incident response. 580+ engagements. Founder of AtlSecCon, one of Canada's longest-running security conferences. No SDR, no junior associate — you talk to the person who has run this incident before.

25+
years IR
580+
engagements
1–25
provider ICP
Scenarios we have walked practices through

Illustrative composites drawn from practitioner conversations. No patient or practice identifiers.

  • Ransomware · Friday afternoon

    Walked the office manager of an 8-provider primary-care clinic through the first three hours — who to call, what not to touch, and what the 60-day HIPAA clock meant.

  • Cyber-insurer renewal

    A 3-provider dermatology clinic pulled the playbooks, customized two pages, and the underwriter accepted the plan — instead of a $9,000 consulting engagement.

  • BEC wire-fraud attempt

    A 5-provider OB/GYN group had read the Front-Desk Email Compromise playbook the week before. Their dual-approval rule caught the wire and prevented the loss.

  • MSP handoff to physician-owner

    The HIPAA self-check produced a one-page gap list an MSP could hand to a physician-owner — no jargon translation required.

Upgrade — vCISO

Your MIPS-ready SRA — and a named owner for the 60-day clock.

Training gets your people ready and advisory is there when something breaks. When you need someone to own the program — the HIPAA Security Rule, your annual SRA, and 405(d) “reasonable security” — and be the name your OCR, cyber insurer, EHR/clearinghouse business associates, and (in Canada) your provincial health privacy commissioner can point to, that’s the HackFirstAid vCISO: a security leader on retainer. Built for the EHR/vendor ransomware event mid-clinic-day, where the breach clock starts before the schedule clears.

We own your program

Strategy, risk register, roadmap, governance, cadenced reviews, and the OCR, cyber-insurer, EHR/clearinghouse BA, and provincial privacy commissioner conversations.

Independent partners execute

DFIR, SOC, pen-testing, tooling, legal, brokerage — coordinated by your vCISO, never sold by us.

Small Practice
CA$1,800/mo
Solo & the smallest offices — quarterly cadence
Foundations
CA$3,000/mo
Managed
CA$6,500/mo
Most chosen
Embedded
CA$12,000/mo

Billed annually. Every tier includes a named vCISO, a 90-day on-ramp, and household coverage.

Explore the vCISO Book a fit call →