Skip to main content
HackFirstAidMedical
Training library

The clinical practice training library — included with every subscription.

Three self-paced modules, refreshed quarterly, built for the way a small practice actually runs. Modules 01 and 02 share the training backbone used across the HackFirstAid family; Module 03 is exclusive to this site.

Module 01

Personal Protection — Clinician Edition

The everyday habits that keep credentials, devices, and PHI out of the wrong hands.

  • Credential phishing against the EMR — how it actually looks
  • Home-office PHI hygiene: screens, printers, storage
  • Personal-device rules for messaging, email, and photos
  • MFA, password managers, and recovery contacts done right
  • Family enrollment included at no extra cost
Self-paced · refreshed quarterly
Shares the family training backbone used across HackFirstAid sites.
Module 02

Incident Oversight — The Practice Manager's Call

The decisions only a practice leader can make in the first hour.

  • Patient-safety-first decisions when systems go dark
  • The OCR/HIPAA clock: what starts when, and who tracks it
  • Cyber-insurer coordination without losing control of the response
  • When to divert patients — and how to tell them
  • Tabletops adapted to the small-practice persona
  • Documentation habits that survive an OCR review
Self-paced · refreshed quarterly
Shares the family training backbone used across HackFirstAid sites.
Module 03Exclusive to this site

Clinical Continuity Track

The clinical-side drills the other HackFirstAid sites don't cover.

  • EMR-down paper-workflow drills for exam rooms and front desk
  • Breach-notification walkthroughs: patients, OCR, and media thresholds
  • Business-associate vendor incident response (clearinghouse, EHR, RCM)
  • Controlled-substance and ePrescribing incident procedures
  • Restoring clinical trust with staff and patients after an event
Self-paced · refreshed quarterly

Training is included with every paid tier

Access the modules from your client area once you're signed in. Practice and Practice + Retainer subscribers get all three, plus quarterly refreshes and family enrollment for Module 01.

Sign in to access trainingSee pricing →
Built by

Travis R. Barlow.

25+ years in incident response. 580+ engagements. Founder of AtlSecCon, one of Canada's longest-running security conferences. No SDR, no junior associate — you talk to the person who has run this incident before.

25+
years IR
580+
engagements
1–25
provider ICP
Scenarios we have walked practices through

Illustrative composites drawn from practitioner conversations. No patient or practice identifiers.

  • Ransomware · Friday afternoon

    Walked the office manager of an 8-provider primary-care clinic through the first three hours — who to call, what not to touch, and what the 60-day HIPAA clock meant.

  • Cyber-insurer renewal

    A 3-provider dermatology clinic pulled the playbooks, customized two pages, and the underwriter accepted the plan — instead of a $9,000 consulting engagement.

  • BEC wire-fraud attempt

    A 5-provider OB/GYN group had read the Front-Desk Email Compromise playbook the week before. Their dual-approval rule caught the wire and prevented the loss.

  • MSP handoff to physician-owner

    The HIPAA self-check produced a one-page gap list an MSP could hand to a physician-owner — no jargon translation required.

Upgrade — vCISO

Your MIPS-ready SRA — and a named owner for the 60-day clock.

Training gets your people ready and advisory is there when something breaks. When you need someone to own the program — the HIPAA Security Rule, your annual SRA, and 405(d) “reasonable security” — and be the name your OCR, cyber insurer, EHR/clearinghouse business associates, and (in Canada) your provincial health privacy commissioner can point to, that’s the HackFirstAid vCISO: a security leader on retainer. Built for the EHR/vendor ransomware event mid-clinic-day, where the breach clock starts before the schedule clears.

We own your program

Strategy, risk register, roadmap, governance, cadenced reviews, and the OCR, cyber-insurer, EHR/clearinghouse BA, and provincial privacy commissioner conversations.

Independent partners execute

DFIR, SOC, pen-testing, tooling, legal, brokerage — coordinated by your vCISO, never sold by us.

Small Practice
CA$1,800/mo
Solo & the smallest offices — quarterly cadence
Foundations
CA$3,000/mo
Managed
CA$6,500/mo
Most chosen
Embedded
CA$12,000/mo

Billed annually. Every tier includes a named vCISO, a 90-day on-ramp, and household coverage.

Explore the vCISO Book a fit call →