Now touring independent clinics · Colchester, CT
Remote HIPAA security risk assessments, phishing drills and firewall audits for independent medical and dental practices. One flat fee, one fix-first report, and a consultant who explains it without sending your office manager for the aspirin.
№ 01 · who holds the lantern
Zinc Lantern started in Colchester, CT, after one too many practice managers showed us a ninety-page security report they’d paid for and couldn’t read. So we built the opposite: a short, ranked list of what to fix, written for the people who actually run the office.
We know what an imaging workstation, an e-prescribing token and a shared front-desk login look like, and why the hygienist’s tablet matters more than anyone thinks. No enterprise checklists bolted onto a four-op dental office.
Scans run through a lightweight agent and a couple of video calls. Nobody parks a laptop in your sterilization room or asks to borrow an operatory. Prefer we poke around after the last patient leaves? Evenings are on the menu.
No hand-offs to a junior analyst you’ve never met. The consultant who interviewed your practice manager and read your firewall rules is the one who writes the findings — and the one on the walkthrough call answering “wait, which router?”
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information…
№ 02 · how an engagement goes
Most engagements take three to five weeks from signed letter to walkthrough. The longest stretch is usually somebody hunting for the Wi-Fi router behind the panoramic x-ray.
Phishing campaigns run 90 days by design — fooling people properly takes patience.
get step one on the calendar →We count workstations, logins, locations and that one Windows machine attached to the sensor software. Then we tell you which engagement you actually need — occasionally fewer than you expected.
A one-page engagement letter with the fee printed on it, and a Business Associate Agreement signed before we look at anything with a patient’s name anywhere nearby.
A scanning agent goes on each workstation (about ten minutes apiece). We review firewall rules, Microsoft 365 or Google Workspace settings, Wi-Fi segmentation and backups, then interview your practice manager for 45 minutes.
Three rounds of convincing, harmless fake emails over 90 days — the “new fax received” lure is a perennial favorite. Anyone who clicks gets a two-minute lesson, not a scolding.
Every finding ranked fix-first, fix-soon or fix-eventually, with an owner beside it — you, your IT vendor, or us. Then a 60-minute walkthrough so nobody has to decode it alone.
№ 03 · the fees
Each fee covers one location and up to 15 workstations. Extra workstations are $65 each; a second location adds $480. Nothing hourly, nothing metered, no meter running while we wait on hold with your EHR vendor.
Invoiced half on signing, half when the report lands. Want us to do the fixing too? We’ll quote that separately after the report — plenty of clinics simply hand the list to their IT vendor, and that’s perfectly fine.
The analysis the Security Rule says you must perform — done properly, documented so it holds up if anyone ever comes asking.
Ninety days of friendly deception for up to 25 staff, so the real scam email meets a team that’s already seen its cousins.
We check whether the locks are actually locked: firewall rules, remote access, patch levels, disk encryption, and admin rights nobody should still have.
Assessment, audit and a phishing campaign, scheduled so each one’s findings feed the next. One combined report, one walkthrough, one invoice split in two.
light the whole thingtwenty minutes, no invoice
A scoping call tells us which engagement you actually need — and sometimes the honest answer is “just the phishing one.” The call costs nothing; the opinion is free and occasionally blunt.
book the scoping callor ring us directly: (860) 377-0798
№ 05 · odds & ends
A monthly note for practice managers, a list of what to dig up before we talk, and the honest answers to the questions everyone asks on the scoping call.
One email a month: one scam currently making the rounds at clinics, one fix you can make before lunch, and one terrible pun we couldn’t talk ourselves out of. Unsubscribe in a click — we won’t take it personally.
Probably. Your IT vendor keeps things running; we check whether they’re locked. Different jobs. Our report goes to them, not around them — most vendors are quietly glad to get a ranked list.
No single document does that, and anyone who promises otherwise is selling a certificate. The assessment is the analysis the Security Rule requires and the starting point for everything else. The report says so plainly.
Results are reported by role, not by name, unless you ask otherwise. The goal is fewer clicks and more “hey, this looks weird” reports — not a wall of shame in the break room.
About ten minutes per workstation for the agent install (after hours works fine), a 45-minute interview with your practice manager, and the 60-minute walkthrough at the end.
Then you get a short report and the rare pleasure of being boring. The fee stays the same — flat means flat in both directions.
Evenings suit scans nicely — your workstations are idle, and so is your front desk.
Nearly all our work is remote. Dropping by? Call first — we may be deep inside someone’s firewall.
Half on signing the engagement letter, half when the report lands in your inbox. The number on the ticket is the number on the invoice.
№ 06 · your move
ready to start?
Tell us a little about the practice and we’ll set up the 20-minute scoping call. Here’s what follows: