book a scoping call

About Zinc Lantern · Colchester, CT

we look carefully, then we tell you plainly — in that order.

A consultant’s desk at dusk: a laptop with a clinic network diagram, a highlighted printed report and a small glowing zinc lantern
Unit 20, Christy Lane Ext — where reports get written, ranked, and rewritten until a practice manager could read them aloud at a staff meeting.

Zinc Lantern is a small security consultancy for independent medical and dental practices. We do three things — risk assessments, phishing drills and firewall audits — remotely, for a flat fee, with a report your office manager can finish in one coffee.

book a free scoping call or see what each engagement covers →

the short version

based in
Colchester, CT — 8 Christy Lane Ext Unit 20
works with
Independent medical and dental practices, two chairs to forty staff
works when
Mon–Fri 8am–5:30pm, evenings by appointment
bills how
One flat fee per engagement, from $1,185

№ 01 · why zinc, why a lantern

a name borrowed from a rust-proof metal and a light you carry by hand

Zinc Lantern started in Colchester after one too many practice managers slid a security report across the table and asked us what it meant. They’d paid for it. It was ninety pages long. It said “critical” forty-one different ways and never once said who should do what by Friday.1

So we built the opposite. A short report, ranked fix-first, fix-soon, fix-eventually, with a name beside every item — you, your IT vendor, or us. Written for the person who also orders the gloves, chases the insurance remits and knows exactly which drawer the spare toner lives in.

a security report nobody reads is just a paperweight with a staple in it.

The zinc part comes from galvanizing: steel gets a coat of zinc, and the zinc takes the weather so the steel doesn’t have to.2 That felt like the right job description. We take the tedious, suspicious, read-every-firewall-rule part so your team can get back to teeth and blood pressure.

The lantern part is simpler. You can’t fix what you can’t see, and most small clinic networks have never had anyone walk them end to end with the lights on. We go slowly, we look in the corners, and we only work on clinics — on purpose.3

  1. We’ve read a few of these. Some had appendices longer than the findings, and one had a glossary that needed a glossary.
  2. Technically the zinc corrodes first, on purpose. Noble. Slightly tragic. Very good for fences.
  3. Two chairs to forty staff. Above that you likely have an IT department, and they likely have opinions about us.

№ 02 · house rules

the rules we taped above the desk, so we can’t pretend we forgot

Every consultancy has principles. Ours come in pairs: a thing we’ll do gladly, and the tempting shortcut next to it that we’ve agreed to keep walking past.

Zinc Lantern house rules: what we will do, and what we won’t
we’ll gladly we’ll politely decline
Sign a Business Associate Agreement first.Before we see a single login, let alone a patient name.
Sell you a “HIPAA certified” badge.There’s no official one to sell. Anyone offering a seal is offering a sticker.
Put the whole fee in writing up front.One number on the engagement letter, the same number on the invoice.
Bill by the hour.Nobody should pay for the forty minutes we spend on hold with your EHR vendor.
Report phishing results by role.“Front desk clicked twice” teaches the office something useful.
Hang a wall of shame in the break room.Embarrassed people stop reporting weird emails. That’s the opposite of the point.
Hand your IT vendor a ranked list.They keep things running; we check what’s locked. Most vendors are quietly glad for the help.
Recommend hardware we profit from.We don’t resell firewalls, so we’ve no reason to tell you yours needs replacing unless it does.
Run scans after the last patient leaves.Evenings by appointment, so the schedule stays full.
Borrow an operatory.Or the sterilization room. Or anyone’s chair, for that matter.
Tell you when you need less.Sometimes the honest answer on a scoping call is “just the phishing one.”
Scare you into the bundle.Fear is a lousy sales tool and a worse security strategy.

Catch us breaking one? Call us on it: (860) 377-0798.

№ 03 · what the lantern turns up

the usual suspects, usually behind the x-ray machine

No two clinics are alike, but the culprits rhyme. Here’s the sort of thing that turns up when we walk a small practice’s network — ranked the way your report would rank it.

A highlighted printed findings report on a clipboard beside a crossed-out password sticky note and a security key
find yours before somebody else does
  1. fix-first

    one login for the whole front desk

    When everyone signs in as frontdesk1, nobody is accountable — and the audit log can’t tell you who opened which chart. Individual logins, quick switching, done.

  2. fix-first

    guest wi-fi one hop from the scheduling server

    The waiting room should be able to stream cartoons, not stroll over to the practice-management database. Separate networks, separate passwords.

  3. fix-first

    former staff still holding the keys

    The hygienist who moved to Glastonbury may still have a working email account, a remote-access login, or both. We match the account list against who actually still works there.

  4. fix-soon

    the imaging pc nobody dares update

    Usually the machine wired to the sensor or panoramic software, running an older Windows because the vendor said so. We don’t pretend it’s fine — we wall it off so it can’t talk to anything it shouldn’t.

  5. fix-soon

    backups that have never been restored

    A backup nobody has tested is a rumor. During the look-around we ask you to restore one file while we watch. It’s oddly suspenseful.

  6. fix-soon

    multi-factor on email, but not on remote access

    A strong front door with the side gate propped open. The remote-desktop tool your billing person uses from home deserves the same second factor.

  7. fix-eventually

    the wi-fi password taped to the router

    Inside a locked back office, it’s low risk. Still, we’ll gently suggest a drawer. Every office has one person who knows the password anyway.

№ 04 · a year with the lights on

a clinic’s security year, pinned to the break-room calendar

Security has seasons, same as flu shots. This is the rhythm we suggest to clinics that ask — the lit months are where an engagement fits neatly, and the rest are small chores your team can handle on a slow afternoon.

  1. risk assessment

    january 01

    New year, fewer excuses. The Security Rule wants your risk analysis kept current — January is a tidy place to redo it.

  2. phishing · round 1

    february 02

    W-2 season. Expect “payroll needs your updated tax form” emails. Good month for the bait to start.

  3. phishing · round 2

    march 03

    Round two, slightly sneakier. The “new fax received” lure usually makes its debut here.

  4. phishing · round 3

    april 04

    Final round, then a 20-minute lunchtime huddle on what everyone spotted. Sandwiches optional.

  5. may 05

    Quiet stretch. Patch the machine you’ve been tiptoeing around, and check who still has admin rights.

  6. june 06

    Summer hires and students arrive. New people, new logins — give each one their own, from day one.

  7. hardening audit

    july 07

    Vacation calendars often thin the schedule. A good moment for us to read every firewall rule.

  8. august 08

    Work through the audit’s fix-soon items before fall picks up and everyone remembers they’re busy.

  9. september 09

    Restore one file from backup. Just one. If it comes back, celebrate. If it doesn’t, call us.

  10. you are here

    october 10

    Cybersecurity Awareness Month. We will be insufferable about it, and a scoping call now books January neatly.

  11. november 11

    Dust off your Business Associate Agreements — every vendor that touches patient data needs one on file.

  12. december 12

    Delivery-notice and gift-card scams are everywhere. A two-line reminder email to staff costs nothing.

Any engagement can run any month — this is a suggested rhythm, not a subscription. We don’t sell one.

see the fees for each lit month →

№ 05 · your move

ready to start?

twenty minutes on the phone, then you’ll know exactly what you need

The scoping call is free and refreshingly short. We count workstations and logins, ask what’s been keeping you up at night, and recommend one engagement — or tell you to hold off. Then the fee goes in writing.

  • Flat fees: risk assessment $2,340, phishing campaign $1,185, hardening audit $1,670.
  • A fix-first report within ten business days of the last scan, plus a 60-minute walkthrough.
  • Remote, with evenings by appointment — not one chair blocked on your schedule.
(860) 377-0798 appointments@zinclanterngroup.com 8 Christy Lane Ext Unit 20, Colchester, CT 06415
admit one scoping call 20 minutes · phone or video
cost$0