PRIVATE SECURITY ASSESSMENT
Identify the weak points.
Know what to fix first.
Find out where sensitive information could be exposed, what the evidence supports and which fixes deserve attention first. The assessment design gives your team clear priorities, responsible owners and a plan to verify the work.
Business inquiries welcome · Shield services are in development · View current availability
01 / WHAT YOU WOULD RECEIVE
System map → findings → corrections.
Owners → verification plan.
- 01
A map of your connected systems
Identify the agreed locations, tools, information paths and responsible people. The assessment covers the named systems—not every part of a vendor’s infrastructure.
- 02
Findings with a clear basis
Explain what was observed, when it was checked and what could not be verified. A reported answer does not become a confirmed problem just because it appears in a report.
- 03
A prioritized correction plan
Separate issues that need action from questions that need more information. Explain the recommended order and any dependencies.
- 04
A named owner for each next step
Agree which practice lead, IT provider or specialist should review and perform the work. A recommendation is not permission to change a system.
- 05
A plan to verify the fix
Define what fresh evidence would show that the particular correction worked. Record exclusions, unresolved gaps and any follow-up review.
02 / EIGHT AREAS TO SCOPE WITH YOUR TEAM
Follow the information.
Find the work that matters.
Explore the assessment areas
Select the areas that fit the practice’s actual systems, permissions and priorities. Not every engagement includes every area.
- Internet exposure
- Enrolled websites, domains and approved remote-access surfaces. Match observed software and configuration to applicable advisories; an exposed service is not proof of compromise.
- Identity and business email
- Supported sign-ins, privileges, forwarding and staff or contractor departures. Review who retains access and who is responsible for correcting it.
- Patient media and record access
- Sharing settings, external links and supported access/export metadata. Clinical photographs, scans and renders keep their source, purpose and permission context.
- Websites and intake
- Trace agreed form destinations and third-party transfers with fictional submissions. Distinguish an observed transfer from a configuration that needs review.
- Marketing and AI use
- Compare the asset, approved purpose, recipient and destination before publication or transfer where a reliable integration exists. Treatment permission is not marketing or model-training permission.
- Devices and recovery
- Use existing endpoint, device-management and backup evidence. Separate a successful backup job from a tested restore and necessary clinical availability.
- Monitoring health
- Surface stale sources, permission loss, missing event ranges, backlog and failed test signals. No alerts is not the same as no risk.
- Investigation and response
- Connect evidence, responsible people, permitted corrections and fresh checks. Keep accepted risks, incomplete changes and returning issues visible.
03 / KNOW WHAT THE REPORT MEANS
What you told us.
What was actually checked.
- Customer-reported
- Information supplied by your practice, such as a statement that backups run nightly. It still needs the appropriate verification.
- Publicly observable
- A specific observation from a permitted public check. It does not prove that your practice has been compromised.
- Verified within scope
- A permitted source or condition was checked, with the date, method and limitations recorded.
- Not assessed
- The necessary access, source or evidence was unavailable. The report keeps that gap visible.
ASSESSMENT METHOD
Specific assets.
Evidence before conclusions.
The assessment design includes internet-exposure and recovery-readiness review; it is not a universal scan or an automatic penetration test.
- 01
Confirm ownership and the boundary
Enroll the exact domains, systems and responsible people. Nearby IP addresses, shared hosting and a vendor’s wider infrastructure are not automatically included.
- 02
Use agreed, non-disruptive evidence
Review approved public observations, configuration records or separately authorized scanner results. Establish permitted methods, test windows and stop conditions.
- 03
Check whether a weakness actually applies
Match the product, version, configuration and reachability to the relevant advisory. Unknown versions remain unknown; a product name or software banner alone is not a confirmed vulnerability.
- 04
Prioritize and define the recheck
Consider supported exploitation evidence, access to sensitive data, impact and dependencies. Name the correction owner and the fresh evidence needed to verify the result.
YOUR NEXT STEP
Identify the weak points.
Plan the next step.
Tell us which systems your practice uses and what you want to protect. We’ll discuss the relevant scope, readiness and responsibilities before any work.