Accounts and staff
Who manages business email and account access? How are new staff, contractors and departures handled?
SHIELD RESOURCES
A useful conversation.
Starts with the right questions.
Bring the names of your systems, the people responsible and the questions you want to resolve. These resources help your team and IT provider prepare without sharing sensitive content.
Business inquiries welcome · Shield services are in development · View current availability
01 / QUESTIONS FOR YOUR TEAM AND IT PROVIDER
What do you use?
Who is responsible?
Patient information and vendors
Where are forms, records and photos stored? Which booking, marketing or AI tools may receive information, and for what purpose?
Backups and continuity
Who manages backups? What has actually been restored and checked? Who is the primary and alternate contact when something goes wrong?
02 / TERMS THAT CHANGE THE CONVERSATION
Similar words.
Different evidence.
- Reported or verified?
- A reported answer tells us what someone believes is in place. Verification checks the specified condition and records the limits.
- Connected or covered?
- A tool can be connected while important information is delayed or unavailable. Coverage should say what is actually visible.
- Finding or confirmed incident?
- Something requiring review is not automatically evidence of compromise or disclosure.
- Closed or fixed?
- A completed ticket or successful change request does not replace a fresh check of the result.
- Backup or recovery?
- A successful backup job and a successful restore test answer different questions.
- Guidance or legal advice?
- General education does not determine your practice’s legal obligations. Appropriate advisers review the actual facts.
03 / OFFICIAL STARTING POINTS
Helpful references.
Not endorsements.
For broader small-business cybersecurity guidance, start with these official resources. They do not certify Shield or assess your practice.
A PRACTICAL SCOPE CHECKLIST
Bring the context.
Keep sensitive evidence private.
- The organization and owners
- Which legal practice, locations, domains and systems are in scope? Who owns each source, approves access and handles IT changes?
- The information path
- Where do forms, photos, scans, records and communications originate? Which vendor, marketing or AI destination may receive each category and for what purpose?
- The available evidence
- Which audit/export records and product editions exist? What is their cadence and retention? Bring descriptions of the evidence—not raw patient records or security logs—to the public inquiry.
- The service and continuity expectations
- Who should review cases, receive an incident handoff and cover the alternate contact? Which changes could interrupt care? What has actually been restored and checked?
- The commercial boundary
- Which assessment or recurring scope is being discussed? Identify exclusions, vendor licenses, specialist work, review hours and unresolved costs before agreeing a price.
TEN SUPPORTING USE CASES
Which questions fit
your practice?
Explore the confidentiality scenarios
These are product-design scenarios, not findings about your practice or claims that every scenario is implemented. Three fictional workflows are implemented in the local pilot; the others require further integration and qualification.
Public patient-media link
Preserve the reported sharing state, asset owner and source evidence. Assign the access review and verify any corrected sharing state.
Access after a staff departure
Compare a recorded departure with supported account activity. Verify identity, timing and any authorized exception before restricting access.
Unapproved AI or analytics destination
Review the information category, purpose and destination together. Record missing permission evidence without treating it as proof of an unlawful transfer.
Compromised account or ransomware
Separate compromise evidence, affected resources and service disruption. Route containment and recovery through the responsible incident lead.
An accidental disclosure
Review a wrong recipient, mistaken publication or incorrect access grant as a confidentiality concern—not only deliberate attacks.
A vendor reports an incident
Connect the vendor to the practice’s affected data and responsibilities. Preserve notices and unresolved questions for the appropriate reviewers.
Facial or body-derived information
Distinguish a photo, clinical image, geometry and identity-related use. Do not automatically label every photograph regulated biometric information.
An intake form sends to the wrong place
Use a controlled fictional submission and a destination register to review the route. Preserve the exact observation and check a corrected route.
A lost or unmanaged device
Bring the existing device provider’s signal together with access and data context. Missing visibility is not proof that information was accessed.
Missing monitoring or recovery evidence
Open a coverage or recovery review when a source goes silent, records are missing or a restore is unverified.
YOUR NEXT STEP
Identify the weak points.
Plan the next step.
Tell us which systems your practice uses and what you want to protect. We’ll discuss the relevant scope, readiness and responsibilities before any work.