book a scoping call

services & flat fees · Colchester, CT

we look carefully, write it down plainly, and stay on the call until it all makes sense.

Three engagements, one bundle and a short list of extras — each with its fee printed right beside it, like a decent diner menu. Pick one, pick all three, or book the scoping call and let us talk you out of the ones you don’t need.

book a free scoping call or read a page of the report first ↓

№ 01 · the engagements, opened up

what each engagement involves, right down to the router behind the x-ray

The honest inventory: what we poke at, what lands in your inbox afterwards, and how much of your team’s day each one borrows. If a line doesn’t apply to your office, the scoping call is where we cross it off — and knock it off the fee where it matters.

hipaa security risk assessment

flat$2,340per location

Required by the Security Rule. Recommended by anyone who has ever had to draft a breach letter.

The one the regulation actually asks for: an accurate, thorough look at where your patients’ electronic records live, who can reach them, and what could reasonably go wrong. Documented properly, so it holds its shape if an auditor, an insurer or a curious attorney ever asks to see it.

what we look at

  • Every workstation, laptop, tablet and server touching ePHI — imaging PCs very much included
  • Microsoft 365 or Google Workspace: sharing, MFA, forwarding rules
  • Backups, and whether anyone has ever actually restored one
  • Vendor access: EHR support, your IT vendor, the sensor company’s remote tool
  • Your written policies, held up against what really happens at the front desk
  • A short video tour of the office — screens, doors, the server closet

what you walk away with

  • A documented risk analysis with likelihood × impact for each threat
  • The fix-first report: every finding ranked, every finding owned
  • A policy-gap memo against the Security Rule safeguards
  • A 60-minute walkthrough call — bring your IT vendor, bring a snack
turnaround
10 business days after the last scan
your team’s time
A 45-minute interview + about 10 minutes per workstation
on every call
The consultant who signs the report
reserve an assessment

phishing simulation campaign

flat$1,18590 days · up to 25 staff

Bigger team? Each extra person is $18.

A dental receptionist eyeing a suspicious email on her monitor with a raised eyebrow

Ninety days of friendly deception. We send three rounds of convincing, harmless fake emails written the way real clinic scams are written — the “new fax received” lure, the denied insurance claim, the EHR password that “expires today.” Click one and you get a two-minute lesson instead of a ransom note.

what we send

  • Round one: a quiet baseline nobody’s been warned about
  • Round two: lures shaped around your EHR, your insurers and your vendors
  • Round three: the sneaky one, after your team has had the huddle
  • A “report this email” button set up in Outlook or Gmail, so suspicion has somewhere to go

what you walk away with

  • Click and report rates by role — front desk, clinical, billing — never by name unless you ask
  • Instant two-minute lessons for anyone who bites
  • A 20-minute lunchtime huddle on video before round three
  • A round-one versus round-three comparison, so you can watch the habits change
runs for
90 days, three rounds
your team’s time
One 15-minute setup call, then nothing — that’s the point
your IT vendor
Allowlists our sending domain; we send them instructions
set the bait

firewall & endpoint hardening audit

flat$1,670per location

Owning a lock and turning it are two very different hobbies.

Plenty of clinics own a perfectly good firewall configured to let in roughly everybody. We check whether the locks you paid for are actually turned — rule by rule, machine by machine — and hand your IT vendor a checklist they can work through without a translator.

what we look at

  • Firewall rules and port forwards — especially the one opened in 2017 “just for a minute”
  • VPN, remote desktop and every remote-support tool on the network
  • Multi-factor sign-in on each way in from outside
  • Patch levels, disk encryption (BitLocker or FileVault) and antivirus status
  • Local admin rights, and accounts belonging to staff who left three receptionists ago
  • Whether the guest Wi-Fi really is separate from the clinical one

what you walk away with

  • Rule-by-rule firewall notes, in sentences a human can read
  • Each workstation measured against CIS Benchmarks, gaps listed
  • A hardening checklist sorted by who does what
  • A walkthrough call your IT vendor is warmly invited to
turnaround
10 business days after the last scan
access we need
Read-only firewall access, granted by your IT vendor
your team’s time
About 10 minutes per workstation — after hours is fine
book the audit
all three · saves $615

the whole lantern

All three, sequenced so each feeds the next: the assessment finds the soft spots, the audit checks the locks around them, and the phishing campaign tests the people holding the keys. One combined report, one walkthrough, one invoice split in two.

flat$4,580bundle · one location
light the whole thing

№ 02 · a page from the report

this is what “plain english” looks like on paper

Most security reports are written to impress other security people. Ours are written for the practice manager with a full schedule and a cold coffee. Every finding gets a rank, an owner, a rough effort and one sentence explaining why it matters to your patients — not just to a scanner.

  • fix first

    This month. Before the next round of insurance forms.

  • fix soon

    This quarter. Put it on the vendor’s next visit.

  • fix eventually

    Once the new hygienist has found the good parking spot.

A printed fix-first report on a clinic desk with a highlighter and a mug of coffee

The page beside this is an illustrative sample — a made-up practice with very real-looking problems.

get one written about your office →
sample
Fix-first report · Maple Hill Family Dental page 4

findings, in the order we’d tackle them

fix first

Three reception PCs share one “frontdesk” login, with no multi-factor sign-in.

If that password leaks, nobody can tell who opened which chart — and neither can an investigator. Give each person their own login and switch on MFA in Microsoft 365.

Owner: practice manager + IT vendorEffort: an afternoon

fix first

Remote desktop on the imaging server is reachable from the open internet.

This is the door ransomware crews knock on first. Close the port forward and route vendor support through the existing VPN.

Owner: IT vendorEffort: about an hour

fix soon

Backups run nightly, but nobody has ever tried a restore.

A backup you haven’t restored is a hope, not a plan. Restore one patient folder to a spare machine and write down how long it took.

Owner: IT vendorEffort: two hours, once a quarter

fix eventually

The sterilization-room tablet sits on the guest Wi-Fi.

Low risk today, awkward later. Move it to the clinical network the next time the access points get touched.

Owner: Zinc Lantern can walk your vendor through itEffort: 20 minutes

Questions about this page? It’s on the walkthrough agenda.Signed by your consultant

№ 03 · which one fits

not sure which you need? find the sentence that sounds like your office

Match the worry to the engagement. Still torn between two? That’s precisely what the free scoping call is for, and we won’t upsell you on it.

  • if you’re thinking…

    “We’ve never done a risk assessment — or the last one is a PDF from 2019 that nobody has opened since.”

    the risk assessment$2,340
  • if you’re thinking…

    “Someone at the front desk clicked a ‘new fax received’ email last month. We think it was fine?”

    the phishing campaign$1,185
  • if you’re thinking…

    “Our IT person set up the firewall years ago, and we’ve all just sort of… trusted it.”

    the hardening audit$1,670
  • if you’re thinking…

    “The cyber-insurance renewal asks about MFA, backups and staff training, and we panicked a little.”

    the whole lantern$4,580
  • if you’re thinking…

    “We’re opening a second office and want to start it clean instead of copying the old mess.”

    assessment + second location$2,820
  • if you’re thinking…

    “We did every fix from our last report and would quite like someone to check our homework.”

    the follow-up re-scan$395

№ 04 · extras & the small print

the add-ons, priced to the dollar, and a few things we politely refuse to do

Every extra below gets written into the same one-page engagement letter, so the total is settled before a single scan runs.

à la carte

  • extra workstation$65 each

    Beyond the first 15. Imaging PCs and that one ancient Windows machine running the sensor software count too.

  • second location$480

    Another address under the same practice: its own network, firewall and front desk, folded into one report.

  • extra phishing staff$18 each

    For teams past 25 people. Part-timers and the Saturday crew are welcome to get fooled too.

  • bonus phishing round$240

    A fourth round, usually timed for the week before open enrollment or your busiest season.

  • follow-up re-scan$395

    Within six months of your report, we re-check every fix-first item and initial the ones you’ve closed.

  • live staff session$310

    45 minutes on video for the whole team, with an anonymous chat for the questions nobody asks in front of the boss.

  • policy & procedure pack$860

    Written HIPAA security policies that describe what your office actually does, ready for signatures.

  • annual refresh assessment$1,640

    For returning clients: we update last year’s analysis instead of starting from a blank page.

  • after-hours scan windowno charge

    Evenings by appointment. Your workstations are idle, and so is your front desk.

  • doing the fixes for youquoted after

    Once the report lands, if you’d rather we did the work, we’ll quote it flat. Handing the list to your IT vendor is completely fine.

№ 05 · your move

ready to start?

pick a lantern — or let us help you pick one

Twenty minutes on the phone, no invoice, and an honest recommendation — even when that recommendation is “just the phishing one, honestly.”

  • Flat fees from $1,185, printed in a one-page engagement letter.
  • A signed BAA before we look at anything with a patient attached.
  • Your fix-first report within ten business days of the last scan.
(860) 377-0798 appointments@zinclanterngroup.com

8 Christy Lane Ext Unit 20, Colchester, CT 06415 · Mon–Fri 8am–5:30pm · evenings by appointment

tell us about the practice