Independent cyber oversight for medical practices

If your systems went down tomorrow, would your practice be ready?

See where your EMR, backups, staff access, and AI tools stand. Get a clear action plan that your existing IT provider can help deliver.

Private resultNo patient informationYour MSP can stay involved
CMPA update · Sept 25, 2026CMPA stopped paying specified damages and settlements arising from cyber breaches. Other assistance continues. Read the accurate summary →

Three questions owners often cannot answer on the spot

Each scenario shows a practical gap and the evidence that would close it — without patient information.

EMR outage

Could we restore the EMR and keep seeing patients tomorrow?

Many clinics assume a cloud EMR means restore is “covered.” Hosting and contractual recovery are different questions.

Evidence that resolves it: written restore responsibility, last restore-test date, and a one-page downtime procedure.
Access

Who still has access after a physician, locum, or vendor leaves?

Shared logins and leftover remote tools are common — and hard to see without a checklist.

Evidence that resolves it: MFA report, named admin list, and same-day offboarding checklist used on the last departure.
AI scribe

Where does AI scribe audio go, and how is consent recorded?

Approved tools, vendor retention, and a consistent decline process matter before the next visit.

Evidence that resolves it: approved-tools list, vendor terms summary, and consent/decline script staff actually use.

What the clinic receives

The free check produces a private, self-reported result. Verified findings come later — and stay clearly labelled.

Example private report preview

Self-reported · not verified

47/100

Significant gaps to address — unknown answers counted as needing verification

Accounts & access62
Devices & network55
EMR & vendors48
Backup & downtime35
Incident readiness50
Staff awareness70
AI tools & scribes28

Top actions (example)

  1. Schedule a documented EMR/documents restore test.
  2. Publish an approved-AI list and staff rule.
  3. Confirm MFA for email, EMR, and remote access for every user.

Priority plan

Owners, due dates, and verification status once you save the check to a practice account.

Responsibility map

Clinic, MSP, EMR vendor, and KCC — who typically owns each follow-up.

Optional evidence review

Invite your MSP to confirm controls. KCC records source, reviewer, date, and next action.

Get my private result

How your MSP fits

Keep the IT provider you trust. KCC coordinates independent review; your MSP can upload evidence and carry out agreed work. You stay in control of access and decisions.

Clinic owner

  • Controls access & decisions
  • Approves quotes
  • Names privacy lead

MSP / IT provider

  • Day-to-day operations
  • Evidence & remediation
  • Cannot change KCC conclusions

EMR vendor

  • Hosts or supports EMR
  • Confirm backup/restore terms in writing

KCC

  • Independent assessment
  • Evidence review
  • Progress tracking for the owner

See roles in detail →

ON

Built for Ontario clinics

PHIPA-aware practice operations, CMPA cyber assistance changes, and AI scribe consent — starting in Ontario, structured so other provinces can be added later.

OT

Ottawa-based · King of CMS

KCC supports organizations across Ontario from Ottawa. CyberHealth is independent assessment and coordination — not a public badge, not insurance, and not a requirement to switch IT providers.

About KCC →

We do not publish invented client counts, ratings, or physician endorsements. Process and deliverables speak for the work.

From free check to optional monthly support

Concrete deliverables. Variable work is quoted in writing before any charge.

Free practice check

18 questions, domain scores, top actions, private PDF. No registration required for results.

For: every practice owner

Expert discussion

45-minute human review of your results and priorities with a clear next-step memo.

For: owners who want guidance

Verified review

Evidence-backed findings on MFA, devices, backups, EMR responsibility, AI vendors, downtime.

For: clinics ready to prove controls

Scoped remediation

From CAD $500 per system after written scope — never auto-charged from a questionnaire.

For: agreed technical fixes

Monthly oversight

From CAD $1,600/mo with endpoint allowance, hours, and exclusions in a signed quote.

Optional — never required

Check your practice’s readiness in about eight minutes

Walk away with a private score, three urgent actions, and a plan you can share with your MSP — without submitting patient information.