MediTrust Cyber runs the technical safeguards sitting beneath a healthcare security program, and keeps the paperwork showing that each one ran. Twenty four subscription lines. Every one carries a countable unit, a rate printed ahead of purchase, and a plain sentence saying where it quits being useful. Filed for medical and dental offices, for clinics, for behavioral health teams, and for whoever handles their billing.
Patient information leaves an office through ordinary doors held open for ordinary reasons. Nothing below counts as misconduct, and each item began with somebody keeping the day moving inside a clinic. What never got written is the closing entry: a date of return, and a name beside whoever checked it.
| What went out | Signed out for | How it travelled | Checked back in |
|---|---|---|---|
| Release of information | An attorney, an insurer, the next provider | Attachment on a message | No entry |
| After hours messages | The answering service, overnight | Mail into a shared box | No entry |
| The replaced workstation | A hardware refresh last spring | A drive behind the printer paper | No entry |
| The shared clinical inbox | Reading messages between rooms | A phone somebody bought themselves | No entry |
Records requests get answered all day. An attorney wants a chart, an insurer wants an operative note, a new provider wants the last two years. Somebody attaches the file and sends it. Most practices can say the request came in. Very few can say what left, on which day, to which address, and who authorized it.
The answering service takes calls overnight and passes them on by mail, so symptoms, dates of birth and callback numbers land in a shared box before the first appointment. Nothing ages any of it out. Two years on, that box is a searchable archive of clinical detail nobody set out to build.
A machine gets swapped out, the new one goes on the desk, and the old one goes in the closet. The practice management client is still installed, its cache is still on the drive, and no line anywhere records that the disk was wiped or that the box ever left the building.
A clinician adds the practice inbox to their own phone so messages can be read between rooms, which is exactly what a busy clinic needs from them. The handset is not enrolled and nothing on it is managed. When that person moves on, the mailbox goes with them.
Not one of the four needs a new policy written before it can be dealt with. Each needs somebody able to say what left, when, and whether it came back. That is the entire job of the lines shelved further down this page.
Nothing here is bundled and nothing is tiered. Choose a jacket, choose the lines inside it, and whatever you shelve arrives on one monthly charge. Every jacket page states what the software does, what a unit counts, and the exact point at which it stops helping you.
A red tab marks a jacket that acts while something is happening. Somebody or something intervenes at the moment of the event.
A blue tab marks a jacket that keeps a record you can go back to. Its value shows up later, when a question is asked about last month.
An agent rides each managed machine and forms its own view of what a piece of software is up to. A correlation layer lays those views beside sign-ins and mail movement. Engineers read the result through the small hours, when a building has emptied and a network has not.
Charts, claims and imaging open on a handful of machines. Across those, keeping a roster of software cleared to start beats asking a scanner to recognise whatever shows up in a fortnight. Missing from the roster means it never starts, and nobody is left judging in the moment how wrong something looked.
Cover fastens over the API onto the mailbox itself. Nothing stands in front of your mail the way a gateway would, and the difference is practical rather than semantic: correspondence delivered an hour back is still reachable. Beside it, brief drills for the colleagues handling referrals and remittances hour upon hour.
A list of machines that is true on the day it gets read. Patch state somebody can be shown. Filtering carried on the agent already installed. Apple hardware run as Apple hardware. And the handsets clinicians glance at on the way between rooms.
Regulated files settle in places nobody planned for. Locate them first and price the exposure. Then rule on which exits a file may use, and seal the copies bound to travel whatever anybody decides.
Copies of files. Copies of entire machines. Physical servers and virtual ones. The cloud tenants holding mail and documents. The directory settling who gets through a door at all. And a rehearsal showing that a restore hands back something readable.
A HIPAA security program is a list of obligations and only part of that list is software. Below is an honest split. Nothing in the right hand column can be bought from this storefront, or from anybody else, however carefully a page is worded.
Ten platforms carry twenty four lines, and each of the ten is named on this page. Any managed service that refuses to name whose agent runs on hardware full of patient records is asking you to extend a trust nobody there ever earned.
Behavioral agent living on the endpoint. Makes its mind up locally, whether or not a network is present.
The correlation layer. Puts an agent account of events alongside sign-in, mailbox and traffic evidence on one timeline.
Allowlisting. Approved software starts. Nothing else is offered the chance.
Protection attached to the mailbox itself over the API. Not a gateway, and never sold here as one.
The health, patch level and hardware list, gathered by one agent over Windows, macOS and Linux.
Apple management. Enrolment, profiles and software delivery across macOS and iOS.
Mobile threat defense running on the phone, forming its opinion there instead of asking a service.
Locating regulated material, scoring the exposure, then sealing documents one at a time.
Whole machine and file level copies, for workstations, for physical servers and for virtual ones.
Second copies held apart: Entra ID configuration, a QuickBooks Online company file, the Google Workspace tenant, the Microsoft 365 tenant.
Five stages, listed in the order they arrive, so that nothing in the opening fortnight lands sideways. Two of them want something from you. The other three do not.
Your card is charged, the order enters the build queue, and Stripe posts a receipt headed FORTIFY 24X7. Nothing at all is asked of you on that day.
Engineers here raise the tenant. Against each machine line an installer gets cut, with its enrolment link beside it. Cloud accounts your scope names receive authorization links of their own.
An opening sweep and an opening copy take longest, since both must cover everything in scope one pass before settling down. Leave machines powered throughout. After that, only differences ever travel.
Rosters bed in. Filters collect exceptions. Timetables get cut down to what your office truly holds. A small number of quick conversations with us belong to that period.
Alerting lands on our bench. It never lands in yours. The portal keeps whatever lines are charged to you, whatever installers were cut for your equipment, and each note the desk received from you.
Billing hands each rate over while this page comes up. Whatever a card shows is therefore the sum your card meets. Shelve as you go. Signing sits apart from all that, and it comes later.
Heads up: card statements show FORTIFY 24X7 - MediTrust Cyber is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.