Compliance in small practices dies in a drawer. A binder gets bought, a webinar gets half-watched, and the risk analysis ages quietly into a liability. We exist to end that: one engagement, one fee, one deliverable you can hand an auditor and a front-desk team that has actually been fooled by a fake email — safely, on purpose.
Security consulting was built for companies that can afford a department. Your practice has a front desk, a router closet and a conscience. Somebody should build for that.
Lantern Ferry started from a plain observation: the independent clinics around Queens Blvd were being quoted enterprise-sized proposals — hourly meters, forty-page statements of work, a sales call for software they never needed. Or they were being quoted nothing, because nobody wanted the job.
So we built the small boat. A fixed fee you read before we start. One walk through your office. A report written for the office manager, not for another consultant. We named it for the oldest job in the city: carry people across, safely, and come back for the next load.
We don’t resell software, so none of our advice is a sales pitch. We don’t log into your charts, so there’s nothing to trust us with that you wouldn’t hand a locum.
Call it a manifesto if you like. We call it the reason our reports get read.
Every finding is ranked by what exposes patient privacy soonest and written in sentences a medical assistant can act on.
The usual way: a 90-page PDF of scanner output.
Ours: a ranked list, worst first, each with an owner.
The number goes in writing the day you call. It’s the number on the invoice.
The usual way: “we’ll bill as we go.”
Ours: $3,480 for the assessment. Done.
Staff don’t fail phishing tests; the training failed them. We fool people safely, privately, and teach in the same breath. Doctors see totals — never names.
The usual way: a leaderboard of who clicked.
Ours: one-page “before you click” card at every desk.
We look at how your systems are set up. We don’t open charts and we don’t change settings. The first time you’ll need to trust us is the first time you read the report.
The usual way: admin credentials handed over on day one.
Ours: walk, photograph the closet, ask questions.
Nobody can promise you’ll pass an audit. We can promise you won’t be empty-handed.
A current risk analysis, a trained front desk and a dated plan to close the gaps. That’s what an auditor wants to see — and it protects patients whether or not one ever knocks.
Saying no is how a small boat stays afloat. If you need any of these, we’ll point you to someone who does them well.
Twenty minutes, no deck. You describe the practice; we give you a fixed fee and a finish date in writing the same day — or tell you honestly that we’re not the right fit. We’re at 104-20 Queens Blvd, Forest Hills, and we schedule around your patient hours.
