Contact
Bring the person who will ask the hardest question.
A technical briefing walks through the schema, the three-listener split, the audit trail, and every limitation this site states, with your privacy office or security reviewer in the room rather than afterwards.
Security disclosure
A named contact who answers, and a clock they are held to.
Any hospital evaluating a third-party system asks two things early: who answers when something is wrong, and how fast. Report suspected vulnerabilities, suspected breaches, or anomalous behaviour in any component to the address below.
Acknowledgement
Within 24 hours of your report reaching us.
Assessment and containment
Begins within 48 hours of that acknowledgement.
Facility notification
A host facility's designated cyber security contact is notified within 24 hours of a suspected incident affecting that facility being confirmed. This is a contractual commitment and belongs in a pilot agreement verbatim. Tighten it if your own reporting duties require a shorter window.
What to include
What you observed, when, and the URL or host involved. Do not include patient information in the report itself.
On regulatory citations
NexLotus deliberately cites no specific cyber-incident reporting regulation. An earlier draft asserted a named Ontario regulation and a reporting clock derived from it; that citation could not be verified and was removed rather than restated. Your CISO and privacy office are the authority on which duties bind you and on what timeline.
Posture on request
Every security-relevant setting of a given host can be resolved and printed as a single report, safe to paste into a security questionnaire, with items that would block a review flagged as such. Ask for it and you get the real output, not a summary of it.
Named contact
Artin Naghipour, artin.naghipour9@nexlotus.com. This will move to a role-based address before any pilot contract is signed.